Jentic Discovery API

openapi: 3.2.0
info:
  contact:
    email: support@jentic.com
    name: Jentic Platform Team
    url: https://jentic.com/
  description: '## Overview ##

    The **Jentic Control Plane API** is the unified HTTP surface of the

    Jentic platform''s control plane — every administrative and

    metadata-facing endpoint outside the Broker data plane. The control plane is the administrative counterpart to the

    Broker data plane: where the Broker executes

    upstream API calls on behalf of agents, the control plane is where

    humans, operators, and agents configure *what* the Broker is

    allowed to do, *for whom*, *with which credentials*, *against

    which registered APIs*, and *with what telemetry retained*. ## Components ##

    High-level components for the control plane API. - **Core / Access** — credentials, toolkits,

    and PBAC grants and runtime params. Owns *who can call what, with which secret*. - **Registry** — registered APIs, immutable

    revisions, operations, search, lookup. Owns *what APIs are

    registered for this deployment and what they look like at any

    given revision*. - **Admin / Audit** — users, permissions,

    execution telemetry, async-job tracker, and dashboard event

    stream. Owns *who can sign in with what permissions* together

    with *what actually happened* — the human roster, the

    append-only records of brokered executions, the unified

    `Job` resource that both Registry imports and Broker

    async-execution calls feed into, and a curated `/events`

    surface for dashboards and operators. ## Authentication ##


    Today the platform ships a local username + password identity

    provider for human users, alongside agent identity (Dynamic Client

    Registration + RFC 7523 JWT-bearer assertions) and service-account

    client credentials — every authenticated operation expects

    `Authorization: Bearer ` (`BearerAuth`, an opaque `at_`

    token) except `GET /health`, `POST /auth/login`,

    `POST /users:create-admin`, and `POST /users:redeem-invite`. Human tokens are issued by `POST /auth/login` with a fixed 1-hour

    TTL and can be re-minted before expiry via `POST /auth/refresh`

    (sliding session, bounded by an absolute window —

    `admin.auth.session_ttl_seconds`, 12 hours by default); agents and

    service accounts obtain tokens from `POST /oauth/token` (see

    `BearerAuth`). The `permissions` claim on a token is a snapshot at

    issue time; permission changes take effect at the next re-issue —

    the next refresh or re-login (≤ 1 hour with the default TTL). The platform ships **no default credentials**. On a fresh

    install the users table is empty, so `GET /health` returns

    `setup_required: true` with `next_step: create_admin`. The

    operator creates the first administrator with `POST

    /users:create-admin {email, password}` — a one-time,

    unauthenticated, self-closing endpoint: it succeeds only while

    the users table is empty and returns `410 setup_already_complete`

    once any user exists (a single-row setup sentinel is the

    concurrency backstop, so two racing callers — even with different

    emails — cannot both bootstrap). It grants `org:admin`, sets the operator''s chosen

    password (so `must_change_password` is **false** — no forced

    rotation), and returns a ready-to-use `LoginResponse`

    (auto-login). After the first user exists `setup_required` flips

    to `false`. See the **Users** tag for the full onboarding

    walkthrough. External SSO providers (Okta, AWS Cognito, Auth0, Azure AD)

    plug in via the `User.auth_provider: external` hook plus an

    `external_subject_id` mapping; no concrete provider ships in

    this revision. Agent identity (separate from human users) uses

    Dynamic Client Registration (`POST /register`) with the agent''s

    JWKS, then RFC 7523 JWT-bearer assertions exchanged at

    `POST /oauth/token` for an opaque access token. ## Cross-cutting conventions


    - Every API reference uses the loose

    `APIReference(vendor, name, version)` data structure. There is no

    foreign key between Core, Registry, and Admin / Audit — the

    tuple is the only join. - **Error shape.** Every error response is RFC 9457 Problem

