What Is the OpenAI Agents API? Codex Harness, Sandboxes and the Enterprise Checklist 2026

One diagram explains the whole thing

The Agents API splits responsibility three ways, and the dashed line at the bottom of the diagram is the part enterprises should look at first, because it says one thing plainly: the agent's "brain" and its "hands" do not have to live in the same house.

Left to right: your app submits a task once, the Agents API runs the think–call tool–read result–think again loop and streams events back for you to render, and the box on the right is where commands actually execute, files actually get written, and artifacts are produced. That right-hand box does not have to be OpenAI's machine.

What a harness is, and why it is the hardest part of shipping an agent

Teams usually assume building an AI agent is mostly about picking a strong model. In practice the model is one piece; what eats engineering months is the harness — the code wrapped around the model that keeps it working over long horizons without falling apart. What the Agents API sells is therefore not a model but a harness: the same one Codex runs on.

What a harness must do	If you write it yourself	What the Agents API handles
Remember work across many turns	Store history yourself and resend the whole blob every call	Sessions keep state on OpenAI's side; you continue without rebuilding context
Running out of context	Write your own summarise/trim logic and hope nothing important is cut	Automatic compaction, applied independently to the root agent and to each subagent
Breaking a big job into parts	Write an orchestrator and merge the results yourself	Delegates to subagents working in parallel, capped by max_concurrent_subagents
Calling several tools at once	Queue them, handle errors and retries by hand	Parallel calls, chained operations, and result filtering before anything reaches the model
Too many tool definitions burning tokens	Push every tool schema into the prompt on every call	Tool search loads only the definitions needed, preserving prompt cache
Work that dies mid-run	Build your own recovery path	Resume the session and carry on — sessions are designed to run for days

How OpenAI got here

Read the launch alone and you only see a new product. Line the APIs up chronologically and the direction is obvious: OpenAI keeps moving work off the developer's plate and onto its own.

API	Status	Who owns the agent loop
Assistants API (beta)	Deprecated, shut down 26 August 2026	OpenAI — but opinionated about state and inflexible
Responses API	OpenAI's recommended migration target	Your application — full control, but you write every part of it
Agents API	Opened in public beta on 10 September 2026	OpenAI (the Codex harness), with a sandbox whose location you pick

Three sandbox options — and the one that decides whether you can use this at all

This is what the dashed line in the diagram represents, and it is why an API launch matters to compliance teams: where the sandbox sits is where the data your agent actually touches sits.

Option	Who runs the machine	Best fit
OpenAI-hosted	OpenAI provisions and maintains it; you supply files, install packages, add skills	Fastest start, no infrastructure to own, non-sensitive workloads
Self-hosted	Your own machines, inside your VPC, with your choice of CPU, GPU and memory	Data that cannot leave your network, or internal services that are not publicly routable
Partner sandbox	Nine providers integrated at launch: Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop and Vercel	The middle path — no machines to babysit, but you still pick the provider and region

What a real call looks like

The request shape is refreshingly plain: one endpoint, one session per job, then a stream of events back.

POST https://api.openai.com/v1/agents/sessions

{
  "model": "gpt-6-astra",
  "sandbox": { "type": "hosted" },          // or point it at your own machine
  "tools": [
    { "type": "mcp", "server_url": "https://mcp.example.com/erp" },
    { "type": "web_search" }
  ],
  "multi_agent": { "enabled": true, "max_concurrent_subagents": 4 }
}

Tools can be MCP (Model Context Protocol) servers over HTTP, your own functions, or built-ins such as web search. If your organisation already exposes an MCP server, wiring it to this agent does not mean writing a fresh adapter layer. The enterprise authentication side of MCP is covered separately in the MCP spec update on stateless enterprise auth.

Pricing: the API is free, the clock on the container is not

OpenAI charges no additional fee for the Agents API itself — you pay for tokens, tools, and container time. That last item is where bills quietly grow.

Item	Published OpenAI rate	What to watch
Agents API itself	No additional fee	The real cost hides in the three rows below
Container (hosted shell / code interpreter)	1 GB $0.03 · 4 GB $0.12 · 16 GB $0.48 · 64 GB $1.92 per 20-minute session container	Billed by the minute with a 5-minute minimum per session — an agent left open all day bills all day
Model gpt-6-astra	$10 input / $50 output per 1M tokens at short context; $20 / $75 at long context	Agent workloads read far more than they write, so input tokens grow fastest
Web search	$10.00 per 1,000 calls, plus search content tokens billed at model rates	Several subagents searching in parallel multiplies the call count immediately

Three things to check before signing off

For public-sector bodies and any organisation bound by data-localisation rules, those two lines are the first answer a compliance reviewer will ask for. Get them settled before a proof of concept, not after it.

