diff --git a/Cargo.lock b/Cargo.lock
index b17e1653..aae7ad8f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1879,6 +1879,7 @@ dependencies = [
  "clap 4.3.19",
  "sea-orm",
  "sea-orm-migration",
+ "serde_json",
  "thiserror",
  "time",
  "tracing",
diff --git a/app/src/ApiClient.ts b/app/src/ApiClient.ts
index 84534a93..8f35580b 100644
--- a/app/src/ApiClient.ts
+++ b/app/src/ApiClient.ts
@@ -117,10 +117,8 @@ export interface Aggregator {
 }
 
 export interface NewAggregator {
-  role: Role;
   name: string;
   api_url: string;
-  dap_url: string;
   bearer_token: string;
   is_first_party?: boolean;
 }
@@ -422,6 +420,10 @@ function errorToMessage({ message, code, params }: ValidationError) {
     return "must be base64";
   } else if (code === "same") {
     return "must not be the same";
+  } else if (code === "token-not-recognized") {
+    return "bearer token not recognized";
+  } else if (code === "http-error") {
+    return "error connecting to url";
   } else if (code === "enum" && Array.isArray(params.values)) {
     return `must be one of these values: ${params.values.join(", ")}`;
   } else if (code === "length") {
diff --git a/app/src/aggregators/AggregatorForm.tsx b/app/src/aggregators/AggregatorForm.tsx
index 1b621645..f3016701 100644
--- a/app/src/aggregators/AggregatorForm.tsx
+++ b/app/src/aggregators/AggregatorForm.tsx
@@ -69,10 +69,8 @@ export function AggregatorForm({
       errors={errors}
       initialValues={
         {
-          role: "either",
           name: "",
           api_url: "",
-          dap_url: "",
           bearer_token: "",
           is_first_party: showIsFirstParty ? true : undefined,
         } as NewAggregator
@@ -86,10 +84,8 @@ export function AggregatorForm({
           noValidate
           autoComplete="off"
         >
-          <RoleSelect {...props} />
           <Name {...props} />
           <ApiUrl {...props} />
-          <DapUrl {...props} />
           <BearerToken {...props} />
           {showIsFirstParty ? <IsFirstParty {...props} /> : null}
           <Button
@@ -219,52 +215,6 @@ function ApiUrl(props: FormikProps<NewAggregator>) {
     </FormGroup>
   );
 }
-function DapUrl(props: FormikProps<NewAggregator>) {
-  return (
-    <FormGroup>
-      <FormLabel>DAP Url</FormLabel>
-
-      <FormControl
-        type="url"
-        onChange={props.handleChange}
-        onBlur={props.handleBlur}
-        value={props.values.dap_url}
-        isInvalid={!!props.errors.dap_url}
-        required
-        autoComplete="off"
-        placeholder="https://example.com"
-        pattern="https://.*"
-        name="dap_url"
-      />
-      <FormControl.Feedback type="invalid">
-        {props.errors.dap_url}
-      </FormControl.Feedback>
-    </FormGroup>
-  );
-}
-
-function RoleSelect(props: FormikProps<NewAggregator>) {
-  return (
-    <FormGroup>
-      <FormLabel>Role</FormLabel>
-
-      <FormSelect
-        value={props.values.role}
-        isInvalid={!!props.errors.role}
-        onChange={props.handleChange}
-        onBlur={props.handleBlur}
-        name="role"
-      >
-        <option value="leader">Leader</option>
-        <option value="helper">Helper</option>
-        <option value="either">Either Leader or Helper</option>
-      </FormSelect>
-      <FormControl.Feedback type="invalid">
-        {props.errors.role}
-      </FormControl.Feedback>
-    </FormGroup>
-  );
-}
 
 function Breadcrumbs() {
   return (
diff --git a/cli/src/aggregators.rs b/cli/src/aggregators.rs
index e85fb4d3..90f05f21 100644
--- a/cli/src/aggregators.rs
+++ b/cli/src/aggregators.rs
@@ -2,45 +2,16 @@ use crate::{CliResult, Output};
 use clap::Subcommand;
 use divviup_client::{DivviupClient, NewAggregator, Url, Uuid};
 
-#[derive(clap::ValueEnum, Clone, Debug)]
-pub enum Role {
-    Either,
-    Leader,
-    Helper,
-}
-
-impl From<Role> for divviup_client::Role {
-    fn from(value: Role) -> Self {
-        match value {
-            Role::Either => Self::Either,
-            Role::Leader => Self::Leader,
-            Role::Helper => Self::Helper,
-        }
-    }
-}
-
 #[derive(Subcommand, Debug)]
 pub enum AggregatorAction {
     List,
     Create {
-        /// Possible roles for this aggregator
-        ///
-        /// Acceptable values: "Either", "Leader", or "Helper"
-        #[arg(short, long)]
-        role: Role,
-
         /// Human-readable identifier for this aggregator
         ///
         /// This can be changed later
         #[arg(short, long)]
         name: String,
 
-        /// DAP URL for this aggregator
-        ///
-        /// must be https
-        #[arg(short, long)]
-        dap_url: Url,
-
         /// API URL for this aggregator
         ///
         /// must be https
@@ -79,9 +50,7 @@ impl AggregatorAction {
             AggregatorAction::List => output.display(client.aggregators(account_id).await?),
 
             AggregatorAction::Create {
-                role,
                 name,
-                dap_url,
                 api_url,
                 bearer_token,
             } => output.display(
@@ -89,9 +58,7 @@ impl AggregatorAction {
                     .create_aggregator(
                         account_id,
                         NewAggregator {
-                            role: role.into(),
                             name,
-                            dap_url,
                             api_url,
                             bearer_token,
                         },
diff --git a/client/src/aggregator.rs b/client/src/aggregator.rs
index 22de4205..3e8d26cc 100644
--- a/client/src/aggregator.rs
+++ b/client/src/aggregator.rs
@@ -27,13 +27,13 @@ pub struct Aggregator {
     pub dap_url: Url,
     pub api_url: Url,
     pub is_first_party: bool,
+    pub vdafs: Vec<String>,
+    pub query_types: Vec<String>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, Eq, PartialEq)]
 pub struct NewAggregator {
-    pub role: Role,
     pub name: String,
-    pub dap_url: Url,
     pub api_url: Url,
     pub bearer_token: String,
 }
diff --git a/client/tests/aggregators.rs b/client/tests/aggregators.rs
index 32678127..e0380639 100644
--- a/client/tests/aggregators.rs
+++ b/client/tests/aggregators.rs
@@ -1,5 +1,5 @@
 mod harness;
-use divviup_client::{DivviupClient, NewAggregator, Role};
+use divviup_client::{DivviupClient, NewAggregator};
 use harness::with_configured_client;
 use std::sync::Arc;
 use test_support::{assert_eq, test, *};
@@ -29,8 +29,6 @@ async fn create_aggregator(
         .create_aggregator(
             account.id,
             NewAggregator {
-                role: Role::Either,
-                dap_url: "https://dap.url".parse().unwrap(),
                 api_url: "https://api.url".parse().unwrap(),
                 name: "my account name".into(),
                 bearer_token: "somebearertoken".into(),
diff --git a/migration/Cargo.toml b/migration/Cargo.toml
index a4117477..e853579f 100644
--- a/migration/Cargo.toml
+++ b/migration/Cargo.toml
@@ -13,6 +13,7 @@ path = "src/lib.rs"
 async-std = { version = "1", features = ["attributes", "tokio1"] }
 clap = { version = "4.3.19", features = ["env", "derive"] }
 sea-orm = "0.11.3"
+serde_json = "1.0.103"
 thiserror = "1.0.44"
 time = "0.3.23"
 tracing = "0.1.37"
diff --git a/migration/src/lib.rs b/migration/src/lib.rs
index 3d714e99..38d009bb 100644
--- a/migration/src/lib.rs
+++ b/migration/src/lib.rs
@@ -14,6 +14,7 @@ mod m20230622_232534_make_aggregator_api_url_mandatory;
 mod m20230626_183248_add_is_first_party_to_aggregators;
 mod m20230630_175314_create_api_tokens;
 mod m20230703_201332_add_additional_fields_to_api_tokens;
+mod m20230725_220134_add_vdafs_and_query_types_to_aggregators;
 
 pub struct Migrator;
 
