Fluid Recall Accounts API

openapi: 3.2.0
info:
  title: Fluid Recall Accounts API
  version: 0.0.0
  description: 'System of record for spaced recall. One service with four doors: MCP at POST /mcp (also /api/mcp), Markdown /api/v1/agent and /api/v1/dev, and JSON /api/v1. Agents may use whatever works best. None is deprecated. JSON operations sit at the /api/v1 root (/due, /decks, /reviews). Request bodies are JSON. Markdown responses use Content-Type text/plain; the body is Markdown. MCP is stateless Streamable HTTP. Send Authorization: Bearer . No Mcp-Session-Id. The same MCP door speaks the ChatGPT MCP Events subset (events/list, events/subscribe, events/unsubscribe) with webhook-only delivery. Muse bootstraps a personal API token with POST /accounts or POST /bootstrap and keeps drilling. The bearer token is the tenant. This API decides what is due and when it is due next. Bootstrap, reviews, and unauthenticated reads are rate limited. HTTP 429 is retryable. ---'
servers:
- url: /api/v1
security:
- bearerAuth: []
- poppyDpop: []
tags:
- name: Accounts
paths:
  /accounts:
    post:
      operationId: createAccount
      summary: Create an account and mint a token
      description: Write. No Authorization header. Muse calls this when the person has no Fluid Recall token yet, then keeps drilling. Creates an anonymous account and returns a personal API token. Do not send a userId on later drill calls. This call is rate limited per IP. HTTP 429 is retryable. Save this token for Fluid Recall API calls. Keep it in Secure Credentials when that is available.
      x-muse-action-class: write
      security: []
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                label:
                  type:
                  - string
                  - 'null'
                  maxLength: 80
      responses:
        '201':
          description: Account id, personal token, and a short save note.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                required:
                - userId
                - tokenId
                - token
                - note
                properties:
                  userId:
                    type: string
                    format: uuid
                  tokenId:
                    type: string
                    format: uuid
                  token:
                    type: string
                  note:
                    type: string
                    const: Save this token for Fluid Recall API calls. Keep it in Secure Credentials when that is available.
        '400':
          description: Invalid body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited. Retry after Retry-After.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Accounts
components:
  schemas:
    Error:
      type: object
      additionalProperties: false
      required:
      - code
      - message
      - retryable
      properties:
        code:
          type: string
          enum:
          - BAD_REQUEST
          - UNAUTHORIZED
          - FORBIDDEN
          - NOT_FOUND
          - CONFLICT
          - UNAVAILABLE
          - RATE_LIMITED
        message:
          type: string
        retryable:
          type: boolean
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Personal Fluid Recall API token from POST /accounts (or POST /bootstrap). Save it for API calls. The operator break-glass secret is a different credential and cannot call drill operations.
    poppyDpop:
      type: http
      scheme: DPoP
      description: 'Personal Agent Protocol (Poppy v0.1) Session Token from POST https://fluidrecall.com/oauth/token, sent as Authorization: DPoP <token> with a DPoP proof header on every call. poppy:read allows reads and poppy:write allows changes; personal API token management is not available. See https://fluidrecall.com/.well-known/poppy.json and https://fluidrecall.com/docs/personal-agent-protocol.'