Automation#

Six jobs, in the order most people meet them.

Guide	The job
Your first API call	A token, `curl`, and the two conventions every other page uses
Stage and commit from a script	The write plane, and the confirm window that makes it safe
Config as code with `agent.yaml`	One file says what the router should look like
Keep the router aligned on a timer	The loop that closes the gap, and the two modes it runs in
Alert on drift	Knowing the router has moved away from the file
Point one agent at several routers	Fleet mode, and what it honestly does

The two conventions#

Every example on this site uses them.

bash

R=https://<router>:8443
T=wh_...                                    # an API token with the role the call needs
curl -sk -H "Authorization: Bearer $T" "$R/api/system"

Use a token, not a cookie. Token requests skip the CSRF header requirement that browser sessions have. Issue a token for automation.

-k is for a self-signed certificate. Drop it once you have a trusted one.

Three planes, three answers#

Plane	Role	Without a licence
Read	`viewer`	Works
Write — stage, commit, roll back, reconcile, apps	`operator`	402, with the reason
Admin — accounts, tokens, settings, licence, power, images	`admin`	402 for the mutating ones

Reads never need a licence. That is worth building around: a monitoring integration keeps working on a router whose subscription has lapsed, and so does getting the configuration off it.

What there is not#

Checked against agent/main.go · agent/license.go · docs/deploy.md · SUPPORT.md