Meta Agent Tools Auth API

openapi: 3.2.0
info:
  title: Agentalog — Agent Auto Log Auth API
  version: 1.0.0
  description: 'Agent Auto Log: catalog of MCP servers, skills and plugins with an automatic change log, plus a monitor for what your agents install.'
servers:
- url: https://agentalog.com
tags:
- name: Auth
paths:
  /api/auth/bootstrap:
    get:
      operationId: get_api_auth_bootstrap
      summary: Prepare the browser for global sign-in
      description: 'Sets a host-only HttpOnly browser cookie. CSRF is bound to the current session. No CORS.

        Returns: { csrf, context }'
      security: []
      responses:
        '200':
          description: '{ csrf, context }'
          content:
            application/json:
              schema:
                type: object
                properties:
                  csrf:
                    type: string
                    description: X-CSRF-Token
                  context:
                    type: string
                    description: Opaque view context, also in X-MM-Context; not a credential / contexto opaco da vista, não é credencial.
                required:
                - csrf
                - context
        '400':
          description: invalid_request
        '403':
          description: invalid_origin / invalid_csrf
        '503':
          description: 'auth_unavailable: a sessão anterior é preservada / the previous session is preserved'
      tags:
      - Auth
  /api/auth/logout:
    post:
      operationId: post_api_auth_logout
      summary: Revoke this product session
      description: 'Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active.

        Returns: { ok }'
      security:
      - globalAccount: []
      responses:
        '200':
          description: '{ ok }'
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                    description: 'true'
                required:
                - ok
        '400':
          description: invalid_request
        '403':
          description: invalid_origin / invalid_csrf
        '503':
          description: 'auth_unavailable: a sessão anterior é preservada / the previous session is preserved'
      tags:
      - Auth
  /api/auth/wallet/agent/start:
    post:
      operationId: post_api_auth_wallet_agent_start
      summary: Start the wallet credential of an agent without an account
      description: 'No account: the wallet proves it is hers by signing the message (EIP-4361). Signing does not pay or transfer anything. The message names this product and lasts 5 minutes. Sign it with personal_sign and send it to /api/auth/wallet/agent/token.

        Returns: { message, issuedAt, expiresIn }'
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                address:
                  type: string
                  description: 0x…, a carteira (EOA ou contrato na Base)
              required:
              - address
            example:
              address: '0x2c7536E3605D9C16a7a3D7b1898e529396a65c23'
      responses:
        '200':
          description: '{ message, issuedAt, expiresIn }'
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: EIP-4361
                  issuedAt:
                    type: number
                    description: segundos / seconds
                  expiresIn:
                    type: number
                    description: '300'
                required:
                - message
                - issuedAt
                - expiresIn
        '400':
          description: invalid_wallet_address
        '503':
          description: auth_unavailable
      tags:
      - Auth
  /api/auth/wallet/agent/token:
    post:
      operationId: post_api_auth_wallet_agent_token
      summary: Get the wallet credential (mmw_…) of this product
      description: 'The wallet''s signature of the start message, checked here (own key) or on Base (contract, EIP-1271/6492). The credential lasts 30 days: send `Authorization: Bearer mmw_…` to the routes that accept the wallet as owner (owner `x402:`). Once the wallet is linked to an account, what it did here moves to the account when the person signs in.

        Returns: { token, owner, expiresAt }'
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                address:
                  type: string
                  description: 0x…, a mesma carteira do start / the same wallet as in start
                issuedAt:
                  type: number
                  description: o issuedAt do start / start's issuedAt
                signature:
                  type: string
                  description: personal_sign (0x…)
              required:
              - address
              - issuedAt
              - signature
            example:
              address: '0x2c7536E3605D9C16a7a3D7b1898e529396a65c23'
              issuedAt: 1791400000
              signature: 0x…
      responses:
        '200':
          description: '{ token, owner, expiresAt }'
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                    description: mmw_…
                  owner:
                    type: string
                    description: x402:0x…
                  expiresAt:
                    type: number
                    description: segundos / seconds
                required:
                - token
                - owner
                - expiresAt
        '400':
          description: invalid_body
        '401':
          description: invalid_wallet
        '429':
          description: wallet_limited
        '503':
          description: wallet_unavailable / auth_unavailable
      tags:
      - Auth
  /api/auth/claim/wallets:
    post:
      operationId: post_api_auth_claim_wallets
      summary: Move to the account what its wallets did without an account
      description: 'The sign-in window calls it after every sign-in. For each wallet linked to the account: the rights bought here by x402 (owner x402:) and what this product keeps for that owner. Repeating moves nothing.