    Details (`application/problem+json`) using the shared

    `ProblemDetails` schema from

    jentic/api-problem-details.'
  license:
    identifier: Apache-2.0
    name: Apache-2.0
  summary: HTTP surface of the Jentic platform's control plane — Core / Access (credentials, toolkits), Registry (registered APIs, operations, search), and Admin / Audit (execution telemetry, async jobs).
  title: Jentic Control Plane Discovery API
  version: 0.39.0
servers:
- description: Same-origin (relative)
  url: /
security:
- BearerAuth: []
tags:
- description: Unauthenticated metadata discovery — the JWKS document and OAuth authorization server metadata under `/.well-known/*`.
  name: Discovery
paths:
  /.well-known/jwks.json:
    get:
      description: Return the JWKS document with the active public signing keys (ES256).
      operationId: jwks
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: true
                title: Response Jwks
                type: object
          description: Successful Response
        '400':
          content:
            application/problem+json:
              example:
                detail: The request was malformed or failed a precondition.
                instance: /example/path
                status: 400
                title: Bad Request
                type: bad_request
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Bad Request
        '422':
          content:
            application/problem+json:
              example:
                detail: Request validation failed; see errors[] for details.
                errors:
                - detail: Field 'name' must not be blank.
                  pointer: '#/name'
                instance: /example/path
                status: 422
                title: Unprocessable Entity
                type: validation_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              example:
                detail: An unexpected error occurred.
                instance: /example/path
                status: 500
                title: Internal Server Error
                type: server_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              example:
                detail: The database is temporarily unavailable; please retry.
                instance: /example/path
                status: 503
                title: Service Unavailable
                type: database_unavailable
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Service Unavailable
      security: []
      summary: JSON Web Key Set
      tags:
      - Discovery
  /.well-known/oauth-authorization-server:
    get:
      description: Return RFC 8414 authorization-server metadata (endpoints, grant types, algorithms).
      operationId: oauthAuthorizationServer
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: true
                title: Response Oauthauthorizationserver
                type: object
          description: Successful Response
        '400':
          content:
            application/problem+json:
              example:
                detail: The request was malformed or failed a precondition.
                instance: /example/path
                status: 400
                title: Bad Request
                type: bad_request
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Bad Request
        '422':
          content:
            application/problem+json:
              example:
                detail: Request validation failed; see errors[] for details.
                errors:
                - detail: Field 'name' must not be blank.
                  pointer: '#/name'
                instance: /example/path
                status: 422
                title: Unprocessable Entity
                type: validation_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              example:
                detail: An unexpected error occurred.
                instance: /example/path
                status: 500
                title: Internal Server Error
                type: server_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              example:
                detail: The database is temporarily unavailable; please retry.
                instance: /example/path
                status: 503
                title: Service Unavailable
                type: database_unavailable
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Service Unavailable
      security: []
      summary: OAuth authorization server metadata
      tags:
      - Discovery
  /.well-known/oauth-authorization-server/mcp:
    get:
      description: 'RFC 8414 metadata for the path-scoped issuer `{base}/mcp`.


        RFC 8414 §3.1 path insertion: this is the metadata URL clients derive for

        the issuer `{base}/mcp` named by the protected-resource document. It

        advertises the anonymous OAuth-client registration door (`/oauth-clients`)

        and the public-client profile (`none` + PKCE S256) — the root document is a

        separate, unchanged surface whose `registration_endpoint` remains the agent

        `/register`.'
      operationId: mcpOauthAuthorizationServer
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: true
                title: Response Mcpoauthauthorizationserver
                type: object
          description: Successful Response
        '400':
          content:
            application/problem+json:
              example:
                detail: The request was malformed or failed a precondition.
                instance: /example/path
                status: 400
                title: Bad Request
                type: bad_request
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Bad Request
        '404':
          description: 'Interactive OAuth for MCP is disabled (`server.mcp.oauth.enabled=false`): the route answers the framework''s plain route-not-found 404, so the gate state is unobservable.'
        '422':
          content:
            application/problem+json:
              example:
                detail: Request validation failed; see errors[] for details.
                errors:
                - detail: Field 'name' must not be blank.
                  pointer: '#/name'
                instance: /example/path
                status: 422
                title: Unprocessable Entity
                type: validation_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              example:
                detail: An unexpected error occurred.
                instance: /example/path
                status: 500
                title: Internal Server Error
                type: server_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              example:
                detail: The database is temporarily unavailable; please retry.
                instance: /example/path
                status: 503
                title: Service Unavailable
                type: database_unavailable
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Service Unavailable
      security: []
      summary: OAuth authorization server metadata for the MCP resource
      tags:
      - Discovery
  /.well-known/oauth-protected-resource:
    get:
      description: 'Root-path alias of the MCP protected-resource document.


        Compatibility fallback for clients that probe the root

        `/.well-known/oauth-protected-resource` instead of following the 401''s

        `resource_metadata` pointer (the documented Claude Code behaviour). Safe

        because this deployment has exactly one OAuth-protected resource, so the

        root and path-scoped documents are the same body.


        Two acknowledged trades:


        - RFC 9728 §3 says this well-known path corresponds to resource identifier

        ``{base}`` (no path), and §3.3 has clients validate ``resource`` against

        the resource they queried. This body claims ``resource={base}/mcp`` — a

        strict path-deriving validator would reject it, but Claude''s fallback

        validates against the MCP server URL (``{base}/mcp``), which is exactly

        what the alias exists to satisfy. That is the intended trade.