@@ -35,6 +36,7 @@ impl MigratorTrait for Migrator {
             Box::new(m20230626_183248_add_is_first_party_to_aggregators::Migration),
             Box::new(m20230630_175314_create_api_tokens::Migration),
             Box::new(m20230703_201332_add_additional_fields_to_api_tokens::Migration),
+            Box::new(m20230725_220134_add_vdafs_and_query_types_to_aggregators::Migration),
         ]
     }
 }
diff --git a/migration/src/m20230725_220134_add_vdafs_and_query_types_to_aggregators.rs b/migration/src/m20230725_220134_add_vdafs_and_query_types_to_aggregators.rs
new file mode 100644
index 00000000..0ba3bf3b
--- /dev/null
+++ b/migration/src/m20230725_220134_add_vdafs_and_query_types_to_aggregators.rs
@@ -0,0 +1,67 @@
+use sea_orm_migration::prelude::*;
+use serde_json::json;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, db: &SchemaManager) -> Result<(), DbErr> {
+        db.alter_table(
+            TableAlterStatement::new()
+                .table(Aggregator::Table)
+                .add_column(ColumnDef::new(Aggregator::Vdafs).json().null())
+                .add_column(ColumnDef::new(Aggregator::QueryTypes).json().null())
+                .to_owned(),
+        )
+        .await?;
+
+        db.exec_stmt(
+            Query::update()
+                .table(Aggregator::Table)
+                .values([
+                    (
+                        Aggregator::Vdafs,
+                        json!(["Prio3Count", "Prio3Sum", "Prio3Histogram"]).into(),
+                    ),
+                    (
+                        Aggregator::QueryTypes,
+                        json!(["TimeInterval", "FixedSize"]).into(),
+                    ),
+                ])
+                .to_owned(),
+        )
+        .await?;
+
+        db.alter_table(
+            TableAlterStatement::new()
+                .table(Aggregator::Table)
+                .modify_column(ColumnDef::new(Aggregator::Vdafs).not_null())
+                .modify_column(ColumnDef::new(Aggregator::QueryTypes).not_null())
+                .to_owned(),
+        )
+        .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, db: &SchemaManager) -> Result<(), DbErr> {
+        db.alter_table(
+            TableAlterStatement::new()
+                .table(Aggregator::Table)
+                .drop_column(Aggregator::Vdafs)
+                .drop_column(Aggregator::QueryTypes)
+                .to_owned(),
+        )
+        .await?;
+        Ok(())
+    }
+}
+
+/// Learn more at https://docs.rs/sea-query#iden
+#[derive(Iden)]
+enum Aggregator {
+    Table,
+    Vdafs,
+    QueryTypes,
+}
diff --git a/src/api_mocks.rs b/src/api_mocks.rs
index ee658e78..f221847d 100644
--- a/src/api_mocks.rs
+++ b/src/api_mocks.rs
@@ -1,12 +1,11 @@
 use crate::handler::origin_router;
-use trillium::{Conn, Handler};
+use trillium::Handler;
 use trillium_http::KnownHeaderName;
 use trillium_logger::{
-    formatters::{method, status, url},
+    formatters::{method, request_header, status, url},
     logger,
 };
 use trillium_macros::Handler;
-use trillium_router::Router;
 
 pub mod aggregator_api;
 pub mod auth0;
@@ -28,12 +27,7 @@ impl ApiMocks {
                 "[mock] ",
                 method,
                 " ",
-                move |conn: &Conn, _| {
-                    conn.headers()
-                        .get_str(KnownHeaderName::Host)
-                        .unwrap_or_default()
-                        .to_string()
-                },
+                request_header(KnownHeaderName::Host),
                 " ",
                 url,
                 " ",
@@ -42,9 +36,7 @@ impl ApiMocks {
             origin_router()
                 .with_handler(postmark_url, postmark::mock())
                 .with_handler(auth0_url, auth0::mock(auth0_url)),
-            // Add a path prefix before the aggregator API mock. Aggregator test fixtures must
-            // include this prefix in their URLs.
-            Router::new().all("prefix/*", aggregator_api::mock()),
+            aggregator_api::mock(),
         )))
     }
 }
diff --git a/src/api_mocks/aggregator_api.rs b/src/api_mocks/aggregator_api.rs
index e7818592..7107d959 100644
--- a/src/api_mocks/aggregator_api.rs
+++ b/src/api_mocks/aggregator_api.rs
@@ -1,7 +1,8 @@
 use super::random_chars;
 use crate::clients::aggregator_client::api_types::{
-    HpkeAeadId, HpkeConfig, HpkeKdfId, HpkeKemId, HpkePublicKey, JanusDuration, QueryType, Role,
-    TaskCreate, TaskId, TaskIds, TaskMetrics, TaskResponse, VdafInstance,
+    AggregatorApiConfig, HpkeAeadId, HpkeConfig, HpkeKdfId, HpkeKemId, HpkePublicKey,
+    JanusDuration, QueryType, Role, TaskCreate, TaskId, TaskIds, TaskMetrics, TaskResponse,
+    VdafInstance,
 };
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use querystrong::QueryStrong;
@@ -10,16 +11,50 @@ use sha2::{Digest, Sha256};
 use std::iter::repeat_with;
 use trillium::{Conn, Handler, Status};
 use trillium_api::{api, Json};
+use trillium_http::KnownHeaderName;
 use trillium_router::{router, RouterConnExt};
 use uuid::Uuid;
 
+pub const BAD_BEARER_TOKEN: &str = "badbearertoken";
+
 pub fn mock() -> impl Handler {
-    router()
-        .post("/tasks", api(post_task))
-        .get("/tasks/:task_id", api(get_task))
-        .get("/task_ids", api(task_ids))
-        .delete("/tasks/:task_id", Status::Ok)
-        .get("/tasks/:task_id/metrics", api(get_task_metrics))
+    (
+        bearer_token_check,
+        router()
+            .get(
+                "/",
+                Json(AggregatorApiConfig {
+                    dap_url: format!("https://dap.{}.example", random_chars(5))
+                        .parse()
+                        .unwrap(),
+                    role: random(),
+                    vdafs: Default::default(),
+                    query_types: Default::default(),
+                }),
+            )
+            .post("/tasks", api(post_task))
+            .get("/tasks/:task_id", api(get_task))
+            .get("/task_ids", api(task_ids))
+            .delete("/tasks/:task_id", Status::Ok)
+            .get("/tasks/:task_id/metrics", api(get_task_metrics)),
+    )
+}
+
+async fn bearer_token_check(conn: Conn) -> Conn {
+    let token_is_valid = conn
+        .request_headers()
+        .get_str(KnownHeaderName::Authorization)
+        .map_or(false, |s| match s.split_once(' ') {
+            Some(("Bearer", BAD_BEARER_TOKEN)) => false,
+            Some(("Bearer", _)) => true,
+            _ => false,
+        });
+
+    if token_is_valid {
+        conn
+    } else {
+        conn.with_status(Status::Unauthorized).halt()
+    }
 }
 
