Manage producer identities — persons, firms, and their addresses, phone numbers, bank accounts,
and insurance policies.

Authentication

Every endpoint requires an OAuth2 client credentials token. Request one using the client ID and
secret issued to you, then send it as Authorization: Bearer <token>.

Use the token endpoint that matches the environment you are calling — a sandbox token is not valid
against production, or vice versa:

Environment	API base URL	Token endpoint
Sandbox	https://api.sandbox.agentsync.io/id	https://auth.sandbox.agentsync.io/oauth2/token
Production	https://api.agentsync.io/id	https://auth.agentsync.io/oauth2/token

The machine-readable tokenUrl in this document is the sandbox endpoint, because OpenAPI 3.0 allows
only one token URL per flow. If you generate a client from this spec and point it at production, override
the token endpoint to the production URL above.

Two scopes govern access: identity.profiles.read for all read operations and
identity.profiles.write for creates, updates, and deletes. A token missing the required scope
returns 403 with code unauthorized_scope.

Pagination

List endpoints use opaque token-based pagination. Pass page_size to set the page size and
page_token to continue from a previous response. page_size defaults to 25 when omitted; a value
outside [1, 250] is rejected with 400 rather than clamped, so validate before sending.

Responses wrap results in an envelope:

{
  "items": [ ... ],
  "page": { "size": 25, "nextToken": "eyJ2IjoxLCJrIjp..." }
}

page.size is the number of items actually returned, so it is 0 on an empty result and may be
smaller than the page_size you requested on the last page. Keep requesting while
page.nextToken is non-null; it is null on the final page. Treat the token as opaque — its
format is server-controlled and may change without an API version bump.

Errors

Errors share one shape across every endpoint:

{
  "message": "Validation failed",
  "details": [ { "param": "email", "message": "must not be blank" } ],
  "code": "validation_failed"
}

Branch on code, which is stable and machine-readable — never on message, which is a
human-readable summary and may be reworded. details carries per-field validation errors on
400 responses and is empty otherwise.

Rate limiting

Every response carries ratelimit-limit, ratelimit-remaining, and ratelimit-reset headers.
On a 429, use the Retry-After header directly as your retry delay — it already accounts for
server-side backoff. Because the limit is a sliding window, ratelimit-reset is a hint rather
than a hard reset point; retrying at exactly that instant may still return 429 under sustained
load.