OpenAI launched the Agents API in public beta for all developers on September 10, providing a managed version of the Codex harness for long-running work. Durable sessions, automatic context compaction, tools, sandboxes, tracing, webhooks, and optional subagents now sit behind one API surface.
The easy reading is that OpenAI finally put “Codex as a backend” on the menu. That is accurate, but incomplete. The consequential product is not another endpoint. It is a transfer of operating responsibility: OpenAI can now run the loop and preserve agent continuity while your application decides which tools exist, which effects are allowed, which artifacts count, and whether the requested outcome actually happened.
That makes this a sequel to RohitAI’s earlier coverage of the Agents SDK as a runtime migration and the Assistants API shutdown. Those pieces argued that retries, state, credentials, and external effects do not disappear when an abstraction gets friendlier. The new API lets teams rent more of that machinery, but it does not make those obligations vanish.
RohitAI’s read: the migration unit is an operating contract, not an endpoint. Decide which continuity, recovery, compute, authority, evidence, and cleanup duties you want OpenAI to own. Keep the rest explicit—and test the seams before production.
A durable agent session is not a durable business transaction. It may remember the work. Your system still has to remember what was accepted and what already changed outside the session.
Three OpenAI surfaces, three ownership contracts
The Agents API does not obsolete every existing agent stack. OpenAI’s runtime comparison presents the Agents API, Agents SDK, and Responses API as distinct choices. A team that already completed a Responses migration has not suddenly chosen the “old” path.
Surface | Who runs the loop and state | Best fit | What your application still owns |
|---|---|---|---|
Agents API | OpenAI runs the Codex harness and managed session | Long-running work where managed continuity is worth the dependency | Domain tools, consequential effects, acceptance, durable business records, and any self-hosted compute lifecycle |
Agents SDK | Your application runs the harness and stores its runtime state | Teams that want a model-native loop with application-controlled orchestration | Deployment, recovery, upgrades, policy, effects, and evidence |
Responses API | Your application composes lower-level model and tool calls | Custom workflows that need precise control or a smaller abstraction | The loop, history, retries, tools, effects, and acceptance |
The interesting decision is therefore not “managed or manual?” It is where your control boundary belongs. A regulated workflow may prefer a smaller primitive because it needs application-owned evidence. A product team with a proven tool layer may value managed continuity. A mixed fleet may use all three.
RohitAI’s GPT-6 Astra launch analysis made the adjacent point: the harness can materially change observed model performance. That conclusion drew on a separate ARC Prize provider-adapter evaluation, not an Agents API benchmark. This beta moves the next question from “does the harness matter?” to “who operates, versions, and pays for it?”
“Self-hosted” describes compute, not the whole system
OpenAI’s architecture guide separates the harness from the execution environment. The harness is OpenAI-hosted in every Agents API deployment. The environment can be an OpenAI sandbox, infrastructure you operate, or no environment at all. In the last mode, remote MCP tools and application-handled functions can still work, while local files, shell commands, patching, and executor-side MCP are unavailable.
That third option deserves more attention than it will get. The cheapest managed agent may be the one with no sandbox: a research approval flow, CRM lookup, or ticket triage agent may need continuity and remote tools but no filesystem runtime. Remove unnecessary compute first; then decide where the remaining tools should execute.
PLANE 1 inference + managed session state OpenAI
PLANE 2 command execution + live filesystem hosted, self-hosted, or none
PLANE 3 credentials + tool authority + effects application and tool providers
PLANE 4 accepted artifacts + audit ledger your durable systemsOriginal insight #1: deployment location and data governance are separate purchase decisions. Running commands in your VPC does not move the managed session into your VPC. The four planes above should appear separately in an architecture review; “self-hosted agent” is too vague to approve.
The current Agents API data-controls row says API data is not used for training, abuse-monitoring logs may be retained for 30 days, application state remains until deletion, and the endpoint is not eligible for Zero Data Retention. The beta’s overview currently lists US-only data residency and explicitly says a self-hosted sandbox does not change the ZDR limitation.
Credential design crosses another plane. OpenAI’s environment security guidance warns that code running in an environment can read credentials placed there. Keep the application key outside the sandbox, broker narrowly scoped credentials when possible, constrain egress, and assume that anything injected into executable context is visible to agent-written code.
Durable sessions still have recovery seams
A managed session can outlive a client connection, and turns run asynchronously. That is useful continuity. It is not exactly-once execution, event replay, or a job queue. Those distinctions decide whether an interrupted agent quietly resumes, loses work, or repeats a side effect.