 async fn get_task_metrics(_: &mut Conn, (): ()) -> Json<TaskMetrics> {
diff --git a/src/api_mocks/auth0.rs b/src/api_mocks/auth0.rs
index bdf6d7ba..be273d07 100644
--- a/src/api_mocks/auth0.rs
+++ b/src/api_mocks/auth0.rs
@@ -2,29 +2,32 @@ use super::random_chars;
 use crate::{clients::auth0_client::Token, User};
 use serde_json::json;
 use trillium::Handler;
-use trillium_api::Json;
+use trillium_api::{Halt, Json};
 use trillium_router::router;
 
 pub fn mock(auth0_url: &str) -> impl Handler {
-    router()
-        .get("/userinfo", Json(User::for_integration_testing()))
-        .post(
-            "/oauth/token",
-            Json(Token {
-                access_token: "access token".into(),
-                expires_in: 60,
-                scope: "".into(),
-                token_type: "bearer".into(),
-            }),
-        )
-        .post(
-            "/api/v2/users",
-            Json(json!({ "user_id": random_chars(10) })),
-        )
-        .post(
-            "/api/v2/tickets/password-change",
-            Json(json!({
-                "ticket": format!("{auth0_url}/password_tickets/{}", random_chars(10))
-            })),
-        )
+    (
+        router()
+            .get("/userinfo", Json(User::for_integration_testing()))
+            .post(
+                "/oauth/token",
+                Json(Token {
+                    access_token: "access token".into(),
+                    expires_in: 60,
+                    scope: "".into(),
+                    token_type: "bearer".into(),
+                }),
+            )
+            .post(
+                "/api/v2/users",
+                Json(json!({ "user_id": random_chars(10) })),
+            )
+            .post(
+                "/api/v2/tickets/password-change",
+                Json(json!({
+                    "ticket": format!("{auth0_url}/password_tickets/{}", random_chars(10))
+                })),
+            ),
+        Halt,
+    )
 }
diff --git a/src/api_mocks/postmark.rs b/src/api_mocks/postmark.rs
index 17931712..43a6c18a 100644
--- a/src/api_mocks/postmark.rs
+++ b/src/api_mocks/postmark.rs
@@ -1,7 +1,7 @@
 use serde_json::json;
 use trillium::Handler;
-use trillium_api::Json;
+use trillium_api::{Halt, Json};
 use trillium_router::router;
 pub fn mock() -> impl Handler {
-    router().post("/email/withTemplate", Json(json!({})))
+    (router().post("/email/withTemplate", Json(json!({}))), Halt)
 }
diff --git a/src/clients/aggregator_client.rs b/src/clients/aggregator_client.rs
index b6d93035..2663abdd 100644
--- a/src/clients/aggregator_client.rs
+++ b/src/clients/aggregator_client.rs
@@ -8,7 +8,7 @@ use trillium::{HeaderValue, KnownHeaderName, Method};
 use trillium_client::{Client, Conn};
 use url::Url;
 pub mod api_types;
-pub use api_types::{TaskCreate, TaskIds, TaskMetrics, TaskResponse};
+pub use api_types::{AggregatorApiConfig, TaskCreate, TaskIds, TaskMetrics, TaskResponse};
 
 const CONTENT_TYPE: &str = "application/vnd.janus.aggregator+json;version=0.1";
 
@@ -28,14 +28,34 @@ impl AsRef<Client> for AggregatorClient {
 
 impl AggregatorClient {
     pub fn new(client: Client, aggregator: Aggregator) -> Self {
+        let mut base_url: Url = aggregator.api_url.clone().into();
+        if !base_url.path().ends_with('/') {
+            base_url.set_path(&format!("{}/", base_url.path()));
+        }
+
         Self {
             client,
-            base_url: aggregator.api_url.clone().into(),
+            base_url,
             auth_header: HeaderValue::from(format!("Bearer {}", &aggregator.bearer_token)),
             aggregator,
         }
     }
 
+    pub async fn get_config(
+        client: Client,
+        base_url: Url,
+        token: &str,
+    ) -> Result<AggregatorApiConfig, ClientError> {
+        client
+            .get(base_url)
+            .with_header(KnownHeaderName::Authorization, format!("Bearer {token}"))
+            .success_or_client_error()
+            .await?
+            .response_json()
+            .await
+            .map_err(Into::into)
+    }
+
     pub async fn get_task_ids(&self) -> Result<Vec<String>, ClientError> {
         let mut ids = vec![];
         let mut path = String::from("task_ids");
diff --git a/src/clients/aggregator_client/api_types.rs b/src/clients/aggregator_client/api_types.rs
index ae7dcf8f..c4f1fa7a 100644
--- a/src/clients/aggregator_client/api_types.rs
+++ b/src/clients/aggregator_client/api_types.rs
@@ -1,19 +1,20 @@
 use crate::{
     entity::{
+        aggregator::{QueryTypeNameSet, Role as AggregatorRole, VdafNameSet},
         task::vdaf::{CountVec, Histogram, Sum, SumVec, Vdaf},
         Aggregator, ProvisionableTask,
     },
     handler::Error,
 };
+use serde::{Deserialize, Serialize};
+use time::{error::ComponentRange, OffsetDateTime};
+use url::Url;
 
 pub use janus_messages::{
     codec::{Decode, Encode},
     Duration as JanusDuration, HpkeAeadId, HpkeConfig, HpkeConfigId, HpkeConfigList, HpkeKdfId,
     HpkeKemId, HpkePublicKey, Role, TaskId, Time as JanusTime,
 };
-use serde::{Deserialize, Serialize};
-use time::{error::ComponentRange, OffsetDateTime};
-use url::Url;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[non_exhaustive]
@@ -188,12 +189,20 @@ pub struct TaskIds {
     pub pagination_token: Option<String>,
 }
 
-#[derive(Deserialize, Serialize, Debug, Clone, Copy)]
+#[derive(Deserialize, Serialize, Debug, Clone, Copy, PartialEq, Eq)]
 pub struct TaskMetrics {
     pub reports: u64,
     pub report_aggregations: u64,
 }
 
+#[derive(Deserialize, Serialize, Debug, Clone)]
+pub struct AggregatorApiConfig {
+    pub dap_url: Url,
+    pub role: AggregatorRole,
+    pub vdafs: VdafNameSet,
+    pub query_types: QueryTypeNameSet,
+}
+
 #[cfg(test)]
 mod test {
     use super::{TaskCreate, TaskResponse};
diff --git a/src/entity/aggregator.rs b/src/entity/aggregator.rs
index 8ecb7250..27f29ea8 100644
--- a/src/entity/aggregator.rs
+++ b/src/entity/aggregator.rs
@@ -1,24 +1,24 @@
+mod new_aggregator;
+mod query_type_name;
+mod role;
+mod update_aggregator;
+mod vdaf_name;
+
 use super::{url::Url, AccountColumn, AccountRelation, Accounts, Memberships};
 use crate::clients::AggregatorClient;
 use sea_orm::{
-    ActiveModelBehavior, ActiveValue, DeriveActiveEnum, DeriveEntityModel, DerivePrimaryKey,
-    DeriveRelation, EntityTrait, EnumIter, IntoActiveModel, PrimaryKeyTrait, Related, RelationDef,
-    RelationTrait,
+    ActiveModelBehavior, ActiveValue, DeriveEntityModel, DerivePrimaryKey, DeriveRelation,
+    EntityTrait, EnumIter, IntoActiveModel, PrimaryKeyTrait, Related, RelationDef, RelationTrait,
 };
 use serde::{Deserialize, Serialize};
-use std::{
-    error::Error,
-    fmt::{self, Display, Formatter},
-    str::FromStr,
-};
 use time::OffsetDateTime;
 use uuid::Uuid;
 
