POST Confirm an agent update
/api/v1/monitors/{id}/agent-update
New native installations enable remote updates with a separate key permission. An icon in the server list appears when a newer approved version is available. The workspace owner confirms each update; wait for confirmation after restart. Configuration-write permission is independent. Temporary contention returns 503 with update_busy and Retry-After: 1. Retry with the same operation_id and confirmed target; the interface retries for up to ten seconds. An accepted request is returned again without creating another update. The opaque target_id binds the approved release and source installation/version; refresh and confirm again if they change.
On this page
Access and permissions
New native installations enable remote updates with a separate key permission. An icon in the server list appears when a newer approved version is available. The workspace owner confirms each update; wait for confirmation after restart. Configuration-write permission is independent. Temporary contention returns 503 with update_busy and Retry-After: 1. Retry with the same operation_id and confirmed target; the interface retries for up to ten seconds. An accepted request is returned again without creating another update. The opaque target_id binds the approved release and source installation/version; refresh and confirm again if they change.
Browser session: __Host-mb_session cookie.
When using a browser session for a mutation, send the current CSRF token in X-CSRF-Token with the same-site cookie. OAuth consent uses its documented form field.
Parameters and headers
| Field | Location | Type and limits | Required | Meaning |
|---|---|---|---|---|
| id | Path | string; {"format":"uuid"} | Yes | Confirm an agent update |
Request body
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | AgentUpdateStart | Yes | — |
| $.target_id | string; {"pattern":"^[0-9a-f]{64}$"} | Yes | — |
| $.operation_id | string; {"format":"uuid"} | Yes | — |
| $.confirm | boolean; {"const":true} | Yes | — |
Responses
| Stable error codes |
|---|
| unauthorized |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| csrf |
| insufficient_scope |
| invalid_origin |
| owner_required |
| forbidden |
| agent_config_write_required |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| not_found |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| stale |
| not_available |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| invalid |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| quota_exceeded |
| rate_limited |
| Header | Type and limits | Meaning |
|---|---|---|
| Retry-After | string; {"pattern":"^[0-9]+$"} | Seconds before retry. Preserve supported idempotency identifiers and respect the operation’s mutation semantics. |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| unavailable |
| update_busy |
| Header | Type and limits | Meaning |
|---|---|---|
| Retry-After | string; {"pattern":"^[0-9]+$"} | Seconds before retry. Preserve supported idempotency identifiers and respect the operation’s mutation semantics. |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
application/json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | AgentUpdateJob | Yes | — |
| $.id | string; {"format":"uuid"} | Yes | — |
| $.installation_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | — |
| $.state | string; {"enum":["pending","running","succeeded","failed","expired","unconfirmed"]} | Yes | — |
| $.phase | string; {"enum":["downloading","installing","restarting","completed"]} | Yes | — |
| $.target | AgentUpdateTarget | Yes | — |
| $.target.commit | string; {"pattern":"^[0-9a-f]{40}$"} | Yes | — |
| $.target.version | string | Yes | — |
| $.target.created_at | string; {"format":"date-time"} | Yes | — |
| $.target.file | object; {"additionalProperties":false} | Yes | — |
| $.target.file.name | string | Yes | — |
| $.target.file.platform | string; {"enum":["linux","darwin","windows"]} | Yes | — |
| $.target.file.architecture | string; {"enum":["amd64","arm64"]} | Yes | — |
| $.target.file.kind | string; {"const":"binary"} | Yes | — |
| $.target.file.sha256 | string; {"pattern":"^[0-9a-f]{64}$"} | Yes | — |
| $.target.file.size | integer; {"minimum":1,"maximum":268435456} | Yes | — |
| $.requested_at | string; {"format":"date-time"} | Yes | — |
| $.updated_at | string; {"format":"date-time"} | Yes | — |
| $.claimed_at | string; {"format":"date-time"} | null | Yes | — |
| $.claimed_at (anyOf 1) | string; {"format":"date-time"} | No | — |
| $.claimed_at (anyOf 2) | null | No | — |
| $.finished_at | string; {"format":"date-time"} | null | Yes | — |
| $.finished_at (anyOf 1) | string; {"format":"date-time"} | No | — |
| $.finished_at (anyOf 2) | null | No | — |
| $.error_code | string | Yes | — |
| $.monitor_id | string; {"format":"uuid"} | Yes | — |
| $.operation_id | string; {"format":"uuid"} | Yes | — |
| $.source_version | string; {"maxLength":128} | Yes | — |
| $.source_sha256 | string; {"pattern":"^[0-9a-f]{64}$"} | Yes | — |
Retries and asynchronous work
This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.
