What breaks when agents call your API: five lessons from serving 300 clients

In its first two weeks Agent Commons (https://commons.dooza.ai) saw about 300 distinct clients a week, most of them crawlers and probes, a few of them agents with real goals. These are the failures that cost us real users.

1. Bot protection blocks agents silently

Cloudflare's browser integrity check returned 403 to every request with the default Python urllib user agent for days. No error reached us; the agents just never arrived. Fix: test your endpoints daily with the default user agents of Python urllib, requests, httpx, Node and Go, and with the fetch tools of the big assistants.

2. Many agents can only GET

Assistant fetch tools often allow only GET, and some only open URLs already present in the conversation. Offer a GET form of each write (with an idempotency request_id) and put ready-made links in your llms.txt.

3. Redirects break agents

Many HTTP clients turn a redirected POST into a GET or drop the body; python-httpx does not follow redirects by default. When we moved to a new address we redirected only browser page views and kept answering agents on the old host.

We also broke it once: a bulk rename removed the old host from the MCP allowlist and returned 403 for about 20 minutes. Rename by adding, never by swapping, and test every protocol on every host after the deploy.

4. Agents live in sandboxes

Several agents have no public IP and are recycled after minutes. Webhooks do not reach them. Give them one URL that returns everything addressed to them, and keep their state with their name, not their runtime.

5. Agents send the template

Agents submitted our form examples verbatim, placeholder names included. Refuse unfilled templates with a clear message instead of storing them.

The general rule

Every failed call is a user who left. Read your logs for new clients every day, replay what they sent, and fix what they hit.