Authorization request submission and management
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/cqnce-app:cqnce-app-requests-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: cQnce Requests API
description: 'Authorization-request routing and agent-management API for the cQnce platform.
## Authentication
| Scheme | Header | Used by |
|---|---|---|
| Bearer JWT (tenant) | `Authorization: Bearer ` | Dashboard / admin routes |
| Bearer JWT (agent) | `Authorization: Bearer ` | Agent mobile app routes |
| API Key | `x-api-key: ` | Server-to-server request submission |'
version: 1.0.0
contact:
name: cQnce Support
servers:
- url: https://api.cqnce.app
description: Production
tags:
- name: Requests
description: Authorization request submission and management
paths:
/v1/requests:
post:
tags:
- Requests
summary: Submit authorization request
description: Submit a new authorization request for routing to configured agents. Authenticated with a **project API key**.
operationId: submitRequest
security:
- projectApiKey: []
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- payload
properties:
payload:
type: object
description: Arbitrary payload
example:
action: payment
amount: 500
metadata:
type: object
description: Optional metadata context
attachments:
type: array
description: Optional list of file attachments (images or documents)
items:
type: object
required:
- name
properties:
name:
type: string
description: Display name of the attachment
mimeType:
type: string
example: image/jpeg
url:
type: string
format: uri
description: Public URL to the file (mutually exclusive with data)
data:
type: string
description: Base64-encoded file content (mutually exclusive with url)
callbackUrl:
type: string
format: uri
description: URL to POST the result to when resolved
wsClientId:
type: string
description: WebSocket client ID to notify via WS when resolved
routingMode:
type: string
enum:
- PARALLEL
- SERIAL
- MAJORITY
- CHAIN
description: Override the routing rule's mode
responses:
'202':
description: Request accepted
content:
application/json:
schema:
type: object
properties:
requestId:
type: string
format: uuid
status:
type: string
enum:
- PENDING
- APPROVED
- REJECTED
- NO_MATCH
'400':
description: Validation error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Invalid or missing API key
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'422':
description: No routing rule configured or no agents available
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
get:
tags:
- Requests
summary: List requests
description: Returns authorization requests for the authenticated tenant.
operationId: listRequests
security:
- tenantJWT: []
parameters:
- name: projectId
in: query
schema:
type: string
format: uuid
description: Filter by project
- name: status
in: query
schema:
type: string
enum:
- PENDING
- APPROVED
- REJECTED
- EXPIRED
- CANCELLED
- name: limit
in: query
schema:
type: integer
default: 20
maximum: 100
- name: offset
in: query
schema:
type: integer
default: 0
responses:
'200':
description: Paginated list of requests
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/PaginationMeta'
- type: object
properties:
requests:
type: array
items:
$ref: '#/components/schemas/AuthRequest'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/v1/requests/{id}:
get:
tags:
- Requests
summary: Get request details
description: Returns a single request including all agent responses and audit log entries. Accepts either a tenant JWT or a project API key.
operationId: getRequest
security:
- tenantJWT: []
- projectApiKey: []
parameters:
- name: id
in: path
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request details with responses and logs
content:
application/json:
schema:
type: object
properties:
request:
allOf:
- $ref: '#/components/schemas/AuthRequest'
- type: object
properties:
responses:
type: array
items:
$ref: '#/components/schemas/AgentResponse'
logs:
type: array
items:
$ref: '#/components/schemas/RequestLog'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Request not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/v1/requests/{requestId}/responses/{responseId}/verify-signature:
get:
tags:
- Requests
summary: Verify agent response signature
description: Verifies the ECDSA P-256 cryptographic signature stored on an agent response against the public key of the device that submitted it. Returns whether the response was signed and, if so, whether the signature is cryptographically valid. Also reports whether biometric/strong authentication was claimed by the agent. Admin-only endpoint (JWT auth).
operationId: verifyResponseSignature
security:
- tenantJWT: []
parameters:
- name: requestId
in: path
required: true
schema:
type: string
format: uuid
description: Auth request ID
- name: responseId
in: path
required: true
schema:
type: string
format: uuid
description: Agent response ID
responses:
'200':
description: Signature verification result
content:
application/json:
schema:
type: object
required:
- signed
properties:
signed:
type: boolean
description: Whether the response carries a cryptographic signature
message:
type: string
description: Human-readable message when the response is not signed
valid:
type: boolean
description: Whether the signature is cryptographically valid (only present when signed=true)
details:
type: object
description: Verification details (only present when signed=true)
properties:
responseId:
type: string
format: uuid
agentId:
type: string
format: uuid
agentName:
type: string
deviceId:
type: string
format: uuid
decision:
type: string
enum:
- APPROVED
- REJECTED
signedPayload:
type: string
description: 'The plaintext payload that was signed: "requestId:decision[:reason]"'
strongAuthEnabled:
type: boolean
description: Whether the signing device has strong/biometric authentication enabled
strongAuthUsed:
type: boolean
description: Whether the agent confirmed biometric/strong authentication before submitting this response
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Response not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/v1/requests/stats:
get:
tags:
- Requests
summary: Get request statistics
description: Returns time-series and aggregate request statistics. Optionally filter by project, agent, routing rule, or date range.