HTTP 202 means the background job was accepted. Use the returned job ID to check its status. Download results when the job is complete, or inspect its error or cancellation status.
Request examples
Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.
Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.
curl --silent --show-error --output /dev/null --write-out "%{http_code}\\n" \\
--request POST \\
--header @"$HOME/.config/metribeacon/headers.txt" \\
--header 'Content-Type: application/json' \\
--data-binary '{"target_id":"0000000000000000000000000000000000000000000000000000000000000000","operation_id":"00000000-0000-4000-8000-000000000001","confirm":true}' \\
"https://metribeacon.com/api/v1/monitors/00000000-0000-4000-8000-000000000001/agent-update"
import json
from pathlib import Path
from urllib.request import Request, build_opener, HTTPRedirectHandler
headers = json.loads((Path.home() / ".config/metribeacon/headers.json").read_text())
headers["Content-Type"] = "application/json"
request = Request('https://metribeacon.com/api/v1/monitors/00000000-0000-4000-8000-000000000001/agent-update', method='POST', data='{"target_id":"0000000000000000000000000000000000000000000000000000000000000000","operation_id":"00000000-0000-4000-8000-000000000001","confirm":true}'.encode(), headers=headers)
class NoRedirect(HTTPRedirectHandler):
def redirect_request(self, request, fp, code, message, headers, target):
return None
with build_opener(NoRedirect()).open(request, timeout=10) as response:
print(response.status)
import { readFile } from "node:fs/promises";
import { homedir } from "node:os";
import { join } from "node:path";
const headers = JSON.parse(await readFile(join(homedir(), ".config/metribeacon/headers.json"), "utf8"));
headers["Content-Type"] = "application/json";
const response = await fetch("https://metribeacon.com/api/v1/monitors/00000000-0000-4000-8000-000000000001/agent-update", { method: "POST", headers, redirect: "manual", signal: AbortSignal.timeout(10000), body: "{\"target_id\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"operation_id\":\"00000000-0000-4000-8000-000000000001\",\"confirm\":true}" });
console.log(response.status);
await response.body?.cancel();
package main
import ("bytes"; "encoding/json"; "fmt"; "net/http"; "os"; "path/filepath"; "time")
func main() {
home, err := os.UserHomeDir(); if err != nil { panic("home directory unavailable") }
raw, err := os.ReadFile(filepath.Join(home, ".config/metribeacon/headers.json")); if err != nil { panic("private headers unavailable") }
headers := map[string]string{}; if json.Unmarshal(raw, &headers) != nil { panic("invalid private headers") }
request, err := http.NewRequest("POST", "https://metribeacon.com/api/v1/monitors/00000000-0000-4000-8000-000000000001/agent-update", bytes.NewBufferString("{\"target_id\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"operation_id\":\"00000000-0000-4000-8000-000000000001\",\"confirm\":true}")); if err != nil { panic("request unavailable") }
for key,value := range headers { request.Header.Set(key,value) }; request.Header.Set("Content-Type","application/json")
client := &http.Client{Timeout:10*time.Second,CheckRedirect:func(*http.Request,[]*http.Request)error{return http.ErrUseLastResponse}}
response,err := client.Do(request); if err != nil { panic("request failed; credentials and response omitted") }; defer response.Body.Close(); fmt.Println(response.StatusCode)
}
Related guides
- HTTP API, OAuth and MCP
Find the user API endpoints, their permissions, fields, examples and response formats.
- GET Read agent update availability and progress
New native installations enable remote updates with a separate key permission. An icon in the server list appears when a newer approved version is available. The workspace owner confirms each update; wait for confirmation after restart. Configuration-write permission is independent. Temporary contention returns 503 with update_busy and Retry-After: 1. Retry with the same operation_id and confirmed target; the interface retries for up to ten seconds. An accepted request is returned again without creating another update. The opaque target_id binds the approved release and source installation/version; refresh and confirm again if they change.
- DELETE Permanently delete a monitor
Only the workspace owner may permanently delete a monitor. First request a five-minute configuration-bound preview, then send preview_id, confirm_deletion: true and an Idempotency-Key. Unconfirmed legacy archive requests are rejected. The monitor is immediately blocked; a durable job removes all its database, archive and cache data and cleans linked displays. Read the job until complete; paused jobs show a technical error and retry automatically. Daily quotas and security counters remain unchanged. Previously delivered messages and downloaded files cannot be recalled.
- GET Read your monitor and configuration
Read your monitor and configuration.