tascan_delegate_to_agent
Mint a time-limited, NARROWER child API key (POST /delegations, roadmap #11) — only read/write scopes may be requested; full, agent:dispatch, agent:dispatch:code, device:admin, delegate and webhooks:manage are always refused by name (I-6). TTL defaults to 1 hour (3600s), clamps to [60 seconds, 24 hours], and clamps further to THIS key's own expiry if it has one — a delegated key can never outlive its grantor. The child's tier is always a SUBSET of this key's own effective tier, never wider or lateral. Requires the delegate permission (owner-only to grant, requires full). The returned raw key is shown to you exactly ONCE — it is never stored server-side and cannot be retrieved again (I-10). Revoking this key (or any ancestor) cascades immediately to every key it delegated.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | The agent’s job on the project: builder, researcher, reviewer, panelist, ... | |
| model | No | The model the agent runs on, e.g. claude-sonnet-5-5. | |
| scopes | Yes | Scopes to request for the child key — read and/or write only. | |
| vendor | No | The model vendor (defaults to this key’s own vendor). | |
| agent_id | No | Stable agent id used in receipts and the agent registry. | |
| ttl_seconds | No | How long the child key lives, in seconds (default 3600 = 1h; clamped to [60, 86400] and to this key's own expiry). | |
| display_name | No | Readable id for the agent, e.g. "LT-ZOOS-RSCH-02 · Zoos · Researcher 02". | |
| resource_constraints | No | Optional project sandbox: { "project_ids": ["<project uuid>", ...] }. Enforced on every call (migration 249): the child reaches only those projects. Must be a subset of this key’s own projects when this key is itself project-limited; omitted, the child inherits this key’s projects. |