        - The alias squats the deployment''s only root PRM slot: a future non-MCP

        protected resource at ``{base}`` cannot get its own root document

        without breaking this fallback. The mounted MCP app must re-confirm the

        "exactly one OAuth-protected resource" premise before adding one.'
      operationId: mcpOauthProtectedResourceRootAlias
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: true
                title: Response Mcpoauthprotectedresourcerootalias
                type: object
          description: Successful Response
        '400':
          content:
            application/problem+json:
              example:
                detail: The request was malformed or failed a precondition.
                instance: /example/path
                status: 400
                title: Bad Request
                type: bad_request
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Bad Request
        '404':
          description: 'Interactive OAuth for MCP is disabled (`server.mcp.oauth.enabled=false`): the route answers the framework''s plain route-not-found 404, so the gate state is unobservable.'
        '422':
          content:
            application/problem+json:
              example:
                detail: Request validation failed; see errors[] for details.
                errors:
                - detail: Field 'name' must not be blank.
                  pointer: '#/name'
                instance: /example/path
                status: 422
                title: Unprocessable Entity
                type: validation_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              example:
                detail: An unexpected error occurred.
                instance: /example/path
                status: 500
                title: Internal Server Error
                type: server_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              example:
                detail: The database is temporarily unavailable; please retry.
                instance: /example/path
                status: 503
                title: Service Unavailable
                type: database_unavailable
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Service Unavailable
      security: []
      summary: OAuth protected resource metadata (root alias for the MCP resource)
      tags:
      - Discovery
  /.well-known/oauth-protected-resource/mcp:
    get:
      description: 'RFC 9728 protected-resource metadata for `{base}/mcp`.


        Names the /mcp-scoped authorization server and the MCP tool scopes. The

        same body is also served at the root well-known path for clients that

        ignore the 401''s `resource_metadata` pointer.'
      operationId: mcpOauthProtectedResource
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: true
                title: Response Mcpoauthprotectedresource
                type: object
          description: Successful Response
        '400':
          content:
            application/problem+json:
              example:
                detail: The request was malformed or failed a precondition.
                instance: /example/path
                status: 400
                title: Bad Request
                type: bad_request
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Bad Request
        '404':
          description: 'Interactive OAuth for MCP is disabled (`server.mcp.oauth.enabled=false`): the route answers the framework''s plain route-not-found 404, so the gate state is unobservable.'
        '422':
          content:
            application/problem+json:
              example:
                detail: Request validation failed; see errors[] for details.
                errors:
                - detail: Field 'name' must not be blank.
                  pointer: '#/name'
                instance: /example/path
                status: 422
                title: Unprocessable Entity
                type: validation_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              example:
                detail: An unexpected error occurred.
                instance: /example/path
                status: 500
                title: Internal Server Error
                type: server_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              example:
                detail: The database is temporarily unavailable; please retry.
                instance: /example/path
                status: 503
                title: Service Unavailable
                type: database_unavailable
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Service Unavailable
      security: []
      summary: OAuth protected resource metadata for the MCP resource
      tags:
      - Discovery
  /auth/idp:
    get:
      description: 'Public capability hint: whether IdP login is enabled, and which provider.


        The SPA reads this before login to decide whether to show a "Continue with

        " button. Unauthenticated and secret-free — it advertises only the

        enabled flag and the provider name (never client secrets or endpoints).'
      operationId: authIdpDescriptor
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: true
                title: Response Authidpdescriptor
                type: object
          description: Successful Response
        '400':
          content:
            application/problem+json:
              example:
                detail: The request was malformed or failed a precondition.
                instance: /example/path
                status: 400
                title: Bad Request
                type: bad_request
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Bad Request
        '422':
          content:
            application/problem+json:
              example:
                detail: Request validation failed; see errors[] for details.
                errors:
                - detail: Field 'name' must not be blank.
                  pointer: '#/name'
                instance: /example/path
                status: 422
                title: Unprocessable Entity
                type: validation_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              example:
                detail: An unexpected error occurred.
                instance: /example/path
                status: 500
                title: Internal Server Error
                type: server_error
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              example:
                detail: The database is temporarily unavailable; please retry.
                instance: /example/path
                status: 503
                title: Service Unavailable
                type: database_unavailable
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Service Unavailable
      security: []
      summary: External IdP login descriptor
      tags:
      - Discovery
components:
  schemas:
    ProblemDetail:
      description: 'RFC 9457 Problem Details for HTTP APIs.


        This is the standard error response format for all Jentic APIs.

