HTTP API

The running deployment publishes its OpenAPI 3.1 contract at /api/openapi.json and Swagger UI at /api/docs. Send a root or scoped broker credential on authenticated server requests:

Authorization: Bearer <broker-credential>

Connections

Method	Path	Purpose
`POST`	`/api/connections/access/{connection_path}`	Return a secret or `authorization_required`
`POST`	`/api/connections/authorize/{connection_path}`	Start fresh authorization unconditionally
`PUT`	`/api/connections/secret/{connection_path}`	Set or rotate a static provider secret
`GET`	`/api/connections`	List metadata
`GET`	`/api/connections/entry/{connection_path}`	Get metadata
`DELETE`	`/api/connections/entry/{connection_path}`	Revoke and delete
`GET`	`/api/connections/providers`	List trusted provider implementations
`GET`	`/api/connections/callback/{provider_id}`	Complete OAuth; public
`GET`	`/api/connections/client-metadata.json`	Publish deployment CIMD; public

An access body may contain:

{
  "configuration": {
    "resource_url": "https://gmail.run.tools"
  },
  "scopes": [],
  "return_to": "https://app.example.com/integrations"
}

configuration contains non-secret input accepted by the trusted provider. Provider selection always comes from the final path segment, never the body. The provider list describes credential acquisition and input controls:

{
  "providers": [
    {
      "id": "mcp",
      "label": "MCP server",
      "authentication": "oauth",
      "input_schema": {
        "fields": [
          {
            "name": "name",
            "label": "Resource name",
            "type": "text",
            "target": "identity",
            "required": true
          },
          {
            "name": "resource_url",
            "label": "MCP server URL",
            "type": "url",
            "target": "configuration",
            "required": true
          },
          {
            "name": "scopes",
            "label": "Scopes",
            "type": "string_list",
            "target": "scopes",
            "required": false
          }
        ]
      }
    }
  ]
}

Authentication is oauth or secret. Identity fields become path segments; configuration fields become immutable, non-secret connection configuration; scope fields become requested OAuth scopes. Clients should render input_schema.fields.

Broker administration

Method	Path	Purpose
`POST`	`/api/admin/tokens`	Mint a named scoped broker token
`GET`	`/api/admin/tokens`	List active token names; root only
`DELETE`	`/api/admin/tokens/{name}`	Revoke a token and its delegated descendants; root only

Browser facade

When application auth is configured, /api/client exposes provider metadata, connection metadata, authorization starts, write-only secret storage, and disconnect. It rejects credential access, callbacks, and administration. All application responses set Cache-Control: no-store. List and get responses never include stored secrets, refresh tokens, OAuth client secrets, or bearer values. Secret writes return only storage status.

Configuration

Security

License

HTTP API

Connections

Broker administration

Browser facade

​Connections

​Broker administration

​Browser facade

Connections

Broker administration

Browser facade