AgentStack Auth API

openapi: 3.2.0
info:
  title: AgentStack Core Auth API
  description: 'AgentStack is a Universal Processing System — a patented AI-first platform that replaces an entire backend stack and ships a ready admin UI. One ecosystem covers auth, payments, data, social, messenger, AI, knowledge base, game economy, RBAC and more — behind a single SDK, REST API and Model Context Protocol surface. You say the outcome. An AI with AgentStack connected hosts, configures, and reads the result back. Free tier from $0.


    **Two layers:** (1) **Universal access** — `POST /mcp` (`agentstack.execute`), `GET /mcp/actions`, `GET /mcp/discovery`; `GET/POST /api/dna/data` (8DNA key-value); `POST /api/commands/*` (Protein, same stack as MCP `commands.execute`). (2) **REST compatibility** — many `/api/*` routes for SPA, SDK, OAuth, webhooks, uploads. See repo doc `docs/API_CHANNELS_AND_PROTOCOLS.md`.


    **Channels:** Prefer MCP (`POST /mcp`, `GET /mcp/actions`), 8DNA (`/api/dna/data`), and Protein commands (`/api/commands/*`) for new integrations. REST paths below are the compatibility surface for SPA, SDKs, OAuth, and uploads. See `/api-docs`, `/mcp-docs`, and docs/API_CHANNELS_AND_PROTOCOLS.md.


    **Try it:** Use Authorize with `X-API-Key` or Bearer JWT. Changelog: docs/api/API_CHANGELOG.md.'
  version: 0.4.24
  x-agentstack-version: 0.4.24
  x-genetic-tag: docs.api.specs.gen1
  x-changelog-url: docs/api/API_CHANGELOG.md
  x-exported-at: '2026-11-01T04:40:16Z'
security:
- ApiKeyAuth: []
- BearerAuth: []
tags:
- name: Auth
paths:
  /api/hosted-apps/{project_id}/session:
    post:
      tags:
      - Auth
      summary: Mint Hosted App Session
      operationId: mint_hosted_app_session_api_hosted_apps__project_id__session_post
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: integer
          title: Project Id
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '400':
          description: Bad Request
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '409':
          description: Conflict
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '500':
          description: Internal Server Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-channel: rest_compat
    delete:
      tags:
      - Auth
      summary: Clear Hosted App Session
      description: Drop the hosted_app cookie. The cabinet bearer is not involved.
      operationId: clear_hosted_app_session_api_hosted_apps__project_id__session_delete
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: integer
          title: Project Id
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '400':
          description: Bad Request
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '409':
          description: Conflict
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '500':
          description: Internal Server Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-channel: rest_compat
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ProblemDetails:
      type: object
      description: RFC 7807 Problem Details (+ AgentStack trace_id).
      required:
      - title
      - status
      properties:
        type:
          type: string
          format: uri
          default: about:blank
          description: URI reference identifying the problem type.
        title:
          type: string
          description: Short, human-readable summary of the problem type.
        status:
          type: integer
          minimum: 100
          maximum: 599
          description: HTTP status code for this occurrence.
        detail:
          type: string
          description: Human-readable explanation specific to this occurrence.
        instance:
          type: string
          format: uri
          description: URI reference identifying this specific occurrence.
        trace_id:
          type: string
          description: AgentStack request/trace correlation id (X-Trace-Id).
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      description: Client-generated key to make mutating requests idempotent.
      schema:
        type: string
        maxLength: 256
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: User session JWT from /auth/login.
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'Project API key. Optional service_caps whitelist is enforced before RBAC. See /dev/docs/secure/api-keys-scopes. OAuth 2.1 Device Code (RFC 8628) for plugins: see /oauth/device/code — documented in docs, not as a non-standard OAS flow.'
x-tagGroups:
- name: Unified access
  tags:
  - MCP
  - 8DNA API
  - Commands
- name: Field access policy
  tags:
  - DataAccess
- name: Identity & access
  tags:
  - Authentication
  - User
  - Profile
  - Sessions
  - RBAC
  - Permissions
  - OAuth 2.1
  - API Keys
- name: Project platform
  tags:
  - Projects
  - Project
  - CRM
  - Business
  - Integrations
  - Agents Fleet
  - Support
  - Bots
  - Dashboard
  - Notifications
- name: Commerce
  tags:
  - Payments
  - AgentNet
  - Commerce
  - Commerce Shop
  - Commerce Merchant
  - Marketplace
  - Assets
  - Global Assets
  - Invoices
  - Buffs
- name: Automation
  tags:
  - Logic Engine
  - Logic Templates
  - Commands
  - Scheduler
  - Webhooks
  - Unified API
- name: Data & AI
  tags:
  - 8DNA API
  - RAG
  - Neural Architecture
  - Neural Events
  - AI Builder
  - Files
  - Project Files
  - Hosting
- name: Ops
  tags:
  - Health & Metrics
  - Admin
  - Analytics
  - Backup Management
  - OAuth 2.1 Admin
  - Observability
  - OpTrace
  - API Hub
- name: Fabric & platform
  tags:
  - Fabric
  - Capabilities
  - Sandbox
  - Shell Hub
  - Platform
  - Discovery
  - Guidance
  - Ecosystem
- name: Social & AgentNet
  tags:
  - AgentSocial
  - AgentNet
  - AgentNet PTR
  - AgentNet BNB
  - AgentNet Solana
  - AgentNet Arbitrum
  - AgentNet Chain Control
  - AgentNet Chain Control Public
- name: Public surfaces
  tags:
  - Public hosting
  - Public demo hosting
  - Public showcase
  - Public grants
  - Public commerce lite
- name: Finance & billing
  tags:
  - Finance
  - Billing
  - Business
  - PrincipalAccess