Implementation library

Service API guides for encrypted automation and agents

Choose the capability your workload needs, understand its security boundary, and follow a practical path from signed service identity to encrypted delivery or human-approved agent retrieval.

Browse API guides CLI overview Security model

Start with the job, then choose the scope

Ordinary service accounts automate encrypted upload, inventory, sharing, revocation, and download. AI agent principals use a separate owner-approved protocol for exact case artifacts. Begin with the smallest function and principal type that can complete the job.

Use each guide as an implementation brief

Every whitepaper explains the API function, required trust boundary, operational benefits, route or tool sequence, deployment cautions, and concrete use cases. The signed-in Service API guide remains the source for deployment-specific values and one-time credential setup.

Keep plaintext and reusable secrets out of the wrong layer

Service tokens, signing keys, encrypted key bundles, and passphrases belong in protected backend environments. Files are encrypted before upload, while agent approval and key rewrapping stay with the case owner rather than moving into an unattended server shortcut.

Capability library

Choose a Service API workflow

01 Service account authentication and signed API requests Build a backend identity that can automate encrypted delivery without putting a reusable secret in browser code or treating a bearer token as the only proof of identity. 3 min read · 7 implementation topics 02 Encrypted file upload and download automation Use a service account as a cryptographic client: encrypt locally, upload only authenticated ciphertext, complete the encrypted manifest, and decrypt only inside the authorized workload. 3 min read · 6 implementation topics 03 Share provisioning and access lifecycle automation Provision recipient-specific access only after the encrypted upload is complete, then automate expiration, download limits, status tracking, and revocation without exposing a raw file key to the server. 3 min read · 6 implementation topics 04 Human-approved agent access to exact encrypted artifacts Give a customer-controlled agent a narrow path to request specific case evidence without allowing it to browse the workspace, inherit ordinary service scopes, or bypass the owner who controls the file keys. 3 min read · 6 implementation topics 05 Workload identity federation for AI agents Replace an agent bootstrap token with short-lived credentials tied to an exact external workload identity, while keeping the agent signing key and owner-approval protocol as independent security boundaries. 3 min read · 6 implementation topics 06 Continuous access signals for agent credentials Respond to identity risk after an agent is configured by binding one trusted Shared Signals transmitter and applying an explicit audit, access-revocation, or suspension policy to each supported event. 3 min read · 6 implementation topics 07 MCP adapter for owner-approved agent access Expose the delegated-access lifecycle to an MCP client without turning ZipPigeon into a plaintext proxy or allowing a generic OAuth bearer token to bypass the agent key and case owner. 3 min read · 6 implementation topics 08 Transaction context for agent authorization evidence Export a deterministic record of who initiated an agent request, which workload and resources it names, what the owner authorized, and whether that historical context still corresponds to current state. 3 min read · 6 implementation topics

Frequently asked questions

Which guide should a new backend integration read first?

Start with service account authentication, then read encrypted file automation and share lifecycle automation for the operations your workload needs.

Are AI agents ordinary service accounts?

No. AI agents use a separate principal type, separate request and consume scopes, and owner approval for exact eligible case artifacts.

Build the smallest trusted integration that does the job.

Use the signed-in Service API workspace for deployment-specific setup, then keep credentials and decryption inside your controlled backend or agent runtime.

Open Service API workspace Read the CLI overview