{
  "name": "Agentalog",
  "description": "Agent Auto Log: catalog of MCP servers, skills and plugins with an automatic change log, plus a monitor for what your agents install. Submissions are reviewed before publication. This is an independent catalog.",
  "auth": {
    "credito": "Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance.",
    "none": "Public, no credential.",
    "guest": "Guest token (`POST /api/guest`) in `X-Guest-Token: mr_…` or `Authorization: Bearer mr_…`. In the browser it also lives in the HttpOnly `mr_guest` cookie, which writes only from this site's exact Origin. A signed-in account (cookie) also works and takes precedence.",
    "session": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans.",
    "session_ou_x402": "A person can submit with the account cookie or a guest identity. An agent can submit without an account. Both paths are free while billing is off and use the same submission limits. When billing is enabled, the agent path accepts x402 or prepaid credit.",
    "session_ou_carteira": "The global account (the session cookie of this domain), or, for an agent without an account, the wallet credential in `Authorization: Bearer mmw_…` (`POST /api/auth/wallet/agent/start`, sign, `POST /api/auth/wallet/agent/token`). The wallet follows its watches through the API; the change e-mail goes only to an account.",
    "token": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint.",
    "monitor_installation": "Private mmi_ credential in Authorization: Bearer, restricted to one installation and project. The account issues it after recent human sign-in. It cannot approve, buy or issue another credential.",
    "monitor_notices": "Dedicated mmn_ bearer credential for the existing product mail service. Only reserve, start and confirm one product's notices. Account cookies, API keys and installation tokens are refused.",
    "session_ou_monitor_reader": "The existing human account cookie, or a separate mmq_ bearer credential for one project's event GET. Do not mix the reader with cookies or X-API-Key. Account status, security version, expiry and revocation are checked on each use."
  },
  "docs": {
    "llms": "https://agentalog.com/llms.txt",
    "llms_full": "https://agentalog.com/llms-full.txt",
    "openapi": "https://agentalog.com/openapi.json",
    "mcp": "https://agentalog.com/mcp",
    "pricing": "https://agentalog.com/api/pricing",
    "billing": "https://agentalog.com/api/billing",
    "human_ui": "https://agentalog.com/",
    "data_indexes": [
      {
        "id": "cep",
        "produto": "https://pontofato.com",
        "caminho": "/enderecos",
        "title": "Postal codes and addresses",
        "description": "Find addresses by location, with coordinates and a 2022 reference date. Not a current postal-code certification. Each HTML page opens the product app with its public data already rendered.",
        "hierarchy": "State → municipality → locality → street → addresses",
        "url": "https://pontofato.com/enderecos/",
        "formats": {
          "html": "https://pontofato.com/enderecos/",
          "json": "https://api.pontofato.com/enderecos/index.json",
          "md": "https://api.pontofato.com/enderecos/index.md",
          "okf": "https://api.pontofato.com/enderecos/index.okf.md"
        },
        "llms": "https://api.pontofato.com/enderecos/llms.txt",
        "openapi": "https://api.pontofato.com/enderecos/openapi.json",
        "mcp": "https://api.pontofato.com/enderecos/mcp",
        "okf": "https://api.pontofato.com/enderecos/okf/index.md",
        "access": "public-read-only",
        "pagination": {
          "max_items": 20,
          "next": "links.proximo"
        },
        "updates": "manual"
      },
      {
        "id": "editais",
        "produto": "https://editalmd.com",
        "caminho": "/licitacoes",
        "title": "Public procurement",
        "description": "Find public procurement by location and date. View documents and reading options in EditalMD. Each HTML page opens the product app with its public data already rendered.",
        "hierarchy": "Procedure → state → year → month → day → municipality → purchases",
        "url": "https://editalmd.com/licitacoes/",
        "formats": {
          "html": "https://editalmd.com/licitacoes/",
          "json": "https://api.editalmd.com/licitacoes/index.json",
          "md": "https://api.editalmd.com/licitacoes/index.md",
          "okf": "https://api.editalmd.com/licitacoes/index.okf.md"
        },
        "llms": "https://api.editalmd.com/licitacoes/llms.txt",
        "openapi": "https://api.editalmd.com/licitacoes/openapi.json",
        "mcp": "https://api.editalmd.com/licitacoes/mcp",
        "okf": "https://api.editalmd.com/licitacoes/okf/index.md",
        "access": "public-read-only",
        "pagination": {
          "max_items": 20,
          "next": "links.proximo"
        },
        "updates": "manual"
      }
    ],
    "local_monitor": {
      "download": "https://agentalog.com/downloads/mat-monitor-0.4.2.mjs",
      "manifesto": "https://agentalog.com/downloads/mat-monitor-0.4.2.mjs.json",
      "versao": "0.4.2",
      "comandos": [
        "preview",
        "init",
        "scan",
        "outbox",
        "status",
        "connect",
        "sync",
        "policy",
        "check",
        "hooks-preview",
        "hooks-install",
        "hooks-remove",
        "hooks-status"
      ],
      "requisitos": [
        "Node.js 26",
        "Linux and /usr/bin/flock for local state"
      ],
      "modo": "private_sync",
      "envia_dados": true,
      "envio": "sync sends persisted metadata batches after preview consent. Installing hooks with auto delivery also permits bounded sends on native session events and Stop. Choose manual delivery to require explicit sync.",
      "aprova": false,
      "bloqueia": true,
      "bloqueio_universal": false,
      "hooks": {
        "agente": "Claude Code",
        "modos": [
          "observe",
          "enforce"
        ],
        "padrao": "observe",
        "escopo": "Covered native calls with installed project hooks and an exact current signed policy.",
        "limites": "Disabled hooks, a missing executable or an outer timeout can allow the native action. MCP startup, arbitrary processes and network traffic remain outside this control."