-mod update_aggregator;
-pub use update_aggregator::UpdateAggregator;
-
-mod new_aggregator;
 pub use new_aggregator::NewAggregator;
+pub use query_type_name::{QueryTypeName, QueryTypeNameSet};
+pub use role::{Role, UnrecognizedRole};
+pub use update_aggregator::UpdateAggregator;
+pub use vdaf_name::{VdafName, VdafNameSet};
 
 #[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
 #[sea_orm(table_name = "aggregator")]
@@ -41,6 +41,8 @@ pub struct Model {
     pub is_first_party: bool,
     #[serde(skip)]
     pub bearer_token: String,
+    pub query_types: QueryTypeNameSet,
+    pub vdafs: VdafNameSet,
 }
 
 impl Model {
@@ -60,46 +62,6 @@ impl Model {
     }
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, EnumIter, DeriveActiveEnum, Serialize, Deserialize)]
-#[sea_orm(rs_type = "i32", db_type = "Integer")]
-pub enum Role {
-    #[sea_orm(num_value = 0)]
-    Leader,
-    #[sea_orm(num_value = 1)]
-    Helper,
-    #[sea_orm(num_value = 2)]
-    Either,
-}
-impl AsRef<str> for Role {
-    fn as_ref(&self) -> &str {
-        match self {
-            Self::Leader => "leader",
-            Self::Helper => "helper",
-            Self::Either => "either",
-        }
-    }
-}
-
-#[derive(Debug)]
-pub struct UnrecognizedRole(String);
-impl Display for UnrecognizedRole {
-    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        f.write_fmt(format_args!("{} was not a recognized role option", self.0))
-    }
-}
-impl Error for UnrecognizedRole {}
-impl FromStr for Role {
-    type Err = UnrecognizedRole;
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        match &*s.to_lowercase() {
-            "leader" => Ok(Self::Leader),
-            "helper" => Ok(Self::Helper),
-            "either" => Ok(Self::Either),
-            unrecognized => Err(UnrecognizedRole(unrecognized.to_string())),
-        }
-    }
-}
-
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
 pub enum Relation {
     #[sea_orm(
diff --git a/src/entity/aggregator/new_aggregator.rs b/src/entity/aggregator/new_aggregator.rs
index 056d86fe..e6a5322a 100644
--- a/src/entity/aggregator/new_aggregator.rs
+++ b/src/entity/aggregator/new_aggregator.rs
@@ -1,43 +1,29 @@
+use super::ActiveModel;
 use crate::{
-    entity::{validators::base64, Account},
+    clients::{AggregatorClient, ClientError},
+    entity::{validators::base64, Account, Aggregator},
     handler::Error,
 };
 use sea_orm::IntoActiveModel;
 use serde::{Deserialize, Serialize};
 use std::str::FromStr;
 use time::OffsetDateTime;
+use trillium_client::Client;
+use trillium_http::Status;
 use uuid::Uuid;
-use validator::{Validate, ValidationError};
-
-use super::{ActiveModel, Role};
+use validator::{Validate, ValidationError, ValidationErrors};
 
 #[derive(Deserialize, Serialize, Validate, Debug, Clone, Default)]
 pub struct NewAggregator {
-    #[validate(required, custom = "validate_role")]
-    pub role: Option<String>,
     #[validate(required, length(min = 1))]
     pub name: Option<String>,
-    #[validate(required)]
     #[cfg_attr(not(feature = "integration-testing"), validate(custom = "https"))]
     pub api_url: Option<String>,
-    #[validate(required)]
-    #[cfg_attr(not(feature = "integration-testing"), validate(custom = "https"))]
-    pub dap_url: Option<String>,
     #[validate(required, custom = "base64", length(min = 8))]
     pub bearer_token: Option<String>,
     pub is_first_party: Option<bool>,
 }
 
-fn validate_role(role: &str) -> Result<(), ValidationError> {
-    Role::from_str(role)
-        .map_err(|_| {
-            let mut error = ValidationError::new("enum");
-            error.add_param("values".into(), &vec!["Leader", "Helper", "Either"]);
-            error
-        })
-        .map(|_| ())
-}
-
 #[cfg_attr(feature = "integration-testing", allow(dead_code))]
 fn https(url: &str) -> Result<(), ValidationError> {
     let url = url::Url::from_str(url).map_err(|_| ValidationError::new("https-url"))?;
@@ -48,8 +34,40 @@ fn https(url: &str) -> Result<(), ValidationError> {
 }
 
 impl NewAggregator {
-    pub fn build(self, account: Option<&Account>) -> Result<ActiveModel, Error> {
+    pub async fn build(
+        self,
+        account: Option<&Account>,
+        client: Client,
+    ) -> Result<ActiveModel, Error> {
         self.validate()?;
+        let aggregator_config = AggregatorClient::get_config(
+            client,
+            self.api_url.as_ref().unwrap().parse()?,
+            self.bearer_token.as_ref().unwrap(),
+        )
+        .await
+        .map_err(|e| match e {
+            ClientError::HttpStatusNotSuccess {
+                status: Some(Status::Unauthorized | Status::Forbidden),
+                ..
+            } => {
+                let mut ve = ValidationErrors::new();
+                ve.add("bearer_token", ValidationError::new("token-not-recognized"));
+                ve.into()
+            }
+
+            ClientError::Http(_)
+            | ClientError::HttpStatusNotSuccess {
+                status: Some(Status::NotFound),
+                ..
+            } => {
+                let mut ve = ValidationErrors::new();
+                ve.add("api_url", ValidationError::new("http-error"));
+                ve.into()
+            }
+
+            other => Error::from(other),
+        })?;
 
