DelegatedAgentsService

service DelegatedAgentsService {
  rpc UpsertDelegatedAgent(UpsertDelegatedAgentRequest) returns (DelegatedAgent);
  rpc ListDelegatedAgents(ListDelegatedAgentsRequest) returns (ListDelegatedAgentsResponse);
  rpc ListDelegatedAgentOwners(ListDelegatedAgentOwnersRequest) returns (ListDelegatedAgentOwnersResponse);
  rpc RevokeDelegatedAgent(RevokeDelegatedAgentRequest) returns (RevokeDelegatedAgentResponse);
  rpc CreateDelegatedSession(CreateDelegatedSessionRequest) returns (CreateDelegatedSessionResponse);
}

​

Notes

• Owner-side RPCs require the master account.
• UpsertDelegatedAgent rejects a configured max_open_orders; no concurrent open-order cap is enforced.
• An owner holds at most 10 active, unexpired agents; UpsertDelegatedAgent rejects another past that until one is revoked or expires.
• An omitted expires_at defaults to 14 days from now, also on an update; one more than 180 days ahead returns INVALID_ARGUMENT.
• allowed_actions accepts CREATE_ORDER, CANCEL_ORDER, REPLACE_ORDER, READ, and MANAGE_RISK_BUCKETS; any other value returns INVALID_ARGUMENT. Every delegated session may read the owner’s data, so empty allowed_actions or only READ is a read-only key.
• Each listed scope must match: with markets and margin accounts both listed, an order needs a listed market and a listed account. An agent listing only margin accounts trades those accounts on any market; one listing only markets trades them in every margin account. Both empty deny all orders. Empty order-type and time-in-force lists are unrestricted.
• ip_allowlist holds up to 20 IP addresses or CIDR ranges; more, or an unparseable entry, returns INVALID_ARGUMENT. Empty allows any address. DelegatedAgent.ip_allowlist returns the entries normalized to CIDR form.
• Over REST JSON, agentAddress, allowedActions, and allowedTradingPairIds must be present. The other four policy arrays accept omission, null, or []. Protobuf repeated fields default to empty lists; the same policy semantics apply.
• CreateDelegatedSession exchanges an agent session for an owner-scoped delegated session. It returns PERMISSION_DENIED when no active delegation exists for the owner, or when the delegation has an ip_allowlist that does not include the caller’s address.