Skip to main content
Authentication proves which Agent API session is calling. Authorization decides whether that account may perform the requested operation. A valid JWT does not imply access to every resource group.

​
What the API description establishes

  • Most operations inherit JWT bearer authentication.
  • Operations with security: [] explicitly override that bearer requirement.
  • Some operation descriptions mention additional account, identity, key, or review prerequisites.
The current OpenAPI document does not provide a complete machine-readable privilege name or role requirement for every operation.

​
Application checklist

  1. Read the generated operation’s authentication requirement.
  2. Identify the account, Legal Identity, key, contract role, provider, or operator prerequisite stated by the workflow.
  3. Ask the Neuron operator for the narrowest role or privilege set that satisfies those requirements.
  4. Test one permitted and one denied case in the target environment.
  5. Treat a bearer token and the privileges of its account as separate security decisions.

​
Do not infer privileges

Do not copy privilege names from MCP scopes, administration roles, legacy pages, or a different deployment into Agent API code. Until operation-level privilege metadata is verified, the deployment owner is the source for the exact grant. Related: Authentication, Security and transport, and OpenAPI reference.