All paths are relative to https://api.agent.mq. The generated OpenAPI file contains every method, request schema, response schema, and validation rule in the current source build.
Public configuration and device flow
| Path family | Purpose |
|---|---|
GET /v1/config |
Hosted sign-in configuration |
/v1/device/authorizations |
Start, inspect, and poll device authorization |
POST /v1/device/approvals |
Signed-in human approval or refusal |
POST /v1/device/tokens |
Collect the developer token after approval |
GET /v1/purchases/catalog |
Vendor-neutral managed-operation catalog |
Developer account and applications
| Path family | Purpose |
|---|---|
/v1/account/tokens |
Create, list, and revoke personal access tokens |
/v1/applications |
List and create applications |
/v1/applications/{appId} |
Read and rename one application |
/members, /invitations |
Membership and single-use invitations |
/limits |
Per-application provider admission limits |
/operations/{id} |
Configure an application operation |
/credentials/{id} |
Write or rotate an encrypted credential |
Agent operations and Actions
| Path family | Purpose |
|---|---|
/v1/applications/{appId}/agent-keys |
Issue, list, and revoke application Agent keys |
/v1/agent/applications/{appId}/operations |
Discover callable operations and schemas |
/operations/{operationId}/invoke |
Invoke one granted operation |
/operations/{operationId}/prepare |
Prepare one immutable end-user Action |
/actions/{jobId} |
Read and execute an approved Action |
/invocations/{id} |
Read an Agent-owned invocation receipt |
Connections and service execution
| Path family | Purpose |
|---|---|
/v1/applications/{appId}/connections |
Discover services and manage application connections |
/oauth-connections |
List, authorize, and revoke OAuth connections |
/oauth-providers/{providerId}/setup |
Apply managed OAuth provider setup actions |
/service-invocations |
Test operations, list metadata, and read retained results |
/service-reconciliations |
Settle or release ambiguous managed invocations |
Workflows and automation
| Path family | Purpose |
|---|---|
/v1/applications/{appId}/flows |
List or deploy application workflow YAML |
/workflow-operations |
Publish, list, or withdraw workflow operations |
Consumer and identity
| Path family | Purpose |
|---|---|
/v1/consumer/applications/{appId}/providers/{providerId}/{command} |
OIDC session, profile, memory, Action, and receipt controls |
/v1/applications/{appId}/identity |
Read managed identity status |
/identity/production/** |
Prepare, check, and activate a production domain |
/identity/phone-authentication |
Configure usage-based phone authentication |
/identity/enterprise-connections/** |
Manage and test OIDC or SAML enterprise connections |
/domains/{command} |
Execute an application-owned domain command |
Credits and top-ups
| Path family | Purpose |
|---|---|
/v1/applications/{appId}/credits |
Read account-shared credit and reservations |
/v1/topups/applications/{appId}/quote |
Read authoritative top-up packs and availability |
/v1/topups/stripe/** |
Owner-only checkout and automatic top-up settings |
Agentic purchases — Preview
| Path family | Purpose |
|---|---|
/v1/applications/{appId}/purchases |
Create a bounded purchase intent |
/purchases/{purchaseId} |
Read redacted state and current revision |
/approve, /cancel |
Approve one digest or cancel before commit |
/handoffs/** |
Claim, read, complete, or cancel an exclusive human-control lease |
These routes are a preview control plane, not a production browser or payment executor. See Availability and boundaries.
Restricted families
Operator, internal runtime, signed webhook, provider callback, legacy bridge, and historical purchase-provisioning routes are documented separately in Private and callback endpoints.