Ausca Artifacts API

openapi: 3.2.0
info:
  contact:
    name: Ausca
    url: https://ausca.com
  description: Transport-neutral paid invocations, keyless artifact ingress, and focused browser-session and receive-only inbox lease control.
  title: Ausca Artifacts API
  version: 1.3.1
  x-guidance: Start with https://ausca.com/SKILL.md, resolve an immutable offer before acting, and reuse the same invocation bytes and idempotency key after an uncertain response.
servers:
- url: https://ausca.com
security: []
tags:
- name: Artifacts
paths:
  /v1/artifacts:
    post:
      description: Verify and temporarily store one bounded artifact without an account or API key. The returned immutable reference, digest, media type, and size form the artifact commitment supplied to a document or media invocation. Reuse the same idempotency key only for the same bytes and metadata.
      operationId: CommitArtifact
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ArtifactUploadRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ArtifactUploadResult'
          description: Verified immutable artifact commitment
        default:
          $ref: '#/components/responses/ErrorResponse'
      security: []
      summary: Commit an artifact for document or media input
      x-ausca-mcp:
        destructive: true
        enabledByDefault: false
        idempotent: true
        inputSchema: '#/components/schemas/ArtifactUploadRequest'
        name: ausca_commit_artifact
        openWorld: true
        readOnly: false
        resultSchema: '#/components/schemas/ArtifactUploadResult'
      tags:
      - Artifacts
  /v1/artifacts/{artifact_uri}/access:
    post:
      description: Return an idempotent, short-lived download URL for one verified artifact this service holds, including a result artifact named by a succeeded invocation's output_artifact. HTTP sends no request body, not even an empty JSON object; artifact_uri is the URL path parameter and Idempotency-Key is a header. The MCP tool instead takes artifact_uri and idempotency_key as tool arguments. The URL expires after at most 60 seconds. The immutable artifact reference is the only authority; verify downloaded bytes against the returned content digest.
      operationId: CreateArtifactAccess
      parameters:
      - $ref: '#/components/parameters/ArtifactUri'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateArtifactAccessResult'
          description: Short-lived artifact download access
        default:
          $ref: '#/components/responses/ErrorResponse'
      security: []
      summary: Mint artifact download access
      x-ausca-mcp:
        destructive: false
        enabledByDefault: true
        idempotent: true
        inputSchema: '#/components/schemas/CreateArtifactAccessInput'
        name: ausca_artifact_access
        openWorld: true
        readOnly: false
        resultSchema: '#/components/schemas/CreateArtifactAccessResult'
      tags:
      - Artifacts
components:
  schemas:
    CreateArtifactAccessResult:
      additionalProperties: false
      properties:
        artifact:
          $ref: '#/components/schemas/ArtifactAccess'
        status:
          const: ready
      required:
      - status
      - artifact
      type: object
    ArtifactUri:
      description: Opaque artifact reference minted by artifact commitment. Relay it unchanged; its form is not part of the contract.
      maxLength: 512
      minLength: 1
      type: string
    ArtifactAccess:
      additionalProperties: false
      properties:
        artifact_uri:
          $ref: '#/components/schemas/ArtifactUri'
        content_digest:
          $ref: '#/components/schemas/Digest'
        created_at:
          format: date-time
          type: string
        download_url:
          format: uri
          maxLength: 2048
          minLength: 1
          type: string
        expires_at:
          format: date-time
          type: string
        media_type:
          maxLength: 200
          minLength: 1
          type: string
        size_bytes:
          maximum: 26214400
          minimum: 1
          type: integer
      required:
      - artifact_uri
      - content_digest
      - media_type
      - size_bytes
      - created_at
      - download_url
      - expires_at
      type: object
    Digest:
      pattern: ^sha256:[a-f0-9]{64}$
      type: string
    IdempotencyKey:
      maxLength: 128
      minLength: 16
      pattern: ^[^\s\x00-\x1F\x7F](?:[^\x00-\x1F\x7F]*[^\s\x00-\x1F\x7F])?$
      type: string
    Identifier:
      maxLength: 128
      minLength: 1
      pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]*$
      type: string
    ArtifactUploadResult:
      additionalProperties: false
      properties:
        artifact:
          $ref: '#/components/schemas/ArtifactEvidence'
        status:
          const: stored
      required:
      - status
      - artifact
      type: object
    ErrorResult:
      additionalProperties: false
      properties:
        code:
          enum:
          - invalid_request
          - not_found
          - conflict
          - payment_required
          - unavailable
          - upstream_error
          - gone
          - rate_limited
          - attachment_blocked
          type: string
        inspect_url:
          description: Recovery status URL when payment settled but delivery failed.
