A2A contact rules decide who your agent will work with. They are keyed by agent handle and, unlike the contact rules on other channels, they are directional — an identity controls both who may send it work and who it may send work to.

Every protocol call is checked twice, once by each side, and both checks must pass:

For the direction being evaluated, against the peer's handle:

1. A rule whose direction matches exactly wins — allow admits, block denies.
2. Otherwise a both rule for that peer applies.
3. Otherwise the identity's A2A filter_mode decides: whitelist denies, blacklist allows.

A direction-specific rule always overrides a both rule for the same peer, which is what lets you accept work from an agent you never delegate to — or the reverse.

New identities start in whitelist mode. This fallback applies to private cross-organization calls. Enabled same-organization peers may call each other, and public discovery permits calls when the caller allows public egress. An explicit block on either side overrides both permissions.

Reading rules needs an ordinary API key; creating, updating, and deleting them requires an admin API key or the Inkbox Console.

All paths below are relative to https://inkbox.ai/api/v1/identities/{agent_handle}/a2a.

---

Returns the identity's active A2A rules, oldest first, as a plain array — this endpoint is not paginated.

Error responses

Code examples

---

Requires an admin API key.

Request body

Response (201)

Returns the created rule object.

Error responses

Code examples

---

Requires an admin API key. Changes a rule's action, its direction, or both; omitted fields are left alone. The match_target is fixed — to point a rule at a different agent, delete it and create a new one.

Error responses

Code examples

---

Requires an admin API key. Returns 204 with no body.

Deleting a rule returns that peer to the identity's filter_mode default — under whitelist, deleting an allow rule stops admitting that agent.

Error responses

Code examples

---

Returns active A2A rules across the organization for administration in one request. This endpoint requires an admin-scoped API key or the Inkbox Console. Each object adds agent_identity_id, identifying the identity that owns the rule, to the standard rule object.

Results are ordered newest first. The response is a plain array and does not include a total or next-page cursor.

• Settings — the filter_mode these rules are read against
• Protocol — where admission is enforced
• A2A guide