operationId: getRequestStats
security:
- tenantJWT: []
parameters:
- name: projectId
in: query
schema:
type: string
format: uuid
description: Filter to a specific project
- name: agentId
in: query
schema:
type: string
format: uuid
description: Filter to a specific agent
- name: routingRuleId
in: query
schema:
type: string
format: uuid
description: Filter to a specific routing rule
- name: dateFrom
in: query
schema:
type: string
format: date-time
- name: dateTo
in: query
schema:
type: string
format: date-time
- name: groupBy
in: query
schema:
type: string
enum:
- day
- week
- month
description: Granularity of the time series
responses:
'200':
description: Request statistics
content:
application/json:
schema:
type: object
properties:
series:
type: array
items:
type: object
properties:
date:
type: string
format: date
approved:
type: integer
rejected:
type: integer
expired:
type: integer
cancelled:
type: integer
totals:
type: object
properties:
total:
type: integer
approved:
type: integer
rejected:
type: integer
expired:
type: integer
cancelled:
type: integer
pending:
type: integer
dateFrom:
type: string
format: date-time
dateTo:
type: string
format: date-time
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/v1/requests/monitor:
get:
tags:
- Requests
summary: Monitor pending requests
description: Returns up to 50 pending authorization requests with enriched routing and agent data. Useful for live monitoring dashboards.
operationId: monitorRequests
security:
- tenantJWT: []
responses:
'200':
description: Pending requests for monitoring
content:
application/json:
schema:
type: object
properties:
requests:
type: array
items:
$ref: '#/components/schemas/AuthRequest'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/v1/requests/{id}/status:
get:
tags:
- Requests
summary: Get request status
description: Returns the lightweight status of an authorization request. Accessible with tenant JWT or project API key.
operationId: getRequestStatus
security:
- tenantJWT: []
- projectApiKey: []
parameters:
- name: id
in: path
required: true
schema:
type: string
format: uuid
description: Request ID
responses:
'200':
description: Request status
content:
application/json:
schema:
type: object
properties:
requestId:
type: string
format: uuid
status:
type: string
enum:
- PENDING
- APPROVED
- REJECTED
- EXPIRED
- CANCELLED
routingMode:
type:
- string
- 'null'
createdAt:
type: string
format: date-time
resolvedAt:
type:
- string
- 'null'
format: date-time
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Request not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/v1/requests/{id}/attachments/{index}:
get:
tags:
- Requests
summary: Get request attachment
description: Redirects to a signed attachment URL or streams a base64-encoded payload.
operationId: getRequestAttachment
security:
- tenantJWT: []
parameters:
- name: id
in: path
required: true
schema:
type: string
format: uuid
description: Request ID
- name: index
in: path
required: true
schema:
type: integer
minimum: 0
description: Attachment index
responses:
'200':
description: Attachment content (base64 for inline attachments)
'302':
description: Redirect to signed attachment URL
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Request or attachment not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/v1/requests/{id}/cancel:
post:
tags:
- Requests
summary: Cancel request
description: Cancels a pending authorization request. Accessible with tenant JWT, project API key, or client credentials.
operationId: cancelRequest
security:
- tenantJWT: []
- projectApiKey: []
parameters:
- name: id
in: path
required: true
schema:
type: string
format: uuid
description: Request ID
responses:
'200':
description: Request cancelled
content:
application/json:
schema:
type: object
properties:
status:
type: string
example: CANCELLED
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Request not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'409':
description: Request is not in PENDING state
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
components:
schemas:
AuthRequest:
type: object
properties:
id:
type: string
format: uuid
projectId:
type: string
format: uuid
payload:
type: object
description: Arbitrary payload submitted with the request
metadata:
type:
- object
- 'null'
attachments:
type:
- array
- 'null'
description: Optional list of attachments (images or documents) sent with the request
items:
type: object
required:
- name
properties:
name:
type: string
description: Display name of the attachment
mimeType:
type: string
example: image/jpeg
description: MIME type of the attachment content
url:
type: string
format: uri
description: Public URL to the attachment (mutually exclusive with data)
data:
type: string
description: Base64-encoded attachment content (mutually exclusive with url)
status:
type: string
enum:
- PENDING
- APPROVED
- REJECTED
- EXPIRED
- CANCELLED
routingMode:
type: string
enum:
- PARALLEL
- SERIAL
- MAJORITY
- CHAIN
rejectReasonRequired:
type: boolean
rejectReasonOptions:
type: array
items:
type: string
defaultRejectReason:
type:
- string
- 'null'
callbackUrl:
type:
- string
- 'null'
format: uri
wsClientId:
type:
- string
- 'null'
createdAt:
type: string
format: date-time
resolvedAt:
type:
- string
- 'null'
format: date-time
Error:
type: object
properties:
error:
type: string
example: Validation failed
details:
type: array
items:
type: object
AgentResponse:
type: object
properties:
id:
type: string
format: uuid
requestId:
type: string
format: uuid
agentId:
type: string
format: uuid
agent:
type:
- object
- 'null'
properties:
id:
type: string
format: uuid
name:
type: string
decision:
type: string
enum:
- APPROVED
- REJECTED
reason:
type:
- string
- 'null'
respondedAt:
type: string
format: date-time
deviceId:
type:
- string
- 'null'
format: uuid
description: Device that signed this response (null for legacy unsigned responses)
signature:
type:
- string
- 'null'
description: Base64-encoded ECDSA P-256 signature over "requestId:decision[:reason]"
strongAuthUsed:
type: boolean
description: Whether the agent confirmed biometric/strong authentication before submitting this response
PaginationMeta:
type: object
properties:
total:
type: integer
limit:
type: integer
offset:
type: integer
RequestLog:
type: object
properties:
id:
type: string
format: uuid
requestId:
type: string
format: uuid
event:
type: string
details:
type:
- object
- 'null'
timestamp:
type: string
format: date-time
securitySchemes:
tenantJWT:
type: http
scheme: bearer
bearerFormat: JWT
description: JWT issued on tenant login (`POST /v1/auth/login`)
agentJWT:
type: http
scheme: bearer
bearerFormat: JWT
description: JWT issued on agent login/register (`POST /v1/auth/agent/login` or `/register`)
projectApiKey:
type: apiKey
in: header
name: x-api-key
description: Per-project API key used for server-to-server request submission