         // unwrap safety: the below unwraps will never panic, because
         // the above call to `NewAggregator::validate` will
@@ -63,11 +81,11 @@ impl NewAggregator {
         // of the scope of this repository, we work around this by
         // double-checking these Options -- once in validate, and
         // again in the conversion to non-optional fields.
-        Ok(super::Model {
-            role: self.role.unwrap().parse().unwrap(),
+        Ok(Aggregator {
+            role: aggregator_config.role,
             name: self.name.unwrap(),
             api_url: self.api_url.unwrap().parse()?,
-            dap_url: self.dap_url.unwrap().parse()?,
+            dap_url: aggregator_config.dap_url.into(),
             bearer_token: self.bearer_token.unwrap(),
             id: Uuid::new_v4(),
             account_id: account.map(|account| account.id),
@@ -75,6 +93,8 @@ impl NewAggregator {
             updated_at: OffsetDateTime::now_utc(),
             deleted_at: None,
             is_first_party: account.is_none() && self.is_first_party.unwrap_or(true),
+            query_types: aggregator_config.query_types,
+            vdafs: aggregator_config.vdafs,
         }
         .into_active_model())
     }
diff --git a/src/entity/aggregator/query_type_name.rs b/src/entity/aggregator/query_type_name.rs
new file mode 100644
index 00000000..9c69dc57
--- /dev/null
+++ b/src/entity/aggregator/query_type_name.rs
@@ -0,0 +1,117 @@
+use crate::json_newtype;
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::{
+        btree_set::{IntoIter, Iter},
+        BTreeSet as Set,
+    },
+    convert::Infallible,
+    fmt::Display,
+    str::FromStr,
+};
+
+/// https://www.ietf.org/archive/id/draft-ietf-ppm-dap-05.html#name-queries
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Hash, PartialOrd, Ord)]
+pub enum QueryTypeName {
+    Reserved,
+    TimeInterval,
+    FixedSize,
+    #[serde(untagged)]
+    Other(String),
+}
+
+impl AsRef<str> for QueryTypeName {
+    fn as_ref(&self) -> &str {
+        match self {
+            QueryTypeName::Reserved => "Reserved",
+            QueryTypeName::TimeInterval => "TimeInterval",
+            QueryTypeName::FixedSize => "FixedSize",
+            QueryTypeName::Other(o) => o,
+        }
+    }
+}
+
+impl Display for QueryTypeName {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_ref())
+    }
+}
+
+impl FromStr for QueryTypeName {
+    type Err = Infallible;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(match s {
+            "Reserved" => Self::Reserved,
+            "TimeInterval" => Self::TimeInterval,
+            "FixedSize" => Self::FixedSize,
+            other => Self::Other(other.into()),
+        })
+    }
+}
+
+impl From<String> for QueryTypeName {
+    fn from(value: String) -> Self {
+        value.parse().unwrap()
+    }
+}
+
+impl From<&str> for QueryTypeName {
+    fn from(value: &str) -> Self {
+        value.parse().unwrap()
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
+pub struct QueryTypeNameSet(Set<QueryTypeName>);
+
+impl<I> FromIterator<I> for QueryTypeNameSet
+where
+    I: Into<QueryTypeName>,
+{
+    fn from_iter<T: IntoIterator<Item = I>>(iter: T) -> Self {
+        Self(iter.into_iter().map(Into::into).collect())
+    }
+}
+
+impl IntoIterator for QueryTypeNameSet {
+    type Item = QueryTypeName;
+
+    type IntoIter = IntoIter<Self::Item>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.into_iter()
+    }
+}
+
+impl<'a> IntoIterator for &'a QueryTypeNameSet {
+    type Item = &'a QueryTypeName;
+
+    type IntoIter = Iter<'a, QueryTypeName>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.iter()
+    }
+}
+
+impl Default for QueryTypeNameSet {
+    fn default() -> Self {
+        Self::from_iter([QueryTypeName::TimeInterval, QueryTypeName::FixedSize])
+    }
+}
+
+json_newtype!(QueryTypeNameSet);
+
+impl QueryTypeNameSet {
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    pub fn intersect(&self, other: &QueryTypeNameSet) -> QueryTypeNameSet {
+        self.0.intersection(&other.0).cloned().collect()
+    }
+}
diff --git a/src/entity/aggregator/role.rs b/src/entity/aggregator/role.rs
new file mode 100644
index 00000000..5c0a3ddc
--- /dev/null
+++ b/src/entity/aggregator/role.rs
@@ -0,0 +1,58 @@
+use rand::{distributions::Standard, prelude::Distribution};
+use sea_orm::{DeriveActiveEnum, EnumIter};
+use serde::{Deserialize, Serialize};
+use std::{
+    error::Error,
+    fmt::{self, Display, Formatter},
+    str::FromStr,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, EnumIter, DeriveActiveEnum, Serialize, Deserialize)]
+#[sea_orm(rs_type = "i32", db_type = "Integer")]
+pub enum Role {
+    #[sea_orm(num_value = 0)]
+    Leader,
+    #[sea_orm(num_value = 1)]
+    Helper,
+    #[sea_orm(num_value = 2)]
+    Either,
+}
+
+impl Distribution<Role> for Standard {
+    fn sample<R: rand::Rng + ?Sized>(&self, rng: &mut R) -> Role {
+        match rng.gen_range(0..3) {
+            0 => Role::Leader,
+            1 => Role::Helper,
+            _ => Role::Either,
+        }
+    }
+}
+impl AsRef<str> for Role {
+    fn as_ref(&self) -> &str {
+        match self {
+            Self::Leader => "leader",
+            Self::Helper => "helper",
+            Self::Either => "either",
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct UnrecognizedRole(String);
+impl Display for UnrecognizedRole {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        f.write_fmt(format_args!("{} was not a recognized role option", self.0))
+    }
+}
+impl Error for UnrecognizedRole {}
+impl FromStr for Role {
+    type Err = UnrecognizedRole;
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match &*s.to_lowercase() {
+            "leader" => Ok(Self::Leader),
+            "helper" => Ok(Self::Helper),
+            "either" => Ok(Self::Either),
+            unrecognized => Err(UnrecognizedRole(unrecognized.to_string())),
+        }
+    }
+}
diff --git a/src/entity/aggregator/update_aggregator.rs b/src/entity/aggregator/update_aggregator.rs
index 96ff9d4b..73f41a6c 100644
--- a/src/entity/aggregator/update_aggregator.rs
+++ b/src/entity/aggregator/update_aggregator.rs
@@ -1,8 +1,14 @@
-use crate::entity::validators::base64;
+use crate::{
+    clients::{AggregatorClient, ClientError},
+    entity::{validators::base64, Aggregator},
+    Error,
+};
 use sea_orm::{ActiveModelTrait, ActiveValue, IntoActiveModel};
 use serde::Deserialize;
 use time::OffsetDateTime;
-use validator::Validate;
+use trillium_client::Client;
+use trillium_http::Status;
+use validator::{Validate, ValidationError, ValidationErrors};
 
 #[derive(Deserialize, Validate, Debug)]
 pub struct UpdateAggregator {
@@ -14,20 +20,43 @@ pub struct UpdateAggregator {
 }
 
 impl UpdateAggregator {
-    pub fn build(self, model: super::Model) -> Result<super::ActiveModel, crate::handler::Error> {
+    pub async fn build(
+        self,
+        aggregator: Aggregator,
+        client: Client,
+    ) -> Result<super::ActiveModel, crate::handler::Error> {
         self.validate()?;
-        let mut am = model.into_active_model();
+        let api_url = aggregator.api_url.clone().into();
+        let mut aggregator = aggregator.into_active_model();
         if let Some(name) = self.name {
-            am.name = ActiveValue::Set(name);
+            aggregator.name = ActiveValue::Set(name);
         }
 
         if let Some(bearer_token) = self.bearer_token {
-            am.bearer_token = ActiveValue::Set(bearer_token);
+            let aggregator_config = AggregatorClient::get_config(client, api_url, &bearer_token)
+                .await
+                .map_err(|e| match e {
+                    ClientError::HttpStatusNotSuccess {
+                        status: Some(Status::Unauthorized | Status::Forbidden),
+                        ..
+                    } => {
+                        let mut validation_errors = ValidationErrors::new();
+                        validation_errors
+                            .add("bearer_token", ValidationError::new("token-not-recognized"));
+                        validation_errors.into()
+                    }
+
+                    other => Error::from(other),
+                })?;
+
+            aggregator.query_types = ActiveValue::Set(aggregator_config.query_types);
+            aggregator.vdafs = ActiveValue::Set(aggregator_config.vdafs);
+            aggregator.bearer_token = ActiveValue::Set(bearer_token);
         }
 
