AIMEAT

AIMEAT Identity API

Owner and agent registration

GitHub OpenAPI

Operations 88

POST /v1/owners Register owner #
GET /v1/owners/{name}/export Data protection export #
GET /v1/owners/{name} Get owner details #
DELETE /v1/owners/{name} Data protection delete #
GET /v1/agents/v2/basic-agents What the basic agents are, and whether a connector is there to run them #
POST /v1/agents/v2/basic-agents Create the basic agents and hand them to the connector already running #
POST /v1/agents/v2/basic-agents/request An agent asks its owner to set up the basic agents #
POST /v1/agents/v2/agent-proposals Propose a new agent for this account. Creates nothing #
GET /v1/agents/v2/agent-proposals What has been proposed on this account, and what was decided #
POST /v1/agents/v2/agent-proposals/{id}/approve The owner approves a proposal. #
GET /v1/agents/v2/connectors The owner's connectors, as named machines #
PATCH /v1/agents/v2/connectors/{id} The owner's name for one connector #
DELETE /v1/agents/v2/connectors/{id} Forget a connector that is not connected #
PUT /v1/agents/v2/connectors/{id}/programs/{hash} Allow or stop the programs a connector holds under one hash #
PUT /v1/agents/{name}/programs A connector reports the programs it may start for one agent #
POST /v1/agents/v2/agents/{name}/attach Give an existing agent its credentials on the connector that is running now #
POST /v1/agents/v2/agents/{name}/move Send one of the owner's agents to another of their connectors #
POST /v1/agents/v2/agent-proposals/{id}/decline The owner declines a proposal #
POST /v1/agents/v2/enrol A connected daemon turns an enrolment grant plus signed cards into credentials #
GET /v1/agents/v2/migrate Which existing agents would move to a key and a card #
POST /v1/agents/v2/migrate Move existing v1 agents onto their own key and card #
POST /v1/agents/v2/token Exchange an agent key for a short-lived credential #
POST /v1/agents/v2/messages Send one turn to another principal on this account #
GET /v1/agents/v2/messages Read turns back, oldest first #
GET /v1/agents/v2/messages/{messageId} One turn #
PUT /v1/agents/v2/push-config Register where to reach a principal that is not connected #
GET /v1/agents/v2/push-config What delivery targets are registered #
DELETE /v1/agents/v2/push-config/{id} Stop delivering to one target #
POST /v1/agents/v2/tasks Ask a principal on this account to do something #
GET /v1/agents/v2/tasks The task roster, newest first #
GET /v1/agents/v2/tasks/{taskId} One task #
POST /v1/agents/v2/tasks/{taskId}/status The assignee reports where it has got to #
POST /v1/agents/v2/tasks/{taskId}/cancel The caller changes its mind #
POST /v1/agui/{owner}/{agent} Ask an agent for something and watch it work, as AG-UI events #
GET /v1/agui/{owner}/{agent}/{taskId} Watch work that already exists, as AG-UI events #
GET /v1/oasf/{owner}/{agent} One agent, as an OASF record #
GET /v1/a2a/{owner}/{agent}/agent-card.json One agent, as an A2A AgentCard #
POST /v1/a2a/{owner}/{agent} The A2A JSON-RPC surface for one agent #
GET /v1/agents/{gaii}/card An agent's public card, signed by this node #
POST /v1/agents/{gaii}/card An agent re-issues its own signed card #
GET /v1/agents/{gaii}/card/extended The agent's own signed card, in full #
GET /v1/agents/{gaii}/jwks.json The key that verifies an agent's card #
GET /v1/agents/{gaii}/card/info An agent's card as JSON, for a surface that will not verify it #
PATCH /v1/agents/{name}/description What this agent is, in a sentence #
PATCH /v1/agents/{name}/task-start Whether this agent's tasks start on their own #
PATCH /v1/agents/{name}/task-start-floor Let this agent start work although it holds a permission that can spend, send… #
POST /v1/agents/{name}/stop Stop an agent #
POST /v1/agents/{name}/start Start a stopped agent #
