Can an agent create a task with Shortcut REST API?
Who does each step
Whether the agent handles it alone or a person has to step in.
- 01
Discover
MachineThe vendor's machine-readable docs show the agent where and how to call this job.
- 02
Access
Workaround · setupYou give the agent a key or token.
- 03
Onboard
Workaround · setupYou sign up or register a client for the agent.
- 04
Pay
Not applicableNothing to pay for the job.
- 05
Confirm
MachineThe response or specification defines errors the agent can distinguish from success.
- 06
Sustain
Workaround · setupYou replace or revoke the agent's access when it needs to change.
- Access: handing over a key or token.
- Onboard: signing up or registering a client for the agent.
- Sustain: renewing, replacing or revoking its access.
To remove these handoffs: support OAuth client registration so the agent can register its own client and ask for consent; provide an agent registration route, such as auth.md, a sign-up API or OAuth client registration; provide key management or OAuth refresh and revocation so the agent can maintain its own access.
Agent surfaces
The probe
Each request it sent and what came back; the descriptors it read, counted, with what they named.
Discover29 descriptor reads4 facts
- Found
- For agentswww.shortcut.com/llms.txtOAuthapi.app.shortcut.comOAuthapi.app.shortcut.comOAuthapi.app.shortcut.com
- From
- www.shortcut.com/llms.txt · www.shortcut.com/openapi.json · api.app.shortcut.com/.well-known/oauth-authorization-server
- This endpoint
- api.app.shortcut.com is named by a descriptor it read
Job requestPOST api.app.shortcut.com/api/v3/stories40141 ms
- Request
- POST https://api.app.shortcut.com/api/v3/stories
- Response
- 401 · application/json · 172 bytes
- Body
- sha256:7a91ed2558b569dd621e8711609702410d01553e1d31a06ba50ea90acefdf095
- Exchange
- sha256:26d7651dc22a52bd037331d843b18e0f8d45e2c1b2162f4ecb46f6f2c29d704a
Resource metadataGET api.app.shortcut.com/.well-known/oauth-protected-resource/api/v3/stories40135 ms
- Request
- GET https://api.app.shortcut.com/.well-known/oauth-protected-resource/api/v3/stories
- Response
- 401 · application/json · 172 bytes
- Body
- sha256:7a91ed2558b569dd621e8711609702410d01553e1d31a06ba50ea90acefdf095
- Exchange
- sha256:1f62a8c08ff008ee24a8778a789ea5df1ae0b81aec764c57869cf2c2a05d126c
Resource metadataGET api.app.shortcut.com/.well-known/oauth-protected-resource40133 ms
- Request
- GET https://api.app.shortcut.com/.well-known/oauth-protected-resource
- Response
- 401 · application/json · 172 bytes
- Body
- sha256:7a91ed2558b569dd621e8711609702410d01553e1d31a06ba50ea90acefdf095
- Exchange
- sha256:6f827a340306a6a3feb0aa7faef5bcedc9a69d1950cc9e266fd0192a9dcfb878
Declared pageGET www.shortcut.com/signup301103 ms
- Request
- GET https://www.shortcut.com/signup
- Response
- 301 · application/octet-stream · 0 bytes
- Body
- sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Exchange
- sha256:3b1f29f33aee42f6a60194774212cceb17588390e70937d81f008732db677d0d
Shortcut on the startup-offers board
- Shortcut Business Plan + SAML SSO, 1 year freeShortcut Startup Program
The grade’s badge
One image that keeps itself current, linking here.
[](https://sourcey.com/c/shortcut/agent-readiness/shortcut-rest-api/task-create)Improve the report
Correct it, probe it again, or improve the path.
- Profile
- arp_01m4t9s32g9aqs41m9hc0mq79x
- Projection
- sha256:307fc324014d41e0ad1c6d19c8809789917668a04e793fdead771ff6cf558c89
- Policy
- kind-2026-10-12.2 · sha256:b612172aad277b54461de84e006815126f2df566563954b02f4432a39cad89ac
A report or a reassessment request names this profile, its revision and its projection. How report cards are assessed →View the exact declaration