linkbreakers-com Agent Identity API

openapi: 3.2.0
info:
  contact:
    name: Linkbreakers Support
    url: https://app.linkbreakers.com
  description: 'This is a documentation of all the APIs of Linkbreakers


    ## Entry points


    `GET https://api.linkbreakers.com/` and `GET https://api.linkbreakers.com/v1` answer without credentials with the API''s name, version and links. This document is served at `https://api.linkbreakers.com/openapi.json`.


    ## Rate limits


    Every response describes where the caller stands in the IETF `RateLimit-Policy` and `RateLimit` header fields (draft-ietf-httpapi-ratelimit-headers), and in `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` and `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` (a Unix timestamp) for clients that read those. A request past the limit gets `429 Too Many Requests` with `Retry-After` in seconds.


    - Workspace API token: 720 requests per 60 seconds, per token.

    - Dashboard session or OAuth token: 600 requests per 60 seconds, per token.

    - No credentials: 300 requests per 60 seconds, per client IP.


    Each plan also includes a number of API calls per billing cycle. Past it, calls answer `429` with the code `MAX_PUBLIC_API_QUERIED_REACHED` until the cycle renews or the plan changes.


    ## Pagination


    Every list pages with opaque cursors (AIP-158). Pass `pageSize`, then send the `nextPageToken` of each response back as `pageToken` (or its alias `cursor`) to get the next page. An empty or absent `nextPageToken` means the list is complete. Each list operation describes this in `x-pagination`.


    ## Batches and background jobs


    `POST /v1/links/bulk` creates up to 250 links in one transactional request; `POST /v1/links/batch` takes the same links as a bare JSON array. `POST /v1/links/bulk/jobs` accepts the same batch and answers `202 Accepted` at once with a job and a `Location` header; poll `GET /v1/jobs/{id}` until `status` is `JOB_STATUS_SUCCEEDED` (the created link ids are in `linksBulkCreate.linkIds`) or `JOB_STATUS_FAILED` (`error` says why, and nothing was created). Jobs can be read for 24 hours after they finish.


    ## Versioning and deprecation


    The version is in the path: every operation lives under `/v1`. Within a version, changes are additive only: new operations, new optional request fields, new response fields and new enum values. Clients should ignore fields and enum values they do not know. Anything that would break an existing client ships under a new path version instead.


    An operation is retired in two steps. First it is deprecated: it keeps working, is flagged `deprecated: true` in this document, and every response carries a `Deprecation` header field (RFC 9745) with the time it was deprecated and a `Link` with `rel="deprecation"` to the policy. Then, at least 180 days later, it may be removed; that date is announced in advance in a `Sunset` header field (RFC 8594) and as `x-sunset` on the operation. The full policy: https://linkbreakers.com/help/article/api-versioning-and-deprecation-policy