Layer | What the API preserves | What it does not prove | Recovery test |
|---|---|---|---|
Stream | New live events after connection | That missed events will replay | Disconnect mid-turn; buffer new events while reconciling saved items by identity |
Session and turn | Saved items, turns, cancellation history, and continued work | That every tool succeeded or the business outcome was accepted | Inspect outputs and effect receipts before marking the task complete |
Self-hosted executor | A bounded wait for an executor connection | That late connection restarts timed-out input or a killed command | Restart the worker at connection and mid-command boundaries; reconcile before retry |
Hosted workspace | Published output artifacts after turn completion | That the live filesystem lasts as long as the session | Expire the sandbox and reconstruct the accepted result from durable storage |
The event recovery documentation says streams do not replay missed events. Recovery means opening a new stream, reading saved session items and turns, and merging the two views without duplication. It also warns that an idle session or closed stream is not evidence of success, and a completed turn may still contain failed tools.
Self-hosted execution adds another gap. The environment lifecycle guide documents an input wait of up to five minutes for executor connection; connecting after a timed-out submission does not replay it. A mid-turn disconnect can fail a tool without reconnecting or restarting the command. Deleting the session does not stop provider compute or restore its files elsewhere.
For OpenAI-hosted execution, the sandbox guide says an environment can be deleted after an hour without activity and keep-alive signals; that is not a fixed one-hour run limit. Files published from /workspace/outputs on turn completion remain available as immutable artifacts after sandbox expiry, although necessary outputs should be saved before session deletion.
Original insight #2: teams buying durable sessions will often keep an application job ledger anyway. It should record the business request ID, session and turn IDs, input hash, tool call identities, downstream receipts, artifact references, acceptance result, and retry decision. That ledger is not a duplicate agent transcript. It is the system of record that lets you determine whether resubmission is safe.
request accepted
!= stream connected
!= turn completed
!= every tool succeeded
!= external effect committed once
!= artifact acceptedSubagents make tool transport a permission decision
Multi-agent mode is opt-in. OpenAI’s multi-agent guide sets a default concurrency of six children, excluding the coordinator. Children get separate context but share the session filesystem and environment. They inherit MCP tools, credentials, allowlists, web-search configuration, and environment access. Function tools are not available to subagents.
Original insight #3: moving a function behind MCP so a child can call it is not a transport-only refactor. It changes who can act with its credentials. Root-only application functions can be a useful authority boundary; parallelism is not automatically worth weakening it.
Shared execution also means “six workers” is not six isolated computers. Partition editing by file ownership or explicit merge boundaries, give paid tools quotas, and let one coordinator adjudicate contradictory findings. As RohitAI argued in its analysis of multiagent safety patterns, worker count is not the same as useful diversity.
Scope: assign each child a bounded question, artifact, or file set.
Authority: review inherited MCP credentials and egress as a delegation policy.
Budget: cap root and child inference, paid searches, runtime, and retries separately.
Acceptance: require the coordinator or an external gate to verify evidence before consequential writes.
Open source helps inspection; your exit drill measures portability
The Codex repository is public under Apache 2.0. That lowers the cost of inspecting the harness lineage and understanding behavior. It does not establish an export-and-import contract for managed session history, event semantics, compaction state, dashboard traces, or hosted operational guarantees.
Original insight #4: open code can reduce inspection cost while switching cost grows elsewhere. The honest portability test is an exit drill: take your own ledger, inputs, tool schemas, and accepted artifacts, then reconstruct a useful task in another runtime. If you cannot do that, repository availability has not made your production state portable.
OpenAI is also entering an existing managed-harness market. Claude Managed Agents launched in public beta in April; Gemini Managed Agents followed in public preview in May; and AWS AgentCore Harness reached general availability in June. Cursor had already exposed its harness through a programmatic SDK. The useful comparison is not who said “managed agent” first. It is which operating contract fits your workload.
AWS documents immutable harness versions, rollback, and export to Strands code. OpenAI’s beta promises versioned access to capabilities, but the reviewed documentation does not establish a separately pinnable harness revision or a supported full-state export. That gap will matter to enterprise buyers even if the first pilots perform well.
The orchestration line item is free; the work is not
OpenAI says there is no separate Agents API fee. Model inference, paid tools, and OpenAI-hosted containers are billed separately. That pricing is attractive, but it moves attention downstream: longer loops, child inference, retries, search calls, container time, third-party APIs, and human validation all remain part of task cost.
The current pricing page lists container rates by size and 20-minute session, with a per-minute footnote and five-minute minimum for eligible sessions. It also prices standard web search per call plus retrieved-content tokens. Do not turn those tables into a universal “agent costs three cents” claim: the documentation does not map every Agents run to one container size or billing behavior.
Accounting is also less mature than autonomy. The observability guide says session and turn usage is best-effort, can be null or revised, and omits separate cache-write counts. Detailed trace retrieval and external trace exporters are not available through the beta customer API; traces are inspected in the dashboard.
RohitAI’s read: a completion event is not an invoice. Preserve task IDs and cost components in your own ledger, reconcile against authoritative billing, and compare total spend per accepted outcome. The new competitive metric is recovery-adjusted task cost, not whether a vendor adds an orchestration surcharge.
