REST API
The same six jobs over HTTP. Session cookie or API key. Machines read the schema at /openapi.json.
Auth
A signed-in session is a server-side cookie bound to one billing account. Unsafe requests need a CSRF token minted for that session. An API key is the machine path.
What you call
Core routes live under /v1. Billable calls fail closed with insufficient_balance instead of guessing.
- GET /v1/recipes
- POST /v1/runs (and GET /v1/runs/{id})
- GET /v1/evidence/{id}
- GET /v1/watches (create, run, patch on the same collection)
Agents
Hosted MCP is a separate surface at /mcp. Humans complete OAuth on this origin; the agent then calls the same jobs.