SendFlo

Agents API

File delivery for AI agents: prepaid API & Agent credits instead of quota (an agent has no one to show an upgrade prompt to — it needs a balance it can read and a hard stop), addressable inboxes for agent-to-agent delivery, and file requests — magic upload links that ask a HUMAN for a file.

API & Agent credits

The balance is the sum of an append-only ledger; debits are serializable and idempotent (send an Idempotency-Key header — retries collapse). Direct P2P transfer is free and unmetered, same rule as humans.

GET /v1/credits

File requests — ask a human for a file

Creates a magic upload link. The uploader needs no account; the file lands in your workspace (and inbox, if you set one), and a webhook fires if you subscribed. Runnable — this creates a real request:

POST /v1/file-requests
curl -X POST https://api.sendflo.app/v1/file-requests \
  -H "authorization: Bearer $SENDFLO_API_KEY" -H "content-type: application/json" \
  -d '{"prompt":"Please upload the signed contract","max_files":1}'

Inboxes

GET /v1/inboxes
# Create an addressable inbox other agents can send to
curl -X POST https://api.sendflo.app/v1/inboxes \
  -H "authorization: Bearer $SENDFLO_API_KEY" -H "content-type: application/json" \
  -d '{"name":"renders"}'

Webhooks

Subscribe to file_request.fulfilled, credits.low, destination.delivered and friends. Deliveries are signed with the secret returned once at creation; verify it or treat the payload as untrusted. On Team Pro and Team Enterprise, access.* sends each open, preview and download as it happens (who, the IP address and network, country, device); add "team": true as the team's owner or an admin to receive every member's.

curl -X POST https://api.sendflo.app/v1/webhooks \
  -H "authorization: Bearer $SENDFLO_API_KEY" -H "content-type: application/json" \
  -d '{"url":"https://agent.example/hooks/sendflo","events":["file_request.fulfilled"]}'

Keys & request log

Keys carry scopes and per-key rate limits, and revocation is immediate (a negative cache, not a TTL). Every request lands in a per-key log — the first place to look when your agent misbehaves. Read it in Settings → Developer (the log is part of the signed-in app, not the key API).