-        if am.is_changed() {
-            am.updated_at = ActiveValue::Set(OffsetDateTime::now_utc());
+        if aggregator.is_changed() {
+            aggregator.updated_at = ActiveValue::Set(OffsetDateTime::now_utc());
         }
-        Ok(am)
+        Ok(aggregator)
     }
 }
diff --git a/src/entity/aggregator/vdaf_name.rs b/src/entity/aggregator/vdaf_name.rs
new file mode 100644
index 00000000..657bbc62
--- /dev/null
+++ b/src/entity/aggregator/vdaf_name.rs
@@ -0,0 +1,128 @@
+use crate::json_newtype;
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::{
+        btree_set::{IntoIter, Iter},
+        BTreeSet as Set,
+    },
+    convert::Infallible,
+    fmt::{self, Display, Formatter},
+    str::FromStr,
+};
+
+/// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vdaf-06#name-iana-considerations-7
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord)]
+pub enum VdafName {
+    Prio3Count,
+    Prio3Sum,
+    Prio3Histogram,
+    Prio3CountVec,
+    Prio3SumVec,
+    Poplar1,
+    #[serde(untagged)]
+    Other(String),
+}
+
+impl FromStr for VdafName {
+    type Err = Infallible;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(match s {
+            "Prio3Count" => Self::Prio3Count,
+            "Prio3Sum" => Self::Prio3Sum,
+            "Prio3Histogram" => Self::Prio3Histogram,
+            "Prio3CountVec" => Self::Prio3CountVec,
+            "Prio3SumVec" => Self::Prio3SumVec,
+            other => Self::Other(other.into()),
+        })
+    }
+}
+
+impl From<String> for VdafName {
+    fn from(value: String) -> Self {
+        value.parse().unwrap()
+    }
+}
+
+impl From<&str> for VdafName {
+    fn from(value: &str) -> Self {
+        value.parse().unwrap()
+    }
+}
+
+impl AsRef<str> for VdafName {
+    fn as_ref(&self) -> &str {
+        match self {
+            VdafName::Prio3Count => "Prio3Count",
+            VdafName::Prio3Sum => "Prio3Sum",
+            VdafName::Prio3Histogram => "Prio3Histogram",
+            VdafName::Prio3CountVec => "Prio3CountVec",
+            VdafName::Prio3SumVec => "Prio3SumVec",
+            VdafName::Poplar1 => "Poplar1",
+            VdafName::Other(o) => o,
+        }
+    }
+}
+
+impl Display for VdafName {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_ref())
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
+pub struct VdafNameSet(Set<VdafName>);
+impl<I> FromIterator<I> for VdafNameSet
+where
+    I: Into<VdafName>,
+{
+    fn from_iter<T: IntoIterator<Item = I>>(iter: T) -> Self {
+        Self(iter.into_iter().map(Into::into).collect())
+    }
+}
+
+impl IntoIterator for VdafNameSet {
+    type Item = VdafName;
+
+    type IntoIter = IntoIter<Self::Item>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.into_iter()
+    }
+}
+
+impl<'a> IntoIterator for &'a VdafNameSet {
+    type Item = &'a VdafName;
+
+    type IntoIter = Iter<'a, VdafName>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.iter()
+    }
+}
+
+impl Default for VdafNameSet {
+    fn default() -> Self {
+        Self::from_iter([
+            VdafName::Prio3Count,
+            VdafName::Prio3Sum,
+            VdafName::Prio3Histogram,
+        ])
+    }
+}
+
+json_newtype!(VdafNameSet);
+
+impl VdafNameSet {
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    pub fn intersect(&self, other: &VdafNameSet) -> VdafNameSet {
+        self.0.intersection(&other.0).cloned().collect()
+    }
+}
diff --git a/src/routes/aggregators.rs b/src/routes/aggregators.rs
index a1abf7d9..c762fcfe 100644
--- a/src/routes/aggregators.rs
+++ b/src/routes/aggregators.rs
@@ -8,7 +8,8 @@ use sea_orm::{
     ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter,
 };
 use trillium::{Conn, Handler, Status};
-use trillium_api::{FromConn, Json};
+use trillium_api::{FromConn, Json, State};
+use trillium_client::Client;
 use trillium_router::RouterConnExt;
 use uuid::Uuid;
 
@@ -82,10 +83,16 @@ pub async fn index(
 
 pub async fn create(
     _: &mut Conn,
-    (db, account, Json(new_aggregator)): (Db, Account, Json<NewAggregator>),
+    (db, account, Json(new_aggregator), State(client)): (
+        Db,
+        Account,
+        Json<NewAggregator>,
+        State<Client>,
+    ),
 ) -> Result<impl Handler, Error> {
     new_aggregator
-        .build(Some(&account))?
+        .build(Some(&account), client)
+        .await?
         .insert(&db)
         .await
         .map_err(Error::from)
@@ -99,10 +106,16 @@ pub async fn delete(_: &mut Conn, (db, aggregator): (Db, Aggregator)) -> Result<
 
 pub async fn update(
     _: &mut Conn,
-    (db, aggregator, Json(update_aggregator)): (Db, Aggregator, Json<UpdateAggregator>),
+    (db, aggregator, Json(update_aggregator), State(client)): (
+        Db,
+        Aggregator,
+        Json<UpdateAggregator>,
+        State<Client>,
+    ),
 ) -> Result<Json<Aggregator>, Error> {
     update_aggregator
-        .build(aggregator)?
+        .build(aggregator, client)
+        .await?
         .update(&db)
         .await
         .map_err(Error::from)
@@ -111,10 +124,11 @@ pub async fn update(
 
 pub async fn admin_create(
     _: &mut Conn,
-    (db, Json(new_aggregator)): (Db, Json<NewAggregator>),
+    (db, Json(new_aggregator), State(client)): (Db, Json<NewAggregator>, State<Client>),
 ) -> Result<impl Handler, Error> {
     new_aggregator
-        .build(None)?
+        .build(None, client)
+        .await?
         .insert(&db)
         .await
         .map_err(Error::from)
diff --git a/test-support/src/fixtures.rs b/test-support/src/fixtures.rs
index f9f926c3..22e574a1 100644
--- a/test-support/src/fixtures.rs
+++ b/test-support/src/fixtures.rs
@@ -4,6 +4,7 @@ use rand::random;
 use trillium::HeaderValue;
 
 pub use divviup_api::api_mocks::aggregator_api::random_hpke_config;
+use uuid::Uuid;
 
 pub fn user() -> User {
     User {
@@ -104,11 +105,8 @@ pub async fn task(app: &DivviupApi, account: &Account) -> Task {
 
 pub fn new_aggregator() -> NewAggregator {
     NewAggregator {
-        role: Some(Role::Either.as_ref().to_string()),
         name: Some(format!("{}-aggregator", random_name())),
-        // This path prefix matches that in the ApiMocks router.
-        api_url: Some(format!("https://api.{}.divviup.org/prefix/", random_name())),
-        dap_url: Some(format!("https://dap.{}.divviup.org", random_name())),
+        api_url: Some(format!("https://api.{}.divviup.org/", random_name())),
         bearer_token: Some(random_name()),
         is_first_party: None,
     }
@@ -122,12 +120,29 @@ pub async fn aggregator_pair(app: &DivviupApi, account: &Account) -> (Aggregator
 }
 
 pub async fn aggregator(app: &DivviupApi, account: Option<&Account>) -> Aggregator {
-    new_aggregator()
-        .build(account)
-        .unwrap()
-        .insert(app.db())
-        .await
-        .unwrap()
+    Aggregator {
+        account_id: account.map(|a| a.id),
+        api_url: format!("https://api.{}.divviup.org/", random_name())
+            .parse()
+            .unwrap(),
+        dap_url: format!("https://dap.{}.divviup.org/", random_name())
+            .parse()
+            .unwrap(),
+        bearer_token: random_name(),
+        created_at: OffsetDateTime::now_utc(),
+        updated_at: OffsetDateTime::now_utc(),
+        deleted_at: None,
+        is_first_party: account.is_none(),
+        id: Uuid::new_v4(),
+        name: random_name(),
+        role: Role::Either,
+        query_types: Default::default(),
+        vdafs: Default::default(),
+    }
+    .into_active_model()
+    .insert(app.db())
+    .await
+    .unwrap()
 }
 
 pub async fn api_token(app: &DivviupApi, account: &Account) -> (ApiToken, HeaderValue) {
diff --git a/test-support/src/lib.rs b/test-support/src/lib.rs
index 0da5c1af..40271395 100644
--- a/test-support/src/lib.rs
+++ b/test-support/src/lib.rs
@@ -57,7 +57,7 @@ async fn set_up_schema_for<T: EntityTrait>(schema: &Schema, db: &Db, t: T) {
         .unwrap();
 }
 