      },
      "revalida": true,
      "consulta_eventos": {
        "opcional": true,
        "autoridade": "One project's event GET only. No ingest, approval, purchase or credential management.",
        "emissao": "Sign in again, then open Mine > API access. Keep the one-time download private.",
        "chaves_ativas_maximas": 3,
        "validade_segundos": 2592000,
        "revogavel": true
      },
      "webhook": {
        "opcional": true,
        "emissao": "Sign in again, then open Mine > Change webhook. Create a public HTTPS destination and keep the signing-key download private.",
        "destinos_ativos_maximos": 1,
        "validade_segundos": 2592000,
        "assinatura": "Standard Webhooks",
        "tentativas_maximas": 6,
        "deduplicacao": "Verify the signature and timestamp, then deduplicate webhook-id before any effect.",
        "recuperacao": "Read missing committed events through the project cursor.",
        "revogavel": true
      },
      "politica": {
        "assinatura": "Ed25519",
        "validade_maxima_segundos": 900,
        "chave_fixa_no_cliente": true
      }
    }
  },
  "endpoints": [
    {
      "method": "GET",
      "path": "/agent.json",
      "auth": "none",
      "summary": "Agent card: identity, operator, documentation, the MCP endpoint and the tools it serves. Same document as `/.well-known/agent-card.json`.",
      "grupo": "Discovery",
      "retorno": {
        "_texto": "`application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`."
      },
      "exemplo": "curl -s $ORIGIN/agent.json",
      "returns": "`application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`.",
      "url": "https://agentalog.com/agent.json",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/okf/:arquivo",
      "auth": "none",
      "summary": "OKF bundle (Open Knowledge Format v0.1): markdown with frontmatter so an agent reads the whole product without parsing HTML.",
      "grupo": "Discovery",
      "params": {
        "arquivo": {
          "desc": "`index.md`, `sobre.md`, `api.md` or `faq.md`.",
          "exemplo": "index.md"
        }
      },
      "retorno": {
        "_texto": "`text/markdown`. Start at `/okf/index.md`, which lists the bundle."
      },
      "erros": {
        "404": "File outside the bundle."
      },
      "exemplo": "curl -s $ORIGIN/okf/index.md",
      "returns": "`text/markdown`. Start at `/okf/index.md`, which lists the bundle.",
      "url": "https://agentalog.com/okf/:arquivo",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/.well-known/:arquivo",
      "auth": "none",
      "summary": "Machine discovery before the home page: `api-catalog` (RFC 9727, a linkset with the API and the MCP), `security.txt` (RFC 9116), `x402` (payment manifest: network, wallet and the routes that charge) and `mcp-registry-auth` (the official MCP registry key).",
      "grupo": "Discovery",
      "params": {
        "arquivo": {
          "desc": "`api-catalog`, `security.txt`, `x402`, `mcp-registry-auth` or `apis.json`.",
          "exemplo": "api-catalog"
        }
      },
      "retorno": {
        "_texto": "`application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two."
      },
      "erros": {
        "404": "Name outside the five published."
      },
      "exemplo": "curl -s $ORIGIN/.well-known/api-catalog",
      "returns": "`application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two.",
      "url": "https://agentalog.com/.well-known/:arquivo",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/apis.json",
      "auth": "none",
      "summary": "APIs.json (apisjson.org, 0.19): the index APIs.io harvests — the API, the MCP, OpenAPI, guide and OKF bundle in one file. Also at `/.well-known/apis.json`.",
      "grupo": "Discovery",
      "retorno": {
        "_texto": "`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`."
