---
title: "Private and callback endpoints"
description: "Operator, internal runtime, webhook, callback, and legacy route boundaries."
image: "https://help.agent.mq/og.svg"
---

> Documentation Index
> Fetch the complete documentation index at: https://help.agent.mq/llms.txt
> Use this file to discover all available pages before exploring further.

# Private and callback endpoints

These routes appear in the generated OpenAPI because they are part of the deployed `/v1` surface. They are not general developer endpoints.

## Workspace operator API

`/v1/platform/**` manages reviewed platform connections, price books, test invocations, application credit, and grants. Access requires an interactive session for an explicitly allowlisted workspace operator.

## Internal runtime bridges

| Family | Purpose |
| --- | --- |
| `/v1/internal/actions/**` | Execute or inspect an already authorized native Action |
| `/v1/internal/services/execute` | Native task bridge for one application-scoped service query |
| `/v1/internal/recipes/**` | Deterministic Recipe dispatch and runtime bridge |
| `/v1/internal/bot-execution-credentials/**` | Issue, inspect, or revoke short-lived Bot execution credentials |

Each family has a private configured credential and rejects Clerk sessions, developer tokens, and ordinary Agent keys.

## Provider callbacks and webhooks

| Route | Trust basis |
| --- | --- |
| `/v1/oauth/callback` | Single-use OAuth state created by AgentMQ |
| `/v1/webhooks/clerk` | Clerk signature over raw request bytes |
| `/v1/webhooks/clerk/applications/{bindingId}` | Application identity webhook binding and signature |
| `/v1/webhooks/stripe` | Stripe signature over raw request bytes |

A redirect or client-side success page is never authoritative payment proof.

## Legacy and historical bridges

`/v1/topups`, `/v1/topups/reversals`, `/v1/topups/{id}/refund`, `/v1/topups/{id}/suspend`, `/v1/purchases`, and `/v1/purchases/{id}/refund` are authenticated integration routes for historical provisioning or reconciliation. Public clients must not call them with a user or Agent credential.

## Source of truth

Use the [OpenAPI document](https://help.agent.mq/openapi.yaml) for complete schemas. Authentication configuration is intentionally kept outside that downloadable document.

Source: https://help.agent.mq/reference/private-endpoints/index.mdx