Skip to main content
POST
Offer Delegation
Creates a cross-tenant trust delegation offer. Trust delegations allow agents in one tenant to grant specific, scoped permissions to agents in another tenant — enabling secure multi-organization AI workflows without sharing credentials. Delegation offers are time-limited and scope-restricted. The target tenant must explicitly accept the offer before the delegation becomes active. All delegation lifecycle events are recorded in the transparency log.

Delegation Constraints

Cross-tenant delegations are a privileged operation. The offering agent must have the delegations:offer permission and the target tenant must be in the offering tenant’s trusted partners list.

Authentication

string
required
API key with delegations:offer scope. Alternatively, pass a Bearer JWT token in the Authorization header.
string
required
Tenant identifier of the offering party.

Request

string
required
MAIP agent identifier of the agent offering the delegation.
string
required
Tenant identifier of the target organization that will receive the delegation offer.
string[]
required
Array of permission scopes being delegated (e.g. datasets:read, models:read, orchestrations:execute). The accepting agent will only have access to these specific scopes.
integer
Maximum re-delegation depth. Range: 1 to 3. Defaults to 1 (no re-delegation). A value of 2 allows the accepting agent to re-delegate to one additional party.
integer
Time-to-live in hours. Range: 1 to 24. The delegation expires automatically after this period. Defaults to 1.
string
Human-readable description of why this delegation is being offered. Recorded in the audit trail.

Response

string
Unique delegation offer identifier.
string
Delegation status. Always offered on creation.
string
The agent that created the offer.
string
Tenant of the offering agent.
string
Target tenant that may accept the offer.
string[]
Delegated permission scopes.
integer
Maximum re-delegation depth.
string
ISO 8601 timestamp when the offer expires if not accepted.
string
ISO 8601 timestamp of creation.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Body

application/json
from_agent_id
string<uuid>
required

Delegating agent

to_agent_id
string<uuid>
required

Receiving agent

scopes
string[]
required

Scopes to delegate (must be subset of delegating agent scopes)

ttl_seconds
integer

Delegation time-to-live in seconds (max 7 days)

Required range: 60 <= x <= 604800
conditions
object

Conditional constraints on the delegation

Response

Delegation offered

delegation_id
string<uuid>
from_agent_id
string<uuid>
to_agent_id
string<uuid>
scopes
string[]
ttl_seconds
integer
conditions
object
status
enum<string>
Available options:
offered,
active,
expired,
revoked
token
string

Delegation acceptance token (returned on offer)

created_at
string<date-time>
expires_at
string<date-time>