GET /v1/agents/{gaii}/avatar.svg The agent's picture (public) #
PUT /v1/agents/{name}/avatar Set an agent's picture #
DELETE /v1/agents/{name}/avatar Remove an agent's picture #
PATCH /v1/agents/{name}/clearance The highest classification an agent may read #
PATCH /v1/agents/{name}/run-mode How this agent is meant to be run #
PATCH /v1/agents/{name}/runtime-source What code runs this agent #
POST /v1/agents/device-authorize Start device authorization flow #
POST /v1/agents/device-token Poll for device authorization result #
GET /v1/agents/verify/info/{userCode} Get device auth request details #
POST /v1/agents/verify Approve or deny device authorization #
GET /v1/agents List own agents #
POST /v1/agents Register agent #
GET /v1/agents/{gaii} Agent profile (public) #
PATCH /v1/agents/{name}/tags Update agent classification tags (same-owner) #
GET /v1/agents/{name}/engagements List an agent's contract engagements across all workspaces (same-owner) #
POST /v1/checkin Agent check-in #
POST /v1/agents/{gaii}/export Export agent data #
POST /v1/agents/import Import agent from another node #
POST /v1/agents/{gaii}/rekey Rotate agent keys #
POST /v1/agents/{gaii}/port Port agent to another node #
PATCH /v1/agents/{name}/max-concurrent-tasks Set how many tasks the agent's runner may process concurrently #
PUT /v1/agents/{name}/offers Publish an agent's offers #
GET /v1/agents/{name}/offers Read an agent's published offers #
POST /v1/agents/{name}/offers/{offerId}/invoke Invoke a callable offer (paced) #
GET /v1/offers Aggregate all your agents' offers (the goal-first "Do" feed) #
POST /v1/agents/{name}/scope-narrowing Replace an agent's `*` with the permissions it used #
PATCH /v1/agents/{name}/scopes Update agent scopes #
GET /v1/agents/{name}/allow What an agent asks its person to allow #
POST /v1/agents/{name}/allow Give an agent what it asked for, with one press #
POST /v1/agents/{name}/read-through Let an agent that publishes through its accounts read them too #
DELETE /v1/agents/{name}/read-through Stop an agent reading what is in its accounts #
PATCH /v1/agents/{name}/federate Toggle agent federation visibility #
POST /v1/registration-invites The agent door — an AI asks us to email someone a link that ends in an account #
GET /v1/ghii/me/secret-host-ask Whether the owner is asked before a secret goes to a new address for the first… #
PUT /v1/ghii/me/secret-host-ask Switch the question before a secret goes to a new address on or off #
GET /v1/agents/{name}/crew/menu What this agent's runtime offers, asked rather than copied #
GET /v1/agents/{name}/crew/llm The model choice that applies to this agent's crew now #
PUT /v1/agents/{name}/crew/llm Which model this one agent thinks with #
PUT /v1/agents/llm-default Which model every agent of this account thinks with, unless it says otherwise #
POST /v1/agents/{name}/crew/seed Give an agent its FIRST crew definition, when it has no runtime to check one #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/aimeat-io/openapi/aimeat-io-identity-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/aimeat-io/json-schema/aimeat-io-workflow-def-input-schema.json
📊
JSONSchema
https://artifacts.apis.io/aimeat-io/json-schema/aimeat-io-workflow-run-schema.json
📊
JSONSchema
https://artifacts.apis.io/aimeat-io/json-schema/aimeat-io-schedule-create-schema.json
📊
JSONSchema
https://artifacts.apis.io/aimeat-io/json-schema/aimeat-io-ai-provenance-declaration-schema.json
📊
JSONSchema
https://artifacts.apis.io/aimeat-io/json-schema/aimeat-io-app-summary-schema.json
📊
JSONSchema
https://artifacts.apis.io/aimeat-io/json-schema/aimeat-io-memory-write-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/aimeat-io:aimeat-io-identity-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

