Source: docs/integration/request-access.md

Request access

The Public API access bundle is issued out of band by the Forgium administrator.

The operator must configure the approved recipient and channel for each

environment; this public contract does not assume a specific ticketing system,

chat room, or email address.

What to request

Send the following template through the operator-approved channel:

Subject: Forgium Agent Public API access request

Application: <application name>
Owner: <team or contact>
Environment: <development | staging | production>
Purpose: <HTTP messages | capabilities | both>
Callback or host endpoint: <only if capabilities are required>

Please provide the environment-specific access bundle through the approved
secret-sharing channel. I need:
- FORGIUM_AGENT_BASE_URL
- FORGIUM_AGENT_API_KEY

Do not include the API key in this ticket, repository, prompt, or log.

The operator may require additional application or deployment details before

issuing access. Do not invent a URL, key, credential reference, or environment.

Validate the bundle

After receiving the values, keep them in the host application's secret

manager and validate the environment without echoing the key:

export FORGIUM_AGENT_BASE_URL="<value issued for this environment>"
export FORGIUM_AGENT_API_KEY="<value issued for this environment>"

curl -fsS "$FORGIUM_AGENT_BASE_URL/health"
curl -fsS "$FORGIUM_AGENT_BASE_URL/v1/capabilities" \
  -H "Authorization: Bearer $FORGIUM_AGENT_API_KEY"

The first response must identify the Forgium Agent API. The authenticated

request must succeed for the intended environment. A 401 means the key is

missing, invalid, expired, revoked, or paired with the wrong host; ask the

administrator to reissue the matching bundle rather than trying another

environment's key.

For a capability, also verify that the endpoint URL and endpoint credential

belong to the same environment before importing the manifest. See

Environments and Self-service business capabilities.

Security boundary