There is a supported, purpose-built path for this hand-off. Below is the current agent-based path so you can move immediately, and at the end I’ve flagged Pega Foundry, which is the recommended direction going forward.
The current path runs through the Pega Blueprint AI Agent for AWS Transform. You don’t call the Blueprint API directly — the agent is the bridge that takes your AWS Transform output and generates the Blueprint (case types, workflows, data model) for you.
I’ve also just updated the Setup Guide with more detail on the steps below (allowlisting, credentials, and the dev-vs-production configuration), so it’s worth a fresh read.
First step: get your AWS account allowlisted for AWS Transform
Before anything else — before contacting Pega for credentials — your AWS account has to be allowlisted by AWS Transform. Registering the agent into the AWS Transform registry from a non-allowlisted account will just return AccessDenied, so this is the gating step. Request it through your Pega representative or your AWS Solutions Architect, and share your AWS account ID and target environment when you do. Once that’s in place, the rest of the setup below can proceed.
Whom to contact for the signing key + credentials
These are provisioned by Pega, not something you generate yourself. Ask your Pega representative to onboard you for the Pega Blueprint AI Agent for AWS Transform. Two things get set up, both stored in AWS Secrets Manager:
-
OAuth client credentials (client_id / client_secret) — issued by the Pega Blueprint team for your target environment (dev vs. production). Stored as pega-blueprint-agent/oauth-client.
-
JWT signing key — the RSA private key that ships with the agent deployment, stored as pega-blueprint-agent/jwt-signing-key. Its public half is already registered with Pega’s JWKS, so you don’t manage key trust yourself.
One prerequisite worth flagging: in the default user_scoped mode the blueprint owner is auto-resolved from the identity signed into AWS Transform, so the AWS IAM Identity Center user must be the same email that owns a valid Pega Blueprint account — otherwise creation fails.
Direct integration, or an intermediate step?
Intermediate, by design. The agent handles authentication, file extraction/upload, and the Blueprint API call. You deploy it once on Amazon Bedrock AgentCore (subscribe from AWS Marketplace) and register it with AWS Transform (the allowlisting above is what unlocks the registration step).
How you send AWS Transform output in
Through a natural-language prompt in the AWS Transform console, e.g.:
▎ Create a blueprint called “Claims Modernization” for a claims processing application. Industry: Insurance. Use the files at s3://my-bucket/transform-output.zip
Accepted formats & sources
-
Sources: an S3 URI (s3://bucket/key), an HTTP/HTTPS URL, or a ZIP archive (up to 20 files per blueprint — the API max; the agent extracts and uploads them individually).
-
File types: PDF, Word (.doc/.docx), Excel (.xls/.xlsx), CSV, plain text, HTML, Markdown, JSON, XML, and images. Other types upload as application/octet-stream.
So your existing AWS Transform output (extracted rules, analysis reports, etc.) can be zipped and handed off as-is.
Reference documentation
The full walkthrough — Secrets Manager setup, IAM roles, AgentCore runtime creation, and AWS Transform registration — is in the Pega Blueprint AI Agent — Setup Guide (now updated with the extra detail mentioned above).
Recommended path going forward: Pega Foundry
While the agent flow above works today, the recommended solution for the AWS Transform → Pega Blueprint hand-off is Pega Foundry — see the attached screenshot for reference. It’s the direction we’re steering new engagements toward, so I’d suggest looking at that first and using it as your target for this integration. If you’re interested to learn more about Pega Legacy Transformation Foundry and see an opportunity to work together, please send a message to your local pega contact so we can discuss this further.