        Returns: { carteiras, direitos }'
      security:
      - globalAccount: []
      responses:
        '200':
          description: '{ carteiras, direitos }'
          content:
            application/json:
              schema:
                type: object
                properties:
                  carteiras:
                    type: number
                    description: wallets
                  direitos:
                    type: number
                    description: rights moved
                required:
                - carteiras
                - direitos
        '401':
          description: invalid_session
        '503':
          description: auth_unavailable
      tags:
      - Auth
  /api/auth/claim:
    post:
      operationId: post_api_auth_claim
      summary: 'Moves what the guest created to the signed-in account: its listings, likes and…'
      description: 'Bootstrap/CSRF of this browser required; the page does it right after sign-in. Only what the guest still owns moves, in one transaction, and anything that collides with what the account already has stays with the guest. What the guest bought moves too. An old unsigned token that owns nothing here is refused. Repeating it is harmless (moves zero).

        Returns: { ok, claimed }'
      security:
      - globalAccount: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                guest_token:
                  type: string
                  description: Guest `mr_…`; omitted, the `guest` cookie of this browser.
            example: {}
      responses:
        '200':
          description: '{ ok, claimed }'
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                    description: Whether the guest was recognized and moved.
                  claimed:
                    type: object
                    description: '`product.movidos` (rows moved, per table), `product.apagados` (guest duplicates dropped) and `product.direitos` (purchases moved).'
                required:
                - ok
                - claimed
        '400':
          description: invalid_product_claim / invalid_body
        '401':
          description: invalid_session
        '403':
          description: invalid_origin / invalid_csrf
        '409':
          description: unknown_guest (em `claimed.reason` / in `claimed.reason`)
        '503':
          description: product_claim_pending / auth_unavailable
      tags:
      - Auth
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Guest mr_… or ADMIN_TOKEN; the account is a cookie, never a bearer.
    monitorReader:
      type: http
      scheme: bearer
      bearerFormat: mmq_…
      description: Read one private project's event cursor only. No ingestion, approval or purchase. Do not mix with cookies.
    monitorInstallation:
      type: http
      scheme: bearer
      bearerFormat: mmi_…
      description: One private installation and project. No approval, purchase or credential issuance.
    monitorNotices:
      type: http
      scheme: bearer
      bearerFormat: mmn_…
      description: Product notice service only. Reserve, start and confirm; no account or installation authority.
    x402:
      type: apiKey
      in: header
      name: X-PAYMENT
      description: x402 payment per call (USDC on Base). Call without it to get the 402 with `accepts`; sign the authorization and repeat with the base64 payment in X-PAYMENT.
    globalAccount:
      type: apiKey
      in: cookie
      name: __Host-mm-auth
      description: Global session in the product's HttpOnly cookie; writes require exact Origin and X-CSRF-Token.
    contaChaveApi:
      type: http
      scheme: bearer
      bearerFormat: mmk_…
      description: 'Account API key: `Authorization: Bearer mmk_…` or `X-Api-Key: mmk_…`. Created on the account page (API keys), valid only in the product where it was created; it acts as the account (or the organization that owns it).'
    carteiraAgente:
      type: http
      scheme: bearer
      bearerFormat: mmw_…
      description: 'Wallet credential of an agent without an account (`Authorization: Bearer mmw_…`, 30 days, this product only): POST /api/auth/wallet/agent/start, sign the message with the wallet, POST /api/auth/wallet/agent/token. The owner is `x402:<address>`.'
x-service-info:
  categories:
  - ai-agents
  - mcp
  - directory
  docs:
    homepage: https://agentalog.com/
    apiReference: https://agentalog.com/developers
    llms: https://agentalog.com/llms.txt
x-provenance:
  method: harvested
  publisher: Meta Agent Tools
  source: https://agentalog.com/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)