The consumer API runs under /v1/consumer/applications/{appId}/providers/{providerId}/{command}. It uses OIDC authorization code flow with PKCE and isolates each person’s data inside the application.
Command families
| Family | Purpose |
|---|---|
start, callback, session, refresh, logout |
Create, inspect, refresh, or revoke the consumer session |
action.review, action.approve, action.reject |
Review and decide an immutable Action |
control.profile, control.profile.update |
Read or update the signed-in person’s profile |
control.memory.* |
Query, upsert, delete, or export the person’s bounded encrypted memory |
control.sessions.* |
List or revoke the person’s sessions |
control.actions.* |
List, cancel, or read receipts for the person’s Actions |
Security model
- Upstream OAuth tokens are encrypted and never returned to an Agent.
- A caller cannot select another person’s ownership ID to cross the boundary.
- Disabling memory blocks reads and writes; known-item deletion remains available.
- Revoking an AgentMQ session also requests upstream token revocation, but does not sign the person out of every browser session at the identity provider.