    ## Idempotent retries


    Every POST, PUT and PATCH accepts an optional `Idempotency-Key` header (draft-ietf-httpapi-idempotency-key-header). Send a new unique value, such as a UUID, with each logical request and reuse it only to retry that request. A retry with the same key and the same request returns the first response, marked `Idempotent-Replayed: true`, instead of running again. Keys are scoped to the token and kept for 24 hours. The same key with a different request is refused with `422`, and a retry while the first request is still running gets `409` with `Retry-After`. Server errors (5xx) and refusals such as 401, 403 and 429 are not stored, so retrying them runs the request again.'
  title: Linkbreakers Agent Identity API
  version: 1.185.0
  x-api-versioning:
    compatibility: additive changes only within a version
    currentVersion: v1
    deprecationHeaders:
    - Deprecation
    - Sunset
    - Link
    minimumNoticeDays: 180
    policy: https://linkbreakers.com/help/article/api-versioning-and-deprecation-policy
    strategy: url-path
servers:
- url: https://api.linkbreakers.com
security:
- bearerAuth: []
tags:
- description: Claiming a workspace an AI agent registered for itself. An agent registers at the authorization server (https://mcp.linkbreakers.com/agent/identity, see https://linkbreakers.com/auth.md) and hands a person a claim link and a 6-digit code; these endpoints are the person's side of that ceremony.
  name: Agent Identity
paths:
  /v1/agent-identity/claim/complete:
    post:
      description: Check the code from the claim email, attach the claim email with a password or a Google or Microsoft sign-in to the agent's workspace, and sign in. A person who already has an account signs in with its password and the workspace joins that account. The link and code reach the person only by email, so claiming also verifies the address. Afterwards the agent's token keeps working in the claimed workspace, and the agent can fetch a token with wider scopes from the claim grant.
      operationId: AgentIdentityService_ClaimAgentWorkspace
      parameters:
      - description: Makes retrying this request safe. See components.parameters.IdempotencyKey.
        in: header
        name: Idempotency-Key
        required: false
        schema:
          maxLength: 255
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClaimAgentWorkspaceRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
          description: Everything worked as expected.
          headers:
            Idempotent-Replayed:
              $ref: '#/components/headers/Idempotent-Replayed'
            RateLimit:
              $ref: '#/components/headers/RateLimit'
            RateLimit-Policy:
              $ref: '#/components/headers/RateLimit-Policy'
            RateLimit-Remaining:
              $ref: '#/components/headers/RateLimit-Remaining'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Unexpected error
          headers:
            RateLimit:
              $ref: '#/components/headers/RateLimit'
            RateLimit-Policy:
              $ref: '#/components/headers/RateLimit-Policy'
            RateLimit-Remaining:
              $ref: '#/components/headers/RateLimit-Remaining'
      security: []
      summary: Claim an agent's workspace
      tags:
      - Agent Identity
  /v1/agent-identity/claim/lookup:
    post:
      description: 'Return the email a claim link is bound to, whether it can still be used, and what the agent may do once the workspace is claimed. The claim_attempt_token is the secret: anyone holding it and the code can claim.'
      operationId: AgentIdentityService_GetAgentClaim
      parameters:
      - description: Makes retrying this request safe. See components.parameters.IdempotencyKey.
        in: header
        name: Idempotency-Key
        required: false
        schema:
          maxLength: 255
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetAgentClaimRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AgentClaim'
          description: Everything worked as expected.
          headers:
            Idempotent-Replayed:
              $ref: '#/components/headers/Idempotent-Replayed'
            RateLimit:
              $ref: '#/components/headers/RateLimit'
            RateLimit-Policy:
              $ref: '#/components/headers/RateLimit-Policy'
            RateLimit-Remaining:
              $ref: '#/components/headers/RateLimit-Remaining'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Unexpected error
          headers:
            RateLimit:
              $ref: '#/components/headers/RateLimit'
            RateLimit-Policy:
              $ref: '#/components/headers/RateLimit-Policy'
            RateLimit-Remaining:
              $ref: '#/components/headers/RateLimit-Remaining'
      security: []
      summary: Read an agent claim link
      tags:
      - Agent Identity
components:
  headers:
    X-RateLimit-Reset:
      description: Unix time, in seconds, at which the current window resets.
      schema:
        example: 1791650400
        type: integer
    RateLimit-Reset:
      description: Seconds until the current window resets.
      schema:
        example: 42
        type: integer
    RateLimit-Policy:
      description: 'The quota that applies to this caller, as a structured field: `"<name>";q=<requests>;w=<window seconds>` (draft-ietf-httpapi-ratelimit-headers).'
      schema:
        example: '"token";q=600;w=60'
        type: string
    RateLimit-Limit:
      description: Requests allowed in the current window.
      schema:
        example: 600
        type: integer
    Idempotent-Replayed:
      description: true when this response is the stored answer to an earlier request with the same Idempotency-Key.
      schema:
        type: boolean
    X-RateLimit-Limit:
      description: Same as RateLimit-Limit, for clients that read the X- convention.
      schema:
        example: 600
        type: integer
    RateLimit-Remaining:
      description: Requests left in the current window.
      schema:
        example: 598
        type: integer
    RateLimit:
      description: 'What is left of the quota: `"<name>";r=<remaining requests>;t=<seconds until the window resets>` (draft-ietf-httpapi-ratelimit-headers).'
      schema:
        example: '"token";r=598;t=42'
        type: string
    Retry-After:
      description: Seconds to wait before retrying a refused request.
      schema:
        example: 42
        type: integer
    X-RateLimit-Remaining:
      description: Same as RateLimit-Remaining, for clients that read the X- convention.
      schema:
        example: 598
        type: integer
  schemas:
    ErrorResponse:
      properties:
        code:
          description: HTTP status code
          format: int32
          type: integer
        codeType:
          default: UNKNOWN
          description: Custom error code type
          type: string
        details:
          description: Additional error details
          items:
            type: object
          type: array
        message:
          description: Error message
          type: string
      required:
      - code
      - codeType
      - message
      - details
      type: object
    GetAgentClaimRequest:
      properties:
        claimAttemptToken:
          title: The claim_attempt_token from the link the agent handed over
          type: string
      title: Request to read a claim link
      type: object
    AgentClaim:
      description: What a claim link would hand over.
      properties:
        email:
          description: The email the agent named for this claim. The workspace can only be claimed with it.
          type: string
        expiresAt:
          format: date-time
          title: When the code stops working
          type: string
        postClaimScopes:
          items:
            $ref: '#/components/schemas/ApiScope'
          title: What the agent may do once the workspace is claimed
          type: array
        registeredAt:
          format: date-time
          title: When the agent registered
          type: string
        status:
          $ref: '#/components/schemas/AgentClaimStatus'
          title: Where the link stands
      title: AgentClaim
      type: object
    Member:
      description: 'Describes a teammate invited into a workspace, including their role, login metadata, and last-known activity