-async fn set_up_schema(db: &Db) {
+pub async fn set_up_schema(db: &Db) {
     let schema = Schema::new(DbBackend::Sqlite);
     set_up_schema_for(&schema, db, Sessions).await;
     set_up_schema_for(&schema, db, Accounts).await;
diff --git a/tests/aggregator_client.rs b/tests/aggregator_client.rs
index cf3c87d2..7362a0c3 100644
--- a/tests/aggregator_client.rs
+++ b/tests/aggregator_client.rs
@@ -1,4 +1,6 @@
+use divviup_api::api_mocks::aggregator_api;
 use test_support::{assert_eq, test, *};
+use trillium::Handler;
 
 #[test(harness = set_up)]
 async fn get_task_ids(app: DivviupApi) -> TestResult {
@@ -24,3 +26,105 @@ async fn delete_task(app: DivviupApi) -> TestResult {
     assert!(client.delete_task("fake-task-id").await.is_ok());
     Ok(())
 }
+
+mod prefixes {
+    use divviup_api::{clients::aggregator_client::TaskMetrics, handler::origin_router};
+    use trillium_router::router;
+
+    use super::{assert_eq, test, *};
+
+    fn with_random_prefix<F, Fut>(f: F)
+    where
+        F: FnOnce(DivviupApi, ClientLogs, Aggregator) -> Fut,
+        Fut: std::future::Future<Output = Result<(), Box<dyn std::error::Error>>> + Send + 'static,
+    {
+        block_on(async move {
+            let client_logs = ClientLogs::default();
+            let prefix = fixtures::random_name();
+            let api_url = Url::parse(&format!(
+                "https://api.{}.divviup.org/{prefix}",
+                fixtures::random_name()
+            ))
+            .unwrap();
+            let api_mocks = (
+                trillium_logger::logger(),
+                client_logs.clone(),
+                origin_router().with_handler(
+                    &api_url.origin().ascii_serialization(),
+                    router().all(format!("/{prefix}/*"), aggregator_api::mock()),
+                ),
+            );
+            let mut app = DivviupApi::new(config(api_mocks)).await;
+            set_up_schema(app.db()).await;
+            let mut aggregator = fixtures::aggregator(&app, None).await.into_active_model();
+            aggregator.api_url = ActiveValue::Set(api_url.into());
+            let aggregator = aggregator.update(app.db()).await.unwrap();
+            let mut info = "testing".into();
+            app.init(&mut info).await;
+            f(app, client_logs, aggregator).await
+        })
+        .unwrap()
+    }
+
+    #[test(harness = with_random_prefix)]
+    async fn get_task_ids(
+        app: DivviupApi,
+        client_logs: ClientLogs,
+        aggregator: Aggregator,
+    ) -> TestResult {
+        let client = aggregator.client(app.config().client.clone());
+        let task_ids = client.get_task_ids().await?;
+
+        assert_eq!(
+            client_logs
+                .logs()
+                .iter()
+                .map(|l| l.url.as_ref())
+                .collect::<Vec<_>>(),
+            vec![
+                format!("{}/task_ids", aggregator.api_url),
+                format!("{}/task_ids?pagination_token=second", aggregator.api_url),
+                format!("{}/task_ids?pagination_token=last", aggregator.api_url)
+            ]
+        );
+        assert_eq!(client_logs.logs().len(), 3);
+        assert_eq!(task_ids.len(), 25); // two pages of 10 plus a final page of 5
+        Ok(())
+    }
+
+    #[test(harness = with_random_prefix)]
+    async fn get_task_metrics(
+        app: DivviupApi,
+        client_logs: ClientLogs,
+        aggregator: Aggregator,
+    ) -> TestResult {
+        let client = aggregator.client(app.config().client.clone());
+        let metrics = client.get_task_metrics("fake-task-id").await?;
+        assert_eq!(client_logs.last().response_json::<TaskMetrics>(), metrics);
+        assert_eq!(client_logs.last().method, Method::Get);
+        assert_eq!(
+            client_logs.last().url.as_ref(),
+            format!("{}/tasks/fake-task-id/metrics", aggregator.api_url)
+        );
+        assert_eq!(client_logs.logs().len(), 1);
+        Ok(())
+    }
+
+    #[test(harness = with_random_prefix)]
+    async fn delete_task(
+        app: DivviupApi,
+        client_logs: ClientLogs,
+        aggregator: Aggregator,
+    ) -> TestResult {
+        let client = aggregator.client(app.config().client.clone());
+        client.delete_task("fake-task-id").await?;
+        assert_eq!(client_logs.last().url.path_segments().unwrap().count(), 3);
+        assert_eq!(
+            client_logs.last().url.as_ref(),
+            format!("{}/tasks/fake-task-id", aggregator.api_url)
+        );
+        assert_eq!(client_logs.last().method, Method::Delete);
+        assert_eq!(client_logs.logs().len(), 1);
+        Ok(())
+    }
+}
diff --git a/tests/aggregators.rs b/tests/aggregators.rs
index 58428857..53687c2e 100644
--- a/tests/aggregators.rs
+++ b/tests/aggregators.rs
@@ -1,3 +1,5 @@
+use divviup_api::{clients::aggregator_client::AggregatorApiConfig, entity::aggregator::Role};
+use std::str::FromStr;
 use test_support::{assert_eq, *};
 
 mod index {
@@ -283,10 +285,12 @@ mod shared_aggregator_index {
 }
 
 mod create {
+    use divviup_api::api_mocks::aggregator_api::BAD_BEARER_TOKEN;
+
     use super::{assert_eq, test, *};
 
-    #[test(harness = set_up)]
-    async fn success(app: DivviupApi) -> TestResult {
+    #[test(harness = with_client_logs)]
+    async fn success(app: DivviupApi, client_logs: ClientLogs) -> TestResult {
         let (user, account, ..) = fixtures::member(&app).await;
 
         let new_aggregator = fixtures::new_aggregator();
@@ -298,16 +302,19 @@ mod create {
             .await;
         assert_response!(conn, 201);
         let aggregator: Aggregator = conn.response_json().await;
+
+        let aggregator_config: AggregatorApiConfig = client_logs.last().response_json();
+
         assert_eq!(aggregator.account_id.unwrap(), account.id);
-        assert_eq!(
-            aggregator.dap_url,
-            Url::parse(&new_aggregator.dap_url.unwrap()).unwrap()
-        );
+        assert_eq!(aggregator.dap_url, aggregator_config.dap_url);
         assert_eq!(
             aggregator.api_url,
             Url::parse(&new_aggregator.api_url.unwrap()).unwrap()
         );
-        assert_eq!(aggregator.role.as_ref(), new_aggregator.role.unwrap());
+        assert_eq!(
+            Role::from_str(aggregator.role.as_ref()).unwrap(),
+            aggregator_config.role
+        );
         assert!(!aggregator.is_first_party);
 
         let aggregator_from_db = aggregator.reload(app.db()).await?.unwrap();
@@ -344,21 +351,17 @@ mod create {
             .with_api_headers()
             .with_state(user)
             .with_request_json(json!({
-                "role": "whatever",
                 "bearer_token": "not valid base64",
                 "api_url": "not a url",
-                "dap_url": "also not a url"
             }))
             .run_async(&app)
             .await;
 
         assert_response!(conn, 400);
         let error: Value = conn.response_json().await;
-        assert!(error.get("role").is_some());
         assert!(error.get("name").is_some());
         assert!(error.get("api_url").is_some());
         assert!(error.get("bearer_token").is_some());
-        assert!(error.get("dap_url").is_some());
         Ok(())
     }
 
