As I understand it, I would need to imbed a valid agent's username and password in any API request. This is somewhat impractical - I am the owner and don't want my username and password made available to my programming staff; they don't want their passwords available to each other or to me, for that matter. As a small company, I will have only 3 agents altogether, so adding a non-functional API agent would be relatively expensive.
Suggestion (if you agree that this type of agent could/should be free) - create an Agent restriction called "API agent" that doesn't have any authority other than to use the API -- one that doesn't chalk up a fee as a regular agent.