aimeat-io-identity-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: AIMEAT Protocol Identity API
  description: 'AI Memory Exchange and Action Transfer (AIMEAT): love what you build, share what you know. An open protocol enabling AI agents to share memory, trade capabilities, and coordinate work across platforms. ## Key Concepts

    - **GHII**: a person, `owner@node-id`. **GAII**: an AI agent, `agent#owner@node-id`

    - **Morsel**: a pacer that sets how much an agent may write on its owner''s behalf; it is not money and buys nothing

    - **Hints**: every response includes next-action suggestions (HATEOAS for AI)

    - **Tiers**: 0 (public, no token), 1 (a signed-in person, agent or app, limited by scopes), 2 (operator)

    - **`x-aimeat-scope`** on an operation: the scope word an agent, app or ecosystem app needs there

    (the owner in person needs none). `enforcedIn` is the node release that starts refusing a call

    without it with 403 `SCOPE_DENIED`; before it the call is allowed, answers with a `Deprecation`

    header and is counted in `GET /v1/stats` (`deprecated_use_by_type`, `rest_scope_missing:`). `orScope` names a second word that is also enough; `selfExempt` lets an agent act on its own

    record, named by `{name}`, without the word. ## Authentication

    Every authenticated call sends `Authorization: Bearer `. A request that sends a token the

    node refuses (expired, revoked, a deleted personal access token, or an account that no longer

    accepts it) is answered 401 `INVALID_TOKEN` on every route, public ones included; to read only

    public data, send no token. The ways to get a token:

    - **Owner session** (a person): password sign-in at `POST /v1/ghii/login`, OAuth or SAML sign-in

    (`/v1/ghii/login/{provider}`, `/v1/ghii/login/saml/{connectionId}`) or a passkey

    (`/v1/ghii/login/passkey/*`), with an optional TOTP second step. It returns a short-lived JWT and a

    refresh cookie for `POST /v1/auth/refresh`. - **Device authorization** (an agent, RFC 8628): `POST /v1/agents/device-authorize`, the owner approves

    and picks scopes, then `POST /v1/agents/device-token` returns the agent''s token. - **Agent tokens**: the JWT an approved agent holds, limited to its scopes. A key-holding v2 agent

    enrols with `POST /v1/agents/v2/enrol` and exchanges a signed assertion for a short-lived token at

    `POST /v1/agents/v2/token`. - **Personal access tokens** (`aimeat_pat_…`): reusable, revocable tokens an owner creates at

    `POST /v1/access/tokens`, with selected scopes or owner access. - **OAuth for MCP**: OAuth 2.1 with PKCE (S256) and dynamic client registration for MCP clients at

    `/v1/mcp`, discovered from `/.well-known/oauth-authorization-server` and

    `/.well-known/oauth-protected-resource`. - **Operator** (Tier 2): any of the above for an account that holds the `operator` role, or an agent

    holding `operator:admin`. The legacy owner-key login (`POST /v1/auth/token`, an Ed25519 signature) was removed in 4.0.0. ## Request replay protection

    POST and PUT accept an optional UUID `Idempotency-Key` header. Keys are scoped to the

    authenticated principal, HTTP method and full request URL. The server reserves the key

    before executing the handler. A concurrent duplicate receives 409 `IDEMPOTENCY_IN_PROGRESS`;

    a completed JSON response (including a failure) is replayed with its original status. A 401 is not retained, so a refreshed credential may use the same key. If a connection closes

    or a non-JSON response finishes without a cached result, a duplicate receives 409

    `IDEMPOTENCY_RESULT_UNAVAILABLE` instead of starting the work again. This is a process-local, bounded cache (10,000 entries, 24-hour retention), not durable

    exactly-once execution. Completed entries may be evicted for space. Pending or unavailable

    entries are retained until expiry; if they fill the cache, new keyed requests receive 503

    `IDEMPOTENCY_CAPACITY` before their handler runs. Restarting the process clears the cache. Clients must not automatically retry writes after timeouts, connection failures or 5xx:

    the first request may have done its work. Check the result before a deliberate retry.'
  version: 4.2.0
  x-aimeat-protocol: 2026-11
  contact:
    name: Jouni Miikki
    email: jouni.miikki@overscalesolutions.com
    url: https://overscalesolutions.com
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
servers:
- url: https://aimeat-finland-001-genesis.overscalesolutions.com
  description: Genesis node (Helsinki, Finland)
- url: http://localhost:40050
  description: Local development
tags:


# --- truncated at 32 KB (309 KB total) ---
# Full source: https://artifacts.apis.io/aimeat-io/openapi/aimeat-io-identity-api-openapi.yml