Goomp Inc Kalendar Ai Authentication

generated: '2026-08-13'
method: searched
source: https://api.oncockpit.ai/.well-known/ai-plugin.json
docs: null
note: >-
  There is no OpenAPI to derive from — the only machine-readable statement the provider makes
  about authentication is the `auth` block of its live ChatGPT plugin manifest, served from its
  own API host (api.oncockpit.ai, HTTP 200, application/json). It declares an OAuth flow with the
  scopes "read write" and an authorization callback on the legacy kalendar.ai domain. The manifest
  also names an OpenAPI at https://kalendar.ai/openapi.yaml; that URL now 301s to
  https://oncockpit.ai/openapi.yaml, which returns the site's 5,130-byte SPA catch-all shell
  (text/html), so the contract behind this auth flow is no longer published. Treat this profile as
  the provider's last published position on auth, not as a live, documented developer program.
schemes:
- name: oauth
  type: oauth2
  flow: authorization_code
  authorization_url: https://kalendar.ai/chatgpt/authorize_callback.json
  client_registration_url: https://kalendar.ai/users/new/onboard/
  authorization_content_type: application/json
  scopes:
  - read
  - write
  user_authenticated: true
  source: https://api.oncockpit.ai/.well-known/ai-plugin.json
  evidence: 'ai-plugin.json auth: {"type":"oauth","scope":"read write"}'
observations:
- surface: https://api.oncockpit.ai/
  status: 200
  body: '{"name":"Cockpit AI API","status":"active","timestamp":"..."}'
  note: API host self-identifies but publishes no unauthenticated reference or spec
- surface: https://api.oncockpit.ai/health
  status: 200
  body: OK
- surface: https://kalendar.ai/openapi.yaml
  status: 301
  note: redirects to oncockpit.ai/openapi.yaml which returns the SPA shell, not a spec
gaps:
- No public authentication documentation page was found on oncockpit.ai or any subdomain.
- No /.well-known/oauth-authorization-server or /.well-known/oauth-protected-resource is served.
- No API key issuance flow is documented publicly.