        so Linkbreakers can enforce access policies and audit collaboration.'
      properties:
        accessRevokedAt:
          format: date-time
          title: When the member's access was revoked (null means active)
          type: string
        accessToken:
          example: lbw_1w8jp9longjwtvalue
          title: Access token issued during sign-in; returned to clients but not persisted on the member record
          type: string
        createdAt:
          format: date-time
          title: Timestamp when the member was created
          type: string
        displayLanguage:
          example: en-US
          title: Preferred language for emails and product copy (BCP-47)
          type: string
        email:
          example: sam.member@example.com
          title: Email address used as the member's login identifier
          type: string
        emailVerifiedAt:
          format: date-time
          title: When the member confirmed ownership of their email address (null means unverified)
          type: string
        firstName:
          example: Sam
          title: Member's given name used in UI surfaces and emails
          type: string
        id:
          example: 123e4567-e89b-12d3-a456-426614174000
          title: Unique identifier for the member record (UUID)
          type: string
        lastKnownCountry:
          example: US
          title: Country inferred from geolocation during the most recent sign-in (ISO 3166-1 alpha-2)
          type: string
        lastKnownIp:
          example: 203.0.113.42
          title: IP address seen on the most recent sign-in
          type: string
        lastKnownLanguage:
          example: en-US,en;q=0.9
          title: Browser language header captured during the most recent sign-in
          type: string
        lastKnownTimezone:
          example: Europe/London
          title: Timezone reported during the most recent sign-in (IANA TZ database)
          type: string
        lastName:
          example: Rivera
          title: Member's family name used in UI surfaces and emails
          type: string
        lastSigninAt:
          format: date-time
          title: Last time the member successfully authenticated
          type: string
        role:
          description: "Role enumerates the built-in permission tiers that control what teammates can manage inside a workspace.\n\n - ROLE_UNSPECIFIED: Role not specified (defaults to viewer permissions)"
          enum:
          - ROLE_UNSPECIFIED
          - ROLE_VIEWER
          - ROLE_ADMIN
          - ROLE_TECH
          example: ROLE_ADMIN
          title: Workspace role that controls product permissions
        updatedAt:
          format: date-time
          title: Timestamp when member metadata was last updated
          type: string
        workspaceId:
          example: c0d3cafe-5b1e-4d42-a6fd-0c5f5c3962d0
          title: Workspace the member belongs to (UUID)
          type: string
      title: Member
      type: object
    ClaimAgentWorkspaceRequest:
      properties:
        claimAttemptToken:
          title: The claim_attempt_token from the link the agent handed over
          type: string
        firebaseToken:
          description: A Firebase ID token from Google or Microsoft sign-in, for the claim email. Set this or password.
          type: string
        password:
          description: A password for the claim email. Set this or firebase_token.
          type: string
        userCode:
          title: The 6-digit code from the claim email
          type: string
      title: Request to claim an agent's workspace
      type: object
    AgentClaimStatus:
      default: AGENT_CLAIM_STATUS_UNSPECIFIED
      description: "Where a claim link stands.\n\n - AGENT_CLAIM_STATUS_PENDING: The link is live: enter the code to claim the workspace\n - AGENT_CLAIM_STATUS_CLAIMED: The workspace has been claimed\n - AGENT_CLAIM_STATUS_EXPIRED: The link or the registration expired, or the agent started a newer claim"
      enum:
      - AGENT_CLAIM_STATUS_UNSPECIFIED
      - AGENT_CLAIM_STATUS_PENDING