A seven-day pilot that can actually reject the API
Do not start by moving your easiest demo. Run a matched pilot against the harness you already operate. Keep the model, tools, source material, budget, and acceptance rubric fixed so you can observe the runtime rather than accidentally benchmarking a model change.
Use three representative tasks
Document review: extract decisions and citations from a long packet, including one rare constraint placed near the beginning.
Read-only incident investigation: query logs and remote tools, produce a timestamped evidence trail, and prohibit changes.
Coding task: modify several files, run tests, publish an artifact, and require independent review before merge.
Inject failures on purpose
Close the event stream mid-turn. Reconnect, fetch saved history, and prove the UI neither loses nor duplicates work.
Make a tool commit an external effect, then time out before the success response is recorded. Retry only after reconciling an idempotency key and downstream receipt.
Restart a self-hosted executor before connection and again during a command. Verify your queue distinguishes “accepted,” “started,” “effect unknown,” and “safe to retry.”
Run long enough to trigger natural context rollover. Check whether the early rare constraint survives in the final artifact; keep authoritative constraints in retrievable records.
Let two subagents propose changes to the same file. Confirm ownership rules or merge adjudication prevent silent overwrites.
Allow a hosted sandbox to expire, then rebuild the accepted deliverable from published artifacts and application-owned records.
Measure acceptance, not animation
Gate | Pass condition | Metric |
|---|---|---|
Outcome | Independent reviewer accepts the artifact without hidden cleanup | Accepted tasks, reviewer minutes, escaped defects |
Recovery | Every interruption resolves to resume, reconcile, or safe retry | Recovery rate, duplicates, lost requests, p95 completion time |
Authority | No worker can exceed its intended tool, credential, or release scope | Denied actions, inherited scopes, approval bypasses |
Economics | Managed runtime improves total accepted-output cost | Inference, child work, tools, compute, retries, human review |
Exit | A task can be reconstructed elsewhere from owned records | Time to export inputs, rebuild state, and verify the result |
Record the requested model, beta API version, saved-agent revision, complete tool schemas, environment image, skill or prompt revision, application policy, and eval-set version for every run. The configuration guide says session overrides replace whole objects and arrays rather than deep-merging them, so a partial tools override can silently replace the saved allowlist. Test the exact configuration you intend to ship.
Set a rejection threshold before the pilot begins. If missed-event recovery needs manual archaeology, a ZDR requirement is non-negotiable, accepted-result cost rises, or the team cannot reconstruct state outside the service, keep the existing SDK or Responses path. A public beta is permission to evaluate, not a mandate to migrate.
Questions the beta does not answer yet
The reviewed public material does not establish a general-availability date, quantified reliability SLA, exhaustive model-compatibility list, practical maximum subagent depth, customer-configurable compaction threshold, full trace export, or an independently pinnable harness rollback. OpenAI examples use Astra, but examples are not a compatibility matrix.
Those are procurement and pilot questions, not reasons to dismiss the launch. They are also why launch testimonials—including the customer-reported improvements OpenAI highlights—should not be treated as controlled benchmarks. No substantial independent hands-on benchmark of this API was available at research time.
Frequently asked questions
Does the Agents API replace the Agents SDK or Responses API?
No. OpenAI documents all three as current runtime choices. The API rents a managed Codex harness; the SDK keeps the loop in your application; Responses exposes lower-level primitives. Choose by ownership requirements, not name freshness.
Does a self-hosted environment keep the whole agent in my VPC?
No. It relocates execution, not the OpenAI-managed harness and session service. Review inference and session data, command execution, credential brokering, and artifact storage as four separate planes.
Are subagents isolated sandboxes?
No. They have separate context but share the session environment and filesystem. They also inherit important MCP and credential configuration, so concurrency and authority must be designed together.
Is usage data sufficient for customer billing?
Not by itself in the public beta. Documented usage can be missing or revised and does not expose every cache-write count. Use it for operations, then reconcile customer charges against authoritative billing and your own task ledger.
What should be the first production gate?
A verifier outside the agent’s own success claim. Require artifact checks and side-effect receipts before publishing, deploying, paying, or marking a business request complete. A completed turn is transport state, not acceptance.
The product is managed continuity, not managed accountability
The Agents API is a meaningful OpenAI platform launch because it turns the Codex harness into infrastructure a developer can rent. It can remove a large amount of loop, session, compaction, and coordination code. For teams already maintaining that machinery, the productivity gain could be substantial.
But abstraction changes the location of responsibility more often than it eliminates responsibility. Your durable advantage will not be the prettiest session stream. It will be the owned ledger, narrow authority, recovery drills, portable evidence, and acceptance gates around it.
My prediction: within a year, serious managed-agent evaluations will ask for exportable trajectories and documented harness-version rollback as contract features. Until then, the safest way to adopt this beta is simple: rent the harness, keep the truth.