        Content-Type: application/problem+json


        See: https://www.rfc-editor.org/rfc/rfc9457.html'
      examples:
      - detail: The request body is missing one or more required fields.
        errors:
        - detail: Field 'name' is required.
          pointer: '#/name'
        instance: /v2/capability-sets
        status: 400
        title: Bad Request
        type: about:blank
      properties:
        code:
          anyOf:
          - maxLength: 50
            type: string
          - type: 'null'
          description: An optional provider-specific code for internal error taxonomy and observability correlation.
          examples:
          - JENTIC-4001
          title: Code
        detail:
          description: A human-readable explanation specific to this occurrence of the problem. MUST be present. Provide actionable information where possible.
          examples:
          - The request body is missing required field 'name'.
          maxLength: 4096
          title: Detail
          type: string
        errors:
          anyOf:
          - items:
              $ref: '#/components/schemas/ErrorItem'
            maxItems: 1000
            type: array
          - type: 'null'
          description: An array of granular error details. Use when multiple validation errors or field-level problems need to be surfaced in a single response.
          title: Errors
        instance:
          anyOf:
          - maxLength: 1024
            type: string
          - type: 'null'
          description: A URI reference identifying the specific occurrence of the problem. Typically the request path.
          examples:
          - /v2/capability-sets
          title: Instance
        status:
          anyOf:
          - maximum: 599.0
            minimum: 100.0
            type: integer
          - type: 'null'
          description: The HTTP status code for this occurrence of the problem.
          examples:
          - 400
          title: Status
        title:
          anyOf:
          - maxLength: 1024
            type: string
          - type: 'null'
          description: A short, human-readable summary of the problem type. Should not change between occurrences except for localisation purposes.
          examples:
          - Bad Request
          title: Title
        type:
          default: about:blank
          description: A URI reference identifying the problem type. When set to 'about:blank', the title SHOULD be the standard HTTP status phrase. Use an IANA-registered type URI where one applies.
          examples:
          - about:blank
          maxLength: 1024
          title: Type
          type: string
      required:
      - detail
      title: ProblemDetail
      type: object
    ErrorItem:
      description: 'A granular error detail entry within the errors[] array of a ProblemDetails response.


        At least one of pointer, parameter, or header SHOULD be present to identify the error source.'
      properties:
        code:
          anyOf:
          - maxLength: 50
            type: string
          - type: 'null'
          description: An optional provider-specific code identifying this error in internal taxonomy or documentation.
          examples:
          - JENTIC-V-001
          title: Code
        detail:
          description: A human-readable explanation of this specific error. Be precise — name the field, parameter, or header involved.
          examples:
          - Field 'name' must not be blank.
          maxLength: 4096
          title: Detail
          type: string
        header:
          anyOf:
          - maxLength: 1024
            type: string
          - type: 'null'
          description: The name of the request header that is the source of this error.
          examples:
          - Authorization
          title: Header
        parameter:
          anyOf:
          - maxLength: 1024
            type: string
          - type: 'null'
          description: The name of the query or path parameter that is the source of this error.
          examples:
          - limit
          title: Parameter
        pointer:
          anyOf:
          - maxLength: 1024
            type: string
          - type: 'null'
          description: A JSON Pointer (RFC 6901) to the specific request body property that is the source of this error.
          examples:
          - '#/name'
          title: Pointer
      required:
      - detail
      title: ErrorItem
      type: object
  securitySchemes:
    BearerAuth:
      description: 'Opaque bearer access token (prefixed `at_`), sent as `Authorization: Bearer <token>`. It is **not** a JWT — it is a random string validated server-side by lookup, so it cannot be decoded by the client.


        Obtain one from `POST /oauth/token` using the grant for your actor type:

        - **Agents** — `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` with a JWT assertion signed by the key registered via `POST /register` (the JWT is the *assertion*, not the resulting access token).

        - **Service accounts** — `grant_type=client_credentials` with `client_id` + `client_secret`.

        - **Users** — `grant_type=authorization_code` (interactive) or `grant_type=password`; refresh either with `grant_type=refresh_token`.


        Service accounts can also mint short-lived, scope-narrowed task tokens for agents via `POST /oauth/mint`.


        Per-endpoint scope and actor-type requirements are not modelled in this document (OpenAPI cannot faithfully express the OR-of-scopes / `org:admin` bypass / service-layer enforcement); see `GET /reference/endpoints.json` for the authoritative authorization reference.'
      scheme: bearer
      type: http
x-tagGroups:
- name: Core / Access
  tags:
  - Credentials
  - Toolkits
  - Toolkit Keys
  - Toolkit Credentials
  - Toolkit Permissions
  - Access Requests
- name: Registry
  tags:
  - APIs
  - API Operations
  - API Spec
  - Catalog
  - Search
  - Inspect
  - Lookup
  - Notes
  - Overlays
- name: Admin / Audit
  tags:
  - Users
  - Actors
  - Permissions
  - Executions
  - Jobs
  - Events
  - Audit
  - Monitoring
  - Configuration
  - OAuth Clients
- name: Platform Actors
  tags:
  - Identity
  - Agents
  - Service Accounts
  - OAuth
  - Agent Registration
  - Discovery
- name: Operations
  tags:
  - System
  - MCP