OpenAI opens the Codex harness to third-party apps as the Agents API, with managed sessions and sandboxes

OpenAI opened the Codex harness to third-party applications on Thursday as the Agents API, a managed service that OpenAI's own documentation describes as giving an application "access to the Codex harness through an OpenAI-managed API". The same harness that runs Codex now sits behind a public endpoint, and OpenAI owns the pieces most teams have been writing themselves: sessions, orchestration, context compaction and recovery. The Hacker News thread on the developer docs reached 65 points in about three hours.

What a session actually is

The Agents API is built around a session, which the docs define as "a durable instance of an agent that works on tasks and responds to input". A session holds state across turns, so a team does not rebuild the conversation and tool history on every request. Sessions go through a fixed lifecycle: creation, task assignment, progress monitoring, then continuation or steering across more turns. Every code example in the overview page uses the model gpt-6-astra.

Agents inside a session run in a sandbox that can execute code, edit files, and connect to servers over the Model Context Protocol. The tools the docs list are programmatic tool calls, MCP server connections, a built-in web search, and artifact production. An agent can spawn subagents up to a configurable limit shown in the docs as max_concurrent_subagents: 4.

Pricing, residency, and a real constraint

OpenAI's pricing statement on the page is short. Model use is billed at the selected model's API rates, OpenAI-provided tools use standard rates, and OpenAI-hosted sandboxes are billed at standard container rates. Commenters on Hacker News reported that the sandbox meter runs in twenty-minute blocks, which is worth knowing before pointing many parallel sessions at a small task.

Two constraints in the docs will decide whether some teams can use the service at all. Data residency for the Agents API is currently the United States only, and Zero Data Retention is not supported, including when the sandbox is self-hosted. A team on a European data agreement or a contract that requires ZDR cannot ship this to production today, even with its own execution environment.

The rest of the interesting decisions live at the tool boundary. A team still writes and hosts the tools the agent calls, and still provides an execution environment for anything it does not want running in an OpenAI sandbox. What OpenAI takes over is the loop between those pieces: the state that has to survive a network blip, the compaction of a long conversation, the recovery when a step fails and the agent has to try something else.

That loop is the part every team building an agent has been rewriting for a year. Moving it to a managed API means an application can ship a background agent without owning the harness code, and pay OpenAI directly for the compute the agent burns. The trade is the one the docs already state out loud: US residency, no ZDR, and a sandbox meter someone has to watch.

Source

OpenAI developer docs: Agents API overview, and OpenAI: Introducing the Agents API.