@@ -483,6 +486,30 @@ mod create {
 
         Ok(())
     }
+
+    #[test(harness = with_client_logs)]
+    async fn aggregator_api_forbidden(app: DivviupApi, client_logs: ClientLogs) -> TestResult {
+        let (user, account, ..) = fixtures::member(&app).await;
+
+        let mut new_aggregator = fixtures::new_aggregator();
+        new_aggregator.bearer_token = Some(BAD_BEARER_TOKEN.to_string());
+        let aggregator_count_before = Aggregators::find().count(app.db()).await?;
+
+        let mut conn = post(format!("/api/accounts/{}/aggregators", account.id))
+            .with_api_headers()
+            .with_state(user)
+            .with_request_json(new_aggregator.clone())
+            .run_async(&app)
+            .await;
+        assert_response!(conn, 400);
+        assert_eq!(client_logs.last().response_status, Status::Unauthorized);
+        let error: Value = conn.response_json().await;
+        assert!(error.get("bearer_token").is_some());
+        let aggregator_count_after = Aggregators::find().count(app.db()).await?;
+        assert_eq!(aggregator_count_before, aggregator_count_after);
+
+        Ok(())
+    }
 }
 
 mod show {
@@ -680,10 +707,12 @@ mod show {
 }
 
 mod update {
+    use divviup_api::api_mocks::aggregator_api::BAD_BEARER_TOKEN;
+
     use super::{assert_eq, test, *};
 
-    #[test(harness = set_up)]
-    async fn valid(app: DivviupApi) -> TestResult {
+    #[test(harness = with_client_logs)]
+    async fn valid(app: DivviupApi, client_logs: ClientLogs) -> TestResult {
         let (user, account, ..) = fixtures::member(&app).await;
         let aggregator = fixtures::aggregator(&app, Some(&account)).await;
 
@@ -691,11 +720,20 @@ mod update {
         let new_bearer_token = fixtures::random_name();
         let mut conn = patch(format!("/api/aggregators/{}", aggregator.id))
             .with_api_headers()
-            .with_request_json(json!({ "name": &new_name, "bearer_token": new_bearer_token }))
+            .with_request_json(json!({ "name": &new_name, "bearer_token": &new_bearer_token }))
             .with_state(user)
             .run_async(&app)
             .await;
         assert_ok!(conn);
+        assert_eq!(client_logs.logs().len(), 1);
+        assert_eq!(
+            client_logs
+                .last()
+                .request_headers
+                .get_str(KnownHeaderName::Authorization)
+                .unwrap(),
+            format!("Bearer {new_bearer_token}")
+        );
         let response_aggregator: Aggregator = conn.response_json().await;
         assert_eq!(response_aggregator.name, new_name);
         let reloaded = aggregator.reload(app.db()).await?.unwrap();
@@ -705,6 +743,40 @@ mod update {
         Ok(())
     }
 
+    #[test(harness = with_client_logs)]
+    async fn bad_bearer_token(app: DivviupApi, client_logs: ClientLogs) -> TestResult {
+        let (user, account, ..) = fixtures::member(&app).await;
+        let aggregator = fixtures::aggregator(&app, Some(&account)).await;
+
+        let original_bearer_token = aggregator.bearer_token.clone();
+        let mut conn = patch(format!("/api/aggregators/{}", aggregator.id))
+            .with_api_headers()
+            .with_request_json(json!({ "bearer_token": &BAD_BEARER_TOKEN }))
+            .with_state(user)
+            .run_async(&app)
+            .await;
+        assert_status!(conn, 400);
+        assert_eq!(client_logs.logs().len(), 1);
+        assert_eq!(
+            client_logs
+                .last()
+                .request_headers
+                .get_str(KnownHeaderName::Authorization)
+                .unwrap(),
+            format!("Bearer {BAD_BEARER_TOKEN}")
+        );
+
+        assert_eq!(
+            aggregator.reload(app.db()).await?.unwrap().bearer_token,
+            original_bearer_token
+        );
+        assert_eq!(client_logs.last().response_status, Status::Unauthorized);
+        let errors: Value = conn.response_json().await;
+        assert!(errors.get("bearer_token").is_some());
+
+        Ok(())
+    }
+
     #[test(harness = set_up)]
     async fn invalid(app: DivviupApi) -> TestResult {
         let (user, account, ..) = fixtures::member(&app).await;
@@ -1129,8 +1201,8 @@ mod delete {
 mod shared_create {
     use super::{assert_eq, test, *};
 
-    #[test(harness = set_up)]
-    async fn as_admin(app: DivviupApi) -> TestResult {
+    #[test(harness = with_client_logs)]
+    async fn as_admin(app: DivviupApi, client_logs: ClientLogs) -> TestResult {
         let (admin, ..) = fixtures::admin(&app).await;
         let new_aggregator = fixtures::new_aggregator();
         let mut conn = post("/api/aggregators")
@@ -1142,18 +1214,18 @@ mod shared_create {
 
         assert_response!(conn, 201);
         let aggregator: Aggregator = conn.response_json().await;
-        assert!(aggregator.is_first_party);
-        assert_eq!(
-            aggregator.dap_url,
-            Url::parse(&new_aggregator.dap_url.unwrap()).unwrap()
-        );
+        let aggregator_config: AggregatorApiConfig = client_logs.last().response_json();
+
+        assert!(aggregator.account_id.is_none());
+        assert_eq!(aggregator.dap_url, aggregator_config.dap_url);
         assert_eq!(
             aggregator.api_url,
             Url::parse(&new_aggregator.api_url.unwrap()).unwrap()
         );
-        assert_eq!(aggregator.role.as_ref(), new_aggregator.role.unwrap());
-        assert!(aggregator.account_id.is_none());
-
+        assert_eq!(
+            Role::from_str(aggregator.role.as_ref()).unwrap(),
+            aggregator_config.role
+        );
         // defaults to true when not specified
         assert!(aggregator.is_first_party);
 
diff --git a/tests/new_task.rs b/tests/new_task.rs
index 0df009e0..ac5f686b 100644
--- a/tests/new_task.rs
+++ b/tests/new_task.rs
@@ -1,3 +1,4 @@
+use divviup_api::entity::aggregator::Role;
 use test_support::{assert_eq, test, *};
 
 pub async fn assert_errors(app: &DivviupApi, new_task: &NewTask, field: &str, codes: &[&str]) {
@@ -45,21 +46,13 @@ async fn batch_size(app: DivviupApi) -> TestResult {
 
 #[test(harness = set_up)]
 async fn aggregator_roles(app: DivviupApi) -> TestResult {
-    let leader = NewAggregator {
-        role: Some("leader".into()),
-        ..fixtures::new_aggregator()
-    }
-    .build(None)?
-    .insert(app.db())
-    .await?;
+    let mut leader = fixtures::aggregator(&app, None).await.into_active_model();
+    leader.role = ActiveValue::Set(Role::Leader);
+    let leader = leader.update(app.db()).await?;
 
-    let helper = NewAggregator {
-        role: Some("helper".into()),
-        ..fixtures::new_aggregator()
-    }
-    .build(None)?
-    .insert(app.db())
-    .await?;
+    let mut helper = fixtures::aggregator(&app, None).await.into_active_model();
+    helper.role = ActiveValue::Set(Role::Helper);
+    let helper = helper.update(app.db()).await?;
 
     let either = fixtures::aggregator(&app, None).await;