# Control Plane API

> Mint agent identities, set resolver policy and read query logs with one CALL whisper.agents verb over graph.whisper.online/api/query.

*Source: https://www.whisper.security/docs/control-plane*

---
Everything you change about an agent goes through one Cypher procedure, `whisper.agents`, posted to one endpoint. The same endpoint answers graph reads, so one key and one URL cover both provisioning and investigation.

```bash
curl -s https://graph.whisper.online/api/query \
  -H 'X-API-Key: whisper_live_...' \
  -H 'content-type: application/json' \
  --data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'list', args: {kind: 'agents'}})"}
JSON
```

[The request envelope](/docs/control-plane/envelope) has the wire format: how to build the map literal by hand, and the columns every answer arrives in. [Keys and scopes](/docs/control-plane/auth) covers where a key comes from and which authority each call needs. The [operations](/docs/control-plane/operations) chapter carries one page per operation, each with its arguments and its return columns. When a call comes back with `ok: false`, [error codes](/docs/control-plane/errors) says what the code means and whether the call is worth sending again.

Two sides of the plane need no key at all. [Keyless endpoints](/docs/control-plane/keyless) is the verification, registry and log surface, which anyone can call to check an identity you minted without holding an account here. [Discovery files](/docs/control-plane/discovery) lists the machine-readable manifests an agent reads to find the rest on its own.