Skip to main content

OpenAI Agents API: Codex Goes Serverless, But Data Stays in the US

OpenAI Opens the Agent Floodgates

OpenAI has quietly flipped the switch on its Agents API, a new service that hands developers the keys to the same Codex harness that powers its internal coding agents. The move, spotted in the company's developer docs, turns what was once a client-side tool into a fully managed, server-side platform.

At its core, the API is deceptively simple. There's just one endpoint—POST /v1/agents/sessions—and a single required header (OpenAI-Beta: agents=v1). But don't let the minimalism fool you. Under the hood, OpenAI is handling session management, orchestration, context compression, and recovery. Your app brings the tools and decides where the code runs.

Four Building Blocks, One Managed Service

The documentation boils everything down to four concepts:

  • Agent: The model, instructions, tools, and MCP servers.
  • Environment: An optional sandbox or computer where the agent reads, writes, and executes commands.
  • Session: A persistent agent instance that processes tasks and responds to input.
  • Events and items: The inputs and outputs that flow during a session.

The workflow is straightforward: create a session, assign a task, stream or webhook the results, then continue or intervene as needed. OpenAI's managed harness takes care of the heavy lifting—running code in a sandbox, applying skills, connecting to external data via MCP, compressing context, and even delegating subtasks to subagents.

Multi-agent support is enabled through agent.multi_agent, with a max_concurrent_subagents setting. Tools come in three flavors: programmatic_tool_calling, mcp (HTTP transport), and web_search. Environments can be self_hosted or an OpenAI-managed sandbox.

The Fine Print: US-Only Data, No ZDR

Pricing follows the model: you pay for model usage, standard rates for OpenAI tools, and container rates for the managed sandbox. But two data restrictions stand out. Data residency is currently limited to the US, and the API does not support Zero Data Retention (ZDR)—even if you opt for a self-hosted sandbox, it won't become ZDR-compliant.

The SDKs cover Python, TS/JS, Go, Java, and Ruby, all unified under client.beta.agents.sessions.create(...).

Community Split: Convenience vs. Lock-In

Reactions from developers have been mixed. Some question whether it's wise to hand session management over to OpenAI, while others point to pricing ambiguities. One user tested the sandbox network access and found three modes: enabled, disabled, and restricted. In restricted mode, external domains return "Domain forbidden." He also wondered about billing—does each session spawn a new environment? Are environments billed for at least an hour? Can you close them early to save costs?

On the bigger question—why use this API instead of running the SDK yourself—the community is divided. Critics argue it's "more like strengthening vendor lock-in." Supporters are pragmatic: "to avoid the hassle of maintaining a sandbox VM ourselves."

Architecturally, the Agents API essentially server-izes the Codex client's harness, making long-running agents that can read and write files and split subtasks into first-class API citizens for any backend. The trade-off? You're handing session state and execution environment to OpenAI.

Key Points

  • OpenAI launches Agents API with a single endpoint for managed agent sessions.
  • Handles orchestration, context compression, and recovery; supports sandboxes and MCP tools.
  • US-only data residency and no ZDR support, even with self-hosted sandboxes.
  • Pricing: model usage + standard tool rates + container rates for managed sandboxes.
  • Community concerns: vendor lock-in, billing opacity, and network restrictions.