Admin SDK
UseContoAdmin for organization-level automation: provisioning agents, attaching wallets, assigning
policies, and creating agent SDK keys. Use the regular Conto client for agent runtime payment
calls.
Initialize
Provision an agent
This is the common backend setup flow:CONTO_API_KEY.
ORGANIZATION_CONTROLLED requires the organization owner to register its public authorization key
in Settings → Wallet Control first. Use CONTO_MANAGED when customer self-service key export is
not required. Wallet responses return controlModel and keyAccess so provisioning systems can
reconcile the selected boundary without receiving provider IDs. Organization-controlled creation
is currently EVM-only until a validated Solana provider policy is configured. If keyAccess is
EXPORT_RECONCILIATION_REQUIRED, fail closed and wait for provider reconciliation before attempting
another export.
Agent responses include the caller-owned externalId, parsed allowedContexts, the owner’s stable
membership reference, and callback configuration so provisioning systems can reconcile what Conto
stored. Callback query and fragment values are redacted in responses; send callbackUrl again when
rotating a callback token. agents.list({ search }) also matches externalId.
The setup field reports READY or ACTION_REQUIRED with normalized issues and the request field
to update. It is intended for customer setup automation; provider state and arbitrary agent metadata
are not returned. linkedWalletCount and transactionCount provide stable list-level reconciliation
counts without exposing database relation objects.
Method map
Policy version history
Every change to a policy is versioned. Review the history, diff two versions, and roll back.Scopes
Admin SDK methods use organization API key scopes. Read methods need the matching*:read scope.
Create, update, delete, link, assign, provision, freeze, and revoke methods need the matching
*:write or admin scope. See Authentication for key creation
and rotation.
Security notes
- Organization keys can manage all agents and wallets in the organization.
- Prefer scoped keys for CI and provisioning jobs.
- Rotate keys regularly and revoke unused keys.
- Billing plan changes are available only to owners in the dashboard; organization API keys cannot change billing plans.
Related
Authentication
Key types, scopes, and rotation
Payments
Agent runtime payment calls
Policies
Policy types and evaluation behavior
API Reference
OpenAPI and REST reference links