External callers reach registered agents through the API gateway AI-core lane. The frontend builds URLs with the same rules as buildA2aUrl in the product:
Replace the host with your environment’s gateway base (NEXT_PUBLIC_BACKEND_SERVER_URL → /api/v1, then append /ai for the AI-core lane). Graph Studio and Agent Registry copy the authoritative string for your tenant—always use the value shown in the UI rather than constructing URLs manually.For local development with the dev API proxy, the same paths may appear under http://localhost:3000/api/v1/ai/a2a/....
Callable by any client presenting a valid Phinite API key
organization
Organisation
Callable only when the API key belongs to the same organisation as the registry row
At runtime, the gateway A2ARegistryAccess middleware validates visibility when agents are invoked (for example POST /api/v1/ai/a2a/agents/{registryId}). Organisation-scoped agents return an auth error if the caller’s org does not match.Auth scheme in the product: callers use your organisation’s API key (JWT) in the X-API-Key header unless your deployment configures additional schemes.