      },
      "exemplo": "curl -s $ORIGIN/apis.json",
      "returns": "`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`.",
      "url": "https://agentalog.com/apis.json",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/feed.xml",
      "auth": "none",
      "summary": "RSS 2.0 of the most recently published listings.",
      "grupo": "Discovery",
      "retorno": {
        "_texto": "`application/rss+xml`."
      },
      "exemplo": "curl -s $ORIGIN/feed.xml",
      "returns": "`application/rss+xml`.",
      "url": "https://agentalog.com/feed.xml",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/feed.json",
      "auth": "none",
      "summary": "JSON Feed 1.1 of the most recently published listings — the same stream as the RSS.",
      "grupo": "Discovery",
      "retorno": {
        "_texto": "`application/feed+json`."
      },
      "exemplo": "curl -s $ORIGIN/feed.json",
      "returns": "`application/feed+json`.",
      "url": "https://agentalog.com/feed.json",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/",
      "auth": "none",
      "summary": "Self-describing index: the whole API surface, with quota and quickstart.",
      "grupo": "Discovery",
      "retorno": {
        "name": {
          "tipo": "string",
          "desc": "Product name."
        },
        "description": {
          "tipo": "string",
          "desc": "What the registry is and what it is not."
        },
        "auth": {
          "tipo": "object",
          "desc": "Each authentication mode and how to obtain it."
        },
        "docs": {
          "tipo": "object",
          "desc": "Links to llms.txt, llms-full.txt, openapi.json, MCP and the UI."
        },
        "endpoints": {
          "tipo": "object[]",
          "desc": "Every endpoint with method, path, auth, absolute URL and what it returns."
        },
        "quota": {
          "tipo": "object",
          "desc": "What is free, what costs and how to pay — before you spend a call."
        },
        "mcp": {
          "tipo": "object",
          "desc": "Address and transport of the MCP server."
        },
        "quickstart": {
          "tipo": "string[]",
          "desc": "The calls that take you from zero to the first published listing."
        }
      },
      "returns": "{ name, description, auth, docs, endpoints, quota, mcp, quickstart }",
      "url": "https://agentalog.com/api/",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/health",
      "auth": "none",
      "summary": "Liveness and the commit deployed right now — it is how the smoke waits for its own deploy.",
      "grupo": "Discovery",
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true` when the Worker answers."
        },
        "app": {
          "tipo": "string",
          "desc": "Product name."
        },
        "build": {
          "tipo": "string",
          "desc": "Deployed commit; CI passes the short SHA on deploy."
        },
        "ts": {
          "tipo": "string",
          "desc": "Time of the response (UTC, ISO-8601)."
        }
      },
      "returns": "{ ok, app, build, ts }",
      "url": "https://agentalog.com/api/health",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/mcp",
      "auth": "none",
      "summary": "MCP server over HTTP (Streamable HTTP, JSON-RPC 2.0) — plugs into the client with nothing to install.",
      "grupo": "Discovery",
      "desc": "The tools are the operations of this same catalog; the MCP has no backend of its own. `GET /mcp` returns the server card.",
      "retorno": {
        "_texto": "JSON-RPC 2.0 response (`initialize`, `tools/list` or `tools/call`)."
      },
      "notes": [
        "Credentials go in the usual headers (X-Guest-Token, Authorization, X-PAYMENT) and are forwarded to the API.",
        "An exhausted quota comes back as a 402 with accepts[] inside the tool result — pay and repeat."
      ],
      "exemplo": "curl -s -XPOST $ORIGIN/mcp -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}'",
      "returns": "JSON-RPC 2.0 response (`initialize`, `tools/list` or `tools/call`).",
      "url": "https://agentalog.com/mcp",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/guest",
      "auth": "none",
      "summary": "Creates a guest `mr_…` — it is the identity that likes, comments and visits.",
      "grupo": "Identity",
      "desc": "Asks for no e-mail. Publishing a listing is what requires an account (or a payment). At most 20 new guests per network per hour; a browser that already has one gets it back from the `mr_guest` cookie.",
      "retorno": {
        "token": {
          "tipo": "string",
          "desc": "The guest, prefix `mr_`. Send it in `X-Guest-Token` or as Bearer."