          type: string
        invocation_id:
          $ref: '#/components/schemas/Identifier'
        message:
          maxLength: 512
          minLength: 1
          type: string
        status:
          const: error
      required:
      - status
      - code
      - message
      type: object
    ArtifactEvidence:
      additionalProperties: false
      properties:
        artifact_uri:
          $ref: '#/components/schemas/ArtifactUri'
        content_digest:
          $ref: '#/components/schemas/Digest'
        created_at:
          format: date-time
          type: string
        media_type:
          maxLength: 200
          minLength: 1
          type: string
        size_bytes:
          maximum: 26214400
          minimum: 1
          type: integer
      required:
      - artifact_uri
      - content_digest
      - media_type
      - size_bytes
      - created_at
      type: object
    ArtifactUploadRequest:
      additionalProperties: false
      properties:
        content_digest:
          $ref: '#/components/schemas/Digest'
        data_base64:
          description: Standard-base64 encoded artifact bytes. The decoded artifact limit is derived from the active document and media offers and is currently 10 MiB.
          maxLength: 34952536
          minLength: 4
          pattern: ^[A-Za-z0-9+/]*={0,2}$
          type: string
        idempotency_key:
          description: Stable retry identity. Reusing it with different bytes or metadata is a conflict.
          maxLength: 128
          minLength: 16
          type: string
        media_type:
          description: IANA media type for the bytes, without transport content-encoding.
          maxLength: 200
          minLength: 1
          type: string
      required:
      - data_base64
      - content_digest
      - media_type
      - idempotency_key
      type: object
  parameters:
    ArtifactUri:
      in: path
      name: artifact_uri
      required: true
      schema:
        $ref: '#/components/schemas/ArtifactUri'
    IdempotencyKey:
      description: Stable retry identity for a ticket-minting operation.
      in: header
      name: Idempotency-Key
      required: true
      schema:
        $ref: '#/components/schemas/IdempotencyKey'
  responses:
    ErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResult'
      description: Transport or infrastructure failure
  securitySchemes:
    LeaseCapability:
      bearerFormat: opaque
      description: Opaque expiry-bound authority for one Ausca resource lease. Never place it in JSON, query parameters, MCP tool arguments, logs, or receipts.
      scheme: bearer
      type: http
x-ausca-mcp-server:
  description: 'Agent infrastructure on demand: discover and control metered, keyless services with explicit pricing, bounded payment authority, and receipt-backed results.'
  icon:
    mimeType: image/svg+xml
    size: any
    src: https://ausca.com/favicon.svg
  instructions: 'Use search and get to resolve an immutable offer before acting. Paid tools take x402 v2 payment only in params._meta["x402/payment"], never in tool arguments: a call without it moves no money and returns the PaymentRequired as an isError result''s structuredContent; retry the same arguments with the signed PaymentPayload and read settlement evidence from result._meta["x402/payment-response"]. For an offer without a listed paid tool, follow the selected service SKILL.md and use its canonical HTTP invocation resource. Browser and inbox lifecycle tools take their lease bearer from the MCP HTTP request Authorization header, never from tool arguments.'
  name: ausca
  registry:
    description: Pay-per-call APIs and MCP services for agents, no accounts or keys, with verifiable receipts.
    name: com.ausca/agent-services
    package:
      argument: mcp
      identifier: ausca
      registryType: npm
      runtimeHint: npx
      version: 0.1.0
    version: 1.2.6
  title: Ausca