The second item is tool scope. An agent useful enough to touch business systems is an agent with real permissions, which shifts the risk from "the model answered wrong" to "the model was talked into acting" — a different problem entirely. We cover it in Prompt Injection: the top AI agent risk before you connect it to business systems.

The third is traceability. If an agent can change records in a back-office system, you must be able to say who asked, when, through which tool, and whether it can be reversed. On the risk profile of the underlying model generation, see OpenAI Astra and the Critical cyber threshold.

Is Anthropic doing the same thing?

Yes — and it got there first. The mental model is nearly identical: separate the brain (a harness the vendor operates) from the hands (a sandbox whose location the customer chooses). The differences are in the controls.

Topic	OpenAI Agents API	Claude Managed Agents
Status	Public beta, 10 September 2026	Beta, launched earlier
Harness	The Codex harness, operated by OpenAI	Anthropic runs the loop; agents are stored, versioned config objects
Sandbox location	Hosted, self-hosted, or nine partner providers	Cloud environment or self-hosted sandbox, with MCP tunnels into your own network
Spend ceiling	No session-level cap found in the launch documentation (checked 13 September 2026) — govern it with org usage limits	Session budgets: a hard dollar cap per session, enforced by the platform, which stops issuing model requests at the limit
Scheduled runs	Not found in the launch documentation (checked 13 September 2026)	Scheduled deployments fire sessions on a cron cadence
MCP	Supported over HTTP transport	Supported, including tunnels to MCP servers that are not publicly reachable

The Anthropic side is covered in full in What Are Claude Managed Agents?, and for the coding-tool angle specifically, see Codex for Enterprises: License, Security and Governance.

What this has to do with ERP

Once the harness is something you can simply buy, the enterprise question shifts from "how do we build an agent?" to "what is this agent allowed to touch?" — and that is a question for whoever owns the back-office system, not for the model vendor.

At Saeree ERP we draw the line plainly: the ERP is the system of record, the AI is an assistant, never an approver. Integration runs through an MCP server that exposes only what was deliberately exposed, permissions follow the same role the user already holds in the system, and every call is written to the audit trail like any other transaction.

To be straightforward about scope: the residency limits above apply to OpenAI's service, not to the ERP — Saeree ERP still deploys on-premise in the customer's own data centre. For organisations under strict requirements, the pattern we have found workable is to let the agent work with summarised results through narrowly scoped tools, rather than opening the database wholesale to a model.

Conclusion: who it suits, and who should wait

A good fit if...	Not yet, if...
You want agents that run for days without writing your own compaction and recovery machinery	Your rules require data to stay in-country, or mandate Zero Data Retention
You already have MCP servers or internal tools and just need a brain to drive them	Your back-office systems still lack clear permission scopes and an audit trail
The work fans out naturally into parallel pieces — reviewing stacks of documents, for instance	There is no spend ceiling and no usage limit set; container time bills while sessions stay open
You want execution to stay inside your network without owning the orchestration	You only need single-shot question and answer — the Responses API is lighter and much cheaper

The useful takeaway for 2026 is that "who has the better model" is no longer the only question. Both vendors have converged on the same picture — separate the brain from the hands, and let the customer decide where the hands go. What an organisation has to prepare, then, is not a vendor choice but its own house: clear permissions, clear scope, and a trail someone can audit.

The harness is now something you can buy. What you still cannot buy is clear permission scope and an audit trail inside your own back-office systems — and that is what decides whether an agent becomes an assistant or a liability.

- The Saeree ERP team, Grand Linux Solution Co., Ltd.

References

• OpenAI — Agents API overview (official docs: endpoint, sandbox types, subagents, data residency and ZDR limits)
• OpenAI Developer Community — Introducing the Agents API and hosted sandboxes (launch announcement, 10 September 2026, with the sandbox partner list)
• OpenAI — API Pricing (container rates per 20-minute session, model rates, web search)
• OpenAI — Deprecations (Assistants API sunset, 26 August 2026)
• Anthropic — Claude Managed Agents overview
• Anthropic — Session budgets
• Anthropic — Self-hosted sandboxes