      - AGENT_CLAIM_STATUS_CLAIMED
      - AGENT_CLAIM_STATUS_EXPIRED
      title: AgentClaimStatus
      type: string
    ApiScope:
      default: API_SCOPE_UNSPECIFIED
      description: "ApiScope is one permission an API token or OAuth grant can hold.\n\nA write scope also grants the read scope of the same resource.\n\n - API_SCOPE_UNSPECIFIED: Not a scope. Rejected wherever a scope is expected.\n - API_SCOPE_LINKS_READ: Read links, their QR code images, tags, folders and link settings.\n - API_SCOPE_LINKS_WRITE: Create, update and delete links, tags, folders and link settings.\n - API_SCOPE_WORKFLOWS_READ: Read the workflow steps behind a link and validate them.\n - API_SCOPE_WORKFLOWS_WRITE: Create, connect, update, lay out and delete workflow steps.\n - API_SCOPE_QRCODES_READ: Read QR code designs and QR code templates.\n - API_SCOPE_QRCODES_WRITE: Change QR code designs and create, publish and delete QR code templates.\n - API_SCOPE_PAGE_THEMES_READ: Read page themes and page theme templates.\n - API_SCOPE_PAGE_THEMES_WRITE: Change page themes and create, publish and delete page theme templates.\n - API_SCOPE_MEDIA_READ: Read uploaded media.\n - API_SCOPE_MEDIA_WRITE: Upload and delete media.\n - API_SCOPE_DOMAINS_READ: Read custom domains and their DNS instructions.\n - API_SCOPE_DOMAINS_WRITE: Add, verify, update and delete custom domains.\n - API_SCOPE_VISITORS_READ: Read and search visitors and their attributes.\n - API_SCOPE_VISITORS_WRITE: Identify, update and delete visitors and their attributes.\n - API_SCOPE_ANALYTICS_READ: Read events, metrics, time series, analytics data and dashboards.\n - API_SCOPE_ANALYTICS_WRITE: Create, update and delete analytics dashboards and generate widget summaries.\n - API_SCOPE_WEBHOOKS_READ: Read webhooks.\n - API_SCOPE_WEBHOOKS_WRITE: Create, update and delete webhooks.\n - API_SCOPE_INTEGRATIONS_READ: Read the Slack and Google Forms integrations.\n - API_SCOPE_INTEGRATIONS_WRITE: Connect, configure, test, sync and disconnect the Slack and Google Forms integrations.\n - API_SCOPE_WORKSPACE_READ: Read the workspace and its settings.\n - API_SCOPE_WORKSPACE_WRITE: Update the workspace, request enrollment and delete the workspace.\n - API_SCOPE_MEMBERS_READ: Read workspace members.\n - API_SCOPE_MEMBERS_WRITE: Update, revoke, sign out and remove members. Inviting a member or changing a sign-in email or password needs full access.\n - API_SCOPE_TOKENS_READ: Read API tokens and their scopes, never their secrets.\n - API_SCOPE_TOKENS_WRITE: Create, update and delete API tokens, limited to the scopes the calling token holds.\n - API_SCOPE_BILLING_WRITE: Open checkout, credit top-up and billing portal sessions.\n - API_SCOPE_ASSISTANT_READ: Read the Assistant conversation.\n - API_SCOPE_ASSISTANT_WRITE: Send files to the Assistant, clear the conversation and contact support."
      enum:
      - API_SCOPE_UNSPECIFIED
      - API_SCOPE_LINKS_READ
      - API_SCOPE_LINKS_WRITE
      - API_SCOPE_WORKFLOWS_READ
      - API_SCOPE_WORKFLOWS_WRITE
      - API_SCOPE_QRCODES_READ
      - API_SCOPE_QRCODES_WRITE
      - API_SCOPE_PAGE_THEMES_READ
      - API_SCOPE_PAGE_THEMES_WRITE
      - API_SCOPE_MEDIA_READ
      - API_SCOPE_MEDIA_WRITE
      - API_SCOPE_DOMAINS_READ
      - API_SCOPE_DOMAINS_WRITE
      - API_SCOPE_VISITORS_READ
      - API_SCOPE_VISITORS_WRITE
      - API_SCOPE_ANALYTICS_READ
      - API_SCOPE_ANALYTICS_WRITE
      - API_SCOPE_WEBHOOKS_READ
      - API_SCOPE_WEBHOOKS_WRITE
      - API_SCOPE_INTEGRATIONS_READ
      - API_SCOPE_INTEGRATIONS_WRITE
      - API_SCOPE_WORKSPACE_READ
      - API_SCOPE_WORKSPACE_WRITE
      - API_SCOPE_MEMBERS_READ
      - API_SCOPE_MEMBERS_WRITE
      - API_SCOPE_TOKENS_READ
      - API_SCOPE_TOKENS_WRITE
      - API_SCOPE_BILLING_WRITE
      - API_SCOPE_ASSISTANT_READ
      - API_SCOPE_ASSISTANT_WRITE
      type: string
  responses:
    TooManyRequests:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
      description: Too many requests. Wait the number of seconds in Retry-After, or until the RateLimit window resets, then retry.
