Get Started on Cloud
BasicsAI AgentsPipelinesActions & ServicesEnvironmentsIntegrationsTargetsTestsDomainsSandboxesAgents & TunnelsYAMLBuddy GitCLIAPIFAQ

YAML for agents

View as Markdown

Learn how to configure agent tunnels and networking using YAML in Buddy pipelines.

YAML parameters for YAML for agents

Agent
agentstring
The agent identifier (human-readable ID).
namestring
The display name of the agent.
targetboolean | string enum
Whether the agent can be used as a deployment target.
Allowed enum:
on,
off
disabledboolean
Whether the agent is disabled and skipped when assigning work.
tagsstring[]
The list of tags used to match the agent to pipelines and targets.
proxyboolean | string enum
Whether the agent acts as a proxy for other agents.
Allowed enum:
on,
off
tunnelingboolean | string enum
Whether tunneling is enabled on the agent.
Allowed enum:
on,
off
tunnelsTunnelYaml[]
The list of tunnels (exposed endpoints) served by the agent.
permissionsPermissionsYaml
Access control settings for the agent.
notestring
Note for this resource
agent_notestring
YAML note for AI agents operating on this resource
Endpoint
endpointstring
The target address the endpoint forwards to (e.g. 'localhost:8080').
namestring
The endpoint name.
typestring enum
The endpoint protocol.
Allowed enum:
TCP,
TLS,
HTTP,
SSH
whiteliststring[]
The list of IP addresses/ranges allowed to access the endpoint.
timeoutinteger
The endpoint idle timeout in seconds.
regionstring enum
The region the endpoint is exposed from. When not set, the region of the agent is used.
Allowed enum:
US,
EU,
AS
httpHttpSettingsYaml
HTTP-specific settings (applies to HTTP endpoints).
tlsTlsSettingsYaml
TLS-specific settings (applies to TLS endpoints).
notestring
Note for this resource
agent_notestring
YAML note for AI agents operating on this resource
HTTP Settings
verify_certificateboolean
Whether to verify the upstream TLS certificate.
compressionboolean
Whether to enable response compression.
http2boolean
Whether to enable HTTP/2.
log_requestsboolean
Whether to log incoming requests.
request_headersobject
Headers added to forwarded requests (name to value).
whitelist_user_agentsstring[]
The list of user agents allowed to access the endpoint.
rewrite_host_headerstring
The value to rewrite the Host header to.
response_headersobject
Headers added to responses (name to value).
tls_castring
The CA certificate used to verify the upstream (PEM).
circuit_breakerinteger
The circuit breaker threshold (percentage, 0-100).
serve_pathstring
The local path to serve static files from.
auth_typestring enum
The authentication type for the endpoint.
Allowed enum:
NONE,
BASIC,
BUDDY
authHttpAuthYaml
The credentials used when authentication is enabled.
HTTP Auth
usernamestring
The authentication username.
passwordstring
The authentication password.
TLS Settings
private_keystring
The TLS private key (PEM).
certificatestring
The TLS certificate (PEM).
ca_certificatestring
The CA certificate (PEM).
terminate_atstring enum
Where TLS is terminated. Default: REGION.
Allowed enum:
REGION,
AGENT,
TARGET
Permissions
othersstring enum
Access level for other workspace members
Allowed enum:
DENIED,
READ_ONLY,
USE_ONLY,
BLIND,
RUN_ONLY,
READ_WRITE,
MANAGE,
DEFAULT,
ALLOWED,
STAGE,
COMMIT
usersobject
Map of specific users (username or email) to their access levels
groupsobject
List of user groups with their access levels
pipelinesAllowedPipelineYaml[]
List of pipelines allowed to access this resource
sandboxesAllowedSandboxYaml[]
List of sandboxes allowed to access this resource

Last modified on Jul 21, 2026

Previous pageYAML for sandboxesNext pageYAML for domains

YAML examples for YAML for agents

Minimal agent

yaml
- agent: my-agent
  name: My Agent

Agent with tunnels and permissions

yaml
- agent: prod-agent
  name: Production Agent
  target: on
  disabled: false
  tags:
    - backend
    - prod
  proxy: off
  tunneling: on
  tunnels:
    - name: web
      endpoint: localhost:8080
      type: HTTP
      region: EU
      whitelist:
        - 10.0.0.0/8
      timeout: 300
      http:
        verify_certificate: true
        compression: true
        auth_type: BASIC
        auth:
          username: admin
          password: secret
  permissions:
    others: DENIED
    users:
      dev@example.com: READ_WRITE
    groups:
      admins: MANAGE
    pipelines:
      - project: my-project
        pipeline: build
        access: USE_ONLY