Agent Fleet Management

Endpoint lifecycle:

Endpoint	Purpose
POST /api/agent/enroll	Enrollment-token exchange
POST /api/agent/heartbeat	Liveness + version + telemetry (incl. curl-impersonate variant counters)
GET /api/agent/config	Per-agent config + identity policy
GET /api/agent/proxy.pac	PAC file for browser proxy auto-config
GET /api/agent/install.sh	One-line installer script
GET /api/agent/bundle/:filename, /api/agent/bundle.js, /api/agent/download	Versioned bundles
GET /api/agent/version / /api/agent/health	Version + health probes
POST /api/agent/logs	Submit agent logs
POST /api/agent/web-traffic	Submit captured web-chat traffic
GET /api/agent/egress-tunnel/listen	Long-poll NDJSON channel — agent receives upstream egress jobs
POST /api/agent/egress-tunnel/respond/:reqid	Agent uploads upstream response

Fleet admin APIs:

• GET /api/admin/agent-fleet — list enrolled agents
• DELETE /api/admin/agent-fleet/:agentKey — deauthorize
• POST /api/admin/agent-fleet/:agentKey/action — send action (restart, update, disconnect)
• GET /api/admin/agent-fleet/egress-stats — egress tunnel + impersonation telemetry
• GET / POST /api/admin/agent-fleet/identity-policy — LLM-account-identity policy
• POST /api/admin/agent-fleet/identity-policy/test — dry-run a policy against a user
• GET /api/admin/agent-fleet/policy-events — policy decision events
• GET / POST / DELETE /api/admin/agent-fleet/identity-exemptions[/:id] — exemption list

Security: mTLS, enrollment token, bandwidth limit (MB/day), CRL Distribution Point served by client agent for cross-platform CRL access.

---