> ## Documentation Index > Fetch the complete documentation index at: https://docs.visiqlabs.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a delegation grant > A parent agent creates a scoped, time-boxed delegation to a child agent. The grant starts `pending` and must be accepted within the accept window. Requires scope `allow:write`. ## OpenAPI ````yaml /api-reference/openapi.yaml post /orchestrate/grants openapi: 3.1.0 info: title: VisIQ Governance API version: 1.0.0 description: > The VisIQ platform API for governing agentic AI. One rule engine evaluates every governed agent event against your policies and returns a decision (permit, deny, approval-required, redact, mask, or escalate), records a cryptographically-verifiable audit trail, and governs agent-to-agent delegation. All requests are authenticated with a bearer API key. Mint a key in the dashboard under **Connectors -> API Keys**; it is presented as `Authorization: Bearer vq_prod_...`. Keys are scoped: harness/agent keys reach the operational surface (evaluate, rule bundles, telemetry, record ingestion), while management keys and dashboard sessions govern rules, agents, settings, and audit reads through role-based permissions. Decision vocabularies differ per facet. Action governance emits `permit | deny | approval_required | mask`. Retrieval governance emits `allow | deny | redact | escalate`. The unified `POST /evaluate` surface projects both into a single union vocabulary (`permit | deny | approval_required | redact | escalate | mask`). contact: name: VisIQ Labs url: https://docs.visiqlabs.com servers: - url: https://api.visiqlabs.com description: Production security: - bearerAuth: [] tags: - name: Evaluation description: Per-event governance decisions for action, retrieval, and delegation. - name: Action Rules description: Manage the rules that govern agent actions (writes/tool calls). - name: Retrieval Rules description: Manage the rules that govern retrieval and context exposure. - name: Unified Rules description: Operation-native rule management across both facets in one surface. - name: Rule Bundles description: Compiled, cacheable rule bundles the SDK runtime pulls per agent. - name: Agents description: Register and manage the agents whose events you govern. - name: Human-in-the-loop description: The approval queue for events that require a human decision. - name: Settings description: Per-account governance defaults. - name: Delegation description: Govern scoped agent-to-agent hand-offs with signed grant tokens. - name: Records description: Ingest, retrieve, finalize, and verify the tamper-evident audit trail. - name: Audit Log description: Versioned, paginated read APIs over recorded decisions and events. - name: Cognition description: >- Read captured Agent Cortex cognition sessions and beats (dedicated cognition:read scope). paths: /orchestrate/grants: post: tags: - Delegation summary: Create a delegation grant description: > A parent agent creates a scoped, time-boxed delegation to a child agent. The grant starts `pending` and must be accepted within the accept window. Requires scope `allow:write`. operationId: createGrant requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/GrantCreate' example: parent_agent_id: orchestrator child_agent_id: emailer tool_scope: - send_email duration_seconds: 3600 responses: '200': description: The pending grant. content: application/json: schema: $ref: '#/components/schemas/GrantCreateResponse' example: grant_id: 9a8b7c6d-5e4f-3210-9876-543210fedcba status: pending effective_tool_scope: - send_email effective_context_scope: null accept_deadline: '2026-07-16T12:05:00Z' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/UnprocessableEntity' security: - bearerAuth: [] components: schemas: GrantCreate: type: object required: - parent_agent_id - child_agent_id properties: parent_agent_id: type: string minLength: 1 maxLength: 255 child_agent_id: type: string minLength: 1 maxLength: 255 tool_scope: type: - array - 'null' default: null items: type: string minLength: 1 description: >- Allowlist of tools the child may use. `null` = unrestricted; `[]` = deny-all. context_scope: type: - array - 'null' default: null items: type: string minLength: 1 purpose: type: string maxLength: 2000 duration_seconds: type: integer minimum: 1 maximum: 604800 default: 3600 max_depth: type: integer minimum: 1 maximum: 16 parent_grant_token: type: - string - 'null' GrantCreateResponse: type: object properties: grant_id: type: string status: type: string enum: - pending effective_tool_scope: type: - array - 'null' items: type: string effective_context_scope: type: - array - 'null' items: type: string accept_deadline: type: string format: date-time Error: type: object required: - error description: > The standard error envelope. `details` carries the validation issue list on 400s; authorization failures add fields such as `detail`, `requiredScopes`, or `requiredPermission`. properties: error: type: string detail: type: string code: type: string details: type: array items: type: object additionalProperties: true additionalProperties: true responses: BadRequest: description: The request was malformed or failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Invalid request body details: - path: - agent_id message: Required Unauthorized: description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Unauthorized Forbidden: description: The key lacks the required permission or scope. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: insufficient_scope detail: This API key is not authorized for the requested operation. NotFound: description: >- The requested resource does not exist (or is not visible to this account). content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Rule not found UnprocessableEntity: description: The request was well-formed but could not be fulfilled. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer description: > A VisIQ API key presented as `Authorization: Bearer vq_prod_...`. Mint keys under **Connectors -> API Keys** in the dashboard. ````