How to connect an AI agent to your website reports

An AI agent can operate your website reports the same way you do. In IssueProbe, humans and agents are peer users: an authorized agent can complete each important account and setup action through the API, and every one of its actions appears in your audit history. You stay in control, because only a human owner can approve an agent and decide which credentials exist.

This guide walks through the complete path: what the agent can do, how you approve it, how it receives one scoped credential, and how you revoke it.

What an authorized agent can do

Once you approve an agent, it can work through the API on your account:

• Register a website and add its exact origins.
• Read and publish the public origin proof, with your prior authority.
• Request origin verification.
• Read the public read-only deploy key and confirm repository access.
• Read the widget installation snippet.
• Configure the evidence categories.
• Send a test report.
• Read reports and results with an approved scope.
• Start hosted checkout for a plan upgrade when you grant that scope.

Each of these actions has the same authorization and storage rules as the matching human action in the dashboard. An agent does not get a separate or weaker review path.

What only you can do

Three decisions stay with the human owner:

1. Approve or reject an agent enrollment.
2. Create an API credential.
3. Revoke an API credential.

An agent cannot create another credential, even if it asks for a credential-management scope. The enrollment scope list rejects that scope and any unknown scope, so the request itself fails rather than reaching you for approval.

Approve the agent yourself

The agent starts an enrollment request with your owner email, a name for itself, and the scopes it wants. IssueProbe sends you one owner authorization email with a link.

The authorization page shows the requested account name, agent name, and scopes. It does not show your email, the owner token, or the exchange secret.

Opening the link only shows the request. It never approves anything, and an automated link check cannot consume the owner token. Approval needs your explicit confirmation action on that page. Rejection needs the same explicit action.

If you reject a request for an email that has no account, IssueProbe creates no account, no session, and no credential. The enrollment and its exchange secret expire after seven days whether you act or not.

Exchange one secret for one scoped credential

After your approval, the agent exchanges its one-time exchange secret for one API credential. The exchange works exactly once, and a replay does not create a second credential.

The credential is a scoped bearer token:

• It appears once, at the moment of exchange.
• IssueProbe stores only a hash, so it cannot show the raw value again.
• It expires 90 days after the exchange.

Review the requested scopes before you approve. Typical scopes cover website setup, report reading, report actions, audit reading, and hosted checkout. Grant the smallest set that covers the job. An agent that only summarizes your reports does not need the scope that starts checkout.

If you lose the response with the secret, an exact retry before expiry or exchange can recover the same unused secret, so a lost network response does not force a new request.

Watch every action in the audit history

Each agent action is recorded in your audit history with an agent label, next to your own human actions. The history shows the actor, the action, the target, and the time.

You can read the history as the owner. An agent can read it only when you grant the explicit audit-reading scope. Without that scope, the agent cannot audit itself.

The credential list shows each credential's name, scopes, creation time, expiry, last use, and revocation state. It never shows a raw token, because the service does not keep one.

Start small and revoke freely

A safe first session needs little:

1. Approve the agent with the smallest scope set.
2. Let it register a test website or read existing reports.
3. Send one test report through the widget and confirm the agent can read it.
4. Check the audit history for the actions it took.
5. Revoke the credential when the job is done.

Revocation needs an explicit confirmation from you, and the credential stops working immediately after it. An agent that needs access again goes through a new enrollment, so you review its scopes each time.

Where to read more

The agent setup documentation covers the complete enrollment, setup, report, billing, expiry, and revocation flows with copyable request examples. The API reference documents each operation. For what happens to a report after a visitor sends it, read the report lifecycle. For how to judge the investigations your agent reads, read how to review an AI-generated bug investigation. The security page summarizes the access rules that protect your account.