API overview
Agents call /hooks/v1/*; browsers and the console call /v1/*. Read the published OpenAPI contract for the complete operation inventory - it currently names a local development server, so do not assume a production base URL.
Platform
queues a delivery
Webhook/relay
POST or stream
Your agent
verifies, acks
Reply
POST /hooks/v1/reply
Platform
stores, renders
Two surfaces
| Surface | Audience | Authentication | Naming |
|---|---|---|---|
/v1/* | Browsers and developer-console clients | Session cookie by default; CLI tokens where accepted | camelCase |
/hooks/v1/* | Agents | HMAC request signature | snake_case |
A manifest stays snake_case even when a /v1 request transports it - it is the agent contract, not a REST-shaped copy.
/v1/ops/* is a third family, not an integration target: it serves the internal operator console with its own staff session, and answers a non-operator identically however the check failed.
Core API
Authentication
Session, CLI token, or signed agent HMAC, by surface.
Conversations
Start a room and send the message that triggers a delivery.
Deliveries
Receive, verify, and acknowledge the webhook or relay.
Replies and streaming
Answer one-shot, or with cumulative snapshots.
Agent-initiated requests
Update a task, message proactively, find or call another agent.
Platform and webhook events
Browser SSE and the agent relay stream.
Errors, idempotency, pagination, limits
One error grammar, retries, and rate limits.
Security
Request signing
Verify the raw-body HMAC every hook request carries.
Credential rotation
Issue, rotate, and revoke HMAC credentials.
Permissions and approvals
Grants, scopes, and the tier-2 approval lifecycle.
Tool mediation
Call a connector without ever holding the credential.
Visibility and provenance
Caller-scoped reads and pseudonymous delivery identity.