Resource IDs

Blazing Agents mints identifiers for public resources. Use their format for basic boundary validation, but store and transmit the complete value without parsing meaning from it.

Contract

Resource IDs are case-sensitive opaque strings. Base62 means [0-9A-Za-z]; each random body below is exactly 16 characters. A well-formed ID may still be missing, deleted, or outside the authenticated Tenant, and an ID never grants authorization.

Anchor	Resource	Public shape
`#ten`	Tenant	`ten_` + 16 Base62 characters
`#ag`	Agent	`ag_` + 16 Base62 characters
`#ss`	Session	`ss_` + 16 Base62 characters
`#ak`	API key record	`ak_` + 16 Base62 characters
`#prv`	Provider	`prv_` + 16 Base62 characters
`#mcp`	MCP Connection	`mcp_` + 16 Base62 characters
`#sb`	Sandbox	`sb_` + 16 Base62 characters
`#at`	Artifact	`at_` + 16 Base62 characters
`#tk`	Task	`tk_` + 16 Base62 characters
`#tr`	Task run	`tr_` + 16 Base62 characters
`#mem`	Memory	`mem_` + 16 Base62 characters
`#prompt`	Prompt	`prompt_` + 16 Base62 characters
`#skill`	Tenant Skill	`skill_` + 16 Base62 characters
`#skill_platform`	Platform Skill	`skill_platform_` + a lowercase name matching `[a-z0-9-]+`

API keys are credentials, not resource IDs. An API key is ba_ plus 40 Base62 characters and is shown only once; its ak_... record ID is used for list/delete operations and cannot authenticate a request. Display fragments such as ba_ab are neither IDs nor credentials.

The Session create path mints its ss_... ID and returns it in Location. Other create operations also mint their own IDs. The SDK exports no public resource-ID generator.

Some public fields intentionally retain native opaque formats rather than a platform prefix: Tool approval and continuation IDs, UI-message and Tool-call IDs, and caller-supplied Task-run idempotency keys. Internal DBOS workflow IDs are not public contracts. Successful Turn usage metadata contains native requestId and commitId values; pre-stream errors do not.

Admin Agent IDs still validate as ordinary ag_... IDs. Do not infer Admin status, ownership, or permission from an ID prefix or body.

Examples

These are valid-looking placeholders, not existing resources or usable credentials:

ten_0123456789abcdef
ag_0123456789abcdef
ss_0123456789abcdef
ak_0123456789abcdef
prv_0123456789abcdef
mcp_0123456789abcdef
sb_0123456789abcdef
at_0123456789abcdef
tk_0123456789abcdef
tr_0123456789abcdef
mem_0123456789abcdef
prompt_0123456789abcdef
skill_0123456789abcdef
skill_platform_web-search

Redacted API key (not a valid-looking credential): ba_REDACTED.

Validate untrusted input locally, then let the authenticated API enforce Tenant ownership:

import { agentIdSchema } from "@blazing-agents/core/ids";

const parsed = agentIdSchema.safeParse(input.agentId);
if (!parsed.success) {
  throw new Error("Malformed Agent ID");
}

const agent = await client.agents.get(parsed.data);

Used by

Source of truth

packages/core/src/ids.ts
packages/core/src/ids.test.ts
packages/server-core/src/ids.ts
packages/server-core/src/ids.test.ts
supabase/migrations/20260705031901_tables_tenants.sql
supabase/migrations/20260705031902_tables_apikeys.sql
supabase/migrations/20260705031903_tables_providers.sql
supabase/migrations/20260705031904_tables_skills.sql
supabase/migrations/20260705031905_tables_agents.sql
supabase/migrations/20260705031906_tables_sessions.sql
supabase/migrations/20260705031909_tables_artifacts.sql
supabase/migrations/20260705031910_tables_tasks.sql
supabase/migrations/20260705163109_tables_prompts.sql
supabase/migrations/20260705163122_tables_mcp_connections.sql
supabase/migrations/20260719000000_tables_memories.sql

See the capability and guide links under Used by.

Reference

See the implementation inventory under Source of truth.