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Limit:
          $ref: '#/components/headers/RateLimit-Limit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimit-Policy'
        RateLimit-Remaining:
          $ref: '#/components/headers/RateLimit-Remaining'
        RateLimit-Reset:
          $ref: '#/components/headers/RateLimit-Reset'
        Retry-After:
          $ref: '#/components/headers/Retry-After'
        X-RateLimit-Limit:
          $ref: '#/components/headers/X-RateLimit-Limit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/X-RateLimit-Remaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/X-RateLimit-Reset'
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT
      description: JWT Bearer token authentication. Use a workspace API token obtained from the Linkbreakers dashboard. When using the SDK, pass this token to the `accessToken` field in the Configuration constructor (not `apiKey`). A token has full access or a list of scopes; each operation lists the one scope it requires, and a write scope also grants the read scope of the same resource. GET /v1/api-scopes lists every scope.
      scheme: bearer
      type: http
    oauth2:
      description: OAuth 2.0 authorization code flow with PKCE and dynamic client registration. Request only the scopes you need. The scope names are the same ones workspace API tokens hold.
      flows:
        authorizationCode:
          authorizationUrl: https://mcp.linkbreakers.com/oauth/authorize
          refreshUrl: https://mcp.linkbreakers.com/oauth/token
          scopes:
            analytics:read: Read events, metrics, time series, analytics data and dashboards.
            analytics:write: Create, update and delete analytics dashboards and generate widget summaries.
            assistant:read: Read the Assistant conversation.
            assistant:write: Send files to the Assistant, clear the conversation and contact support.
            billing:write: Open checkout, credit top-up and billing portal sessions.
            domains:read: Read custom domains and their DNS instructions.
            domains:write: Add, verify, update and delete custom domains.
            integrations:read: Read the Slack and Google Forms integrations.
            integrations:write: Connect, configure, test, sync and disconnect the Slack and Google Forms integrations.
            links:read: Read links, their QR code images, tags, folders and link settings.
            links:write: Create, update and delete links, tags, folders and link settings.
            mcp:tools: Full access, including scopes added later.
            media:read: Read uploaded media.
            media:write: Upload and delete media.
            members:read: Read workspace members.
            members:write: Update, revoke, sign out and remove members. Inviting a member or changing a sign-in email or password needs full access.
            page_themes:read: Read page themes and page theme templates.
            page_themes:write: Change page themes and create, publish and delete page theme templates.
            qrcodes:read: Read QR code designs and QR code templates.
            qrcodes:write: Change QR code designs and create, publish and delete QR code templates.
            tokens:read: Read API tokens and their scopes, never their secrets.
            tokens:write: Create, update and delete API tokens, limited to the scopes the calling token holds.
            visitors:read: Read and search visitors and their attributes.
            visitors:write: Identify, update and delete visitors and their attributes.
            webhooks:read: Read webhooks.
            webhooks:write: Create, update and delete webhooks.
            workflows:read: Read the workflow steps behind a link and validate them.
            workflows:write: Create, connect, update, lay out and delete workflow steps.
            workspace:read: Read the workspace and its settings.
            workspace:write: Update the workspace, request enrollment and delete the workspace.
          tokenUrl: https://mcp.linkbreakers.com/oauth/token
      type: oauth2