These routes appear in the generated OpenAPI because they are part of the deployed /v1 surface. They are not general developer endpoints.
Workspace operator API
/v1/platform/** manages reviewed platform connections, price books, test invocations, application credit, and grants. Access requires an interactive session for an explicitly allowlisted workspace operator.
Internal runtime bridges
| Family | Purpose |
|---|---|
/v1/internal/actions/** |
Execute or inspect an already authorized native Action |
/v1/internal/services/execute |
Native task bridge for one application-scoped service query |
/v1/internal/recipes/** |
Deterministic Recipe dispatch and runtime bridge |
/v1/internal/bot-execution-credentials/** |
Issue, inspect, or revoke short-lived Bot execution credentials |
Each family has a private configured credential and rejects Clerk sessions, developer tokens, and ordinary Agent keys.
Provider callbacks and webhooks
| Route | Trust basis |
|---|---|
/v1/oauth/callback |
Single-use OAuth state created by AgentMQ |
/v1/webhooks/clerk |
Clerk signature over raw request bytes |
/v1/webhooks/clerk/applications/{bindingId} |
Application identity webhook binding and signature |
/v1/webhooks/stripe |
Stripe signature over raw request bytes |
A redirect or client-side success page is never authoritative payment proof.
Legacy and historical bridges
/v1/topups, /v1/topups/reversals, /v1/topups/{id}/refund, /v1/topups/{id}/suspend, /v1/purchases, and /v1/purchases/{id}/refund are authenticated integration routes for historical provisioning or reconciliation. Public clients must not call them with a user or Agent credential.
Source of truth
Use the OpenAPI document for complete schemas. Authentication configuration is intentionally kept outside that downloadable document.