        }
      },
      "erros": {
        "429": "More than 20 new guests from the same network in the hour.",
        "503": "auth_unavailable"
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/guest",
      "returns": "{ token }",
      "url": "https://agentalog.com/api/guest",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/listings",
      "auth": "none",
      "colecao": {
        "porPagina": 50,
        "anda": "next"
      },
      "summary": "The public mosaic: paginated search of the catalog's listings, the lower-signal tail last.",
      "grupo": "Catalog",
      "desc": "`live` listings first and the `low` tail (few stars or no clear license) after them in every order — `low=0` leaves the tail out. To walk everything, follow `next`: without `q` it is a cursor (`next_cursor`, keyset on the order's index) and has no ceiling; every listing also has an HTML page at `/l/:id` and the shards of `/sitemap-listings.xml` list them all. `q` runs on a full-text index (FTS5, bm25) kept in the same transaction as every text write. With `q` and `low=0`, `low_count` says how many `low` listings the filter left out — LIKE with a cap of 200. The query is mapped onto kind/topic/transport filters unless `interpret=0`.",
      "query": {
        "q": {
          "tipo": "string",
          "desc": "Free text over the name, the tagline, the description, the origin identifier and the README excerpt: every word (up to six, 2+ letters, accents ignored) must match; ranked by bm25 with the name weighing most (10), then tagline (5), identifier (3), description (2), README excerpt (1); ties by stars. Kind, topic and transport words become filters. The `low` tail is in the same index.",
          "exemplo": "browser testing"
        },
        "interpret": {
          "tipo": "string",
          "desc": "`0` disables query understanding and searches the raw string.",
          "valores": [
            "0"
          ]
        },
        "kind": {
          "tipo": "string",
          "desc": "Which kind of resource to fetch.",
          "valores": [
            "mcp",
            "skill",
            "plugin"
          ]
        },
        "category": {
          "tipo": "string",
          "desc": "Category declared by whoever published."
        },
        "sort": {
          "tipo": "string",
          "desc": "Result order. Without it, a query is ranked by relevance — bm25 over the full-text index (name 10, tagline 5, identifier 3, description 2, README excerpt 1) multiplied by 1 + 0.05·ln(1 + stars) + 0.1 if pushed in the last 180 days + 0.1 if a README was collected; ties by stars — and a plain listing by arrival.",
          "valores": [
            "relevancia",
            "recent",
            "stars",
            "likes",
            "visits",
            "nome"
          ],
          "padrao": "relevancia when q is set, recent otherwise"
        },
        "low": {
          "tipo": "string",
          "desc": "`0` leaves the `low` tail out; by default it comes after the `live` listings in every order.",
          "valores": [
            "0"
          ]
        },
        "cursor": {
          "tipo": "string",
          "desc": "Opaque cursor from `next_cursor` of the previous page (orders `recent`, `stars` and `nome`, without `q`). With it, `offset` is ignored. A cursor from another order or a malformed one restarts at the first page."
        },
        "limit": {
          "tipo": "int",
          "desc": "Listings per page.",
          "padrao": 24
        },
        "offset": {
          "tipo": "int",
          "desc": "How many listings to skip. No ceiling since 2026-09-13, but the database reads every skipped row: to walk the catalog, follow `next` (cursor) instead.",
          "padrao": 0
        },
        "language": {
          "tipo": "string",
          "desc": "Repository code languages, comma-separated. Preserve case, for example Python."
        },
        "license": {
          "tipo": "string",
          "desc": "Repository licenses, comma-separated, for example MIT,Apache-2.0. Preserve case."
        },
        "min_stars": {
          "tipo": "int",
          "desc": "Minimum repository stars, from 0 to 999999999."
        },
        "min_forks": {
          "tipo": "int",
          "desc": "Minimum forks of a repository with collected activity data."
        },
        "min_prs": {
          "tipo": "int",
          "desc": "Minimum open pull requests of a repository with collected activity data."
        },
        "max_prs": {
          "tipo": "int",
          "desc": "Maximum open pull requests of a repository with collected activity data."
        },
        "added_since": {
          "tipo": "string",
          "desc": "Catalog arrival on or after YYYY-MM-DD. This is not the original publication date."
        },
        "pushed_since": {
          "tipo": "string",
          "desc": "Last repository code push on or after YYYY-MM-DD."
        },
        "has_code": {
          "tipo": "string",
          "desc": "Whether a repository link is available. This does not certify the code.",
          "valores": [
            "0",
            "1"
          ]
        }
      },
      "retorno": "PaginaDeAnuncios",
      "exemplo": "curl -s '$ORIGIN/api/listings?kind=mcp&sort=likes&limit=5'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "returns": "{ items[{seguranca_nivel?,seguranca_estado?,seguranca_api?,moderation?,id,kind,category,name,tagline,body,url,status,origin,origin_id,install,source,transporte,ns,versao,oficial_status,repo_host,topico,linguagem,licenca,repo_topics,repo_slug,stars,forks,prs_abertos,pushed_at,repo_estado,likes,comments,visits,created_at,updated_at,mine,api,go,comments_api,readme_api?,historico?,readme_fonte?,readme_bytes,readme_sha,readme_em,payload}], limit, offset, next_offset, next_cursor, next, low_count, low_capped, low_included, interpretacao, api }",
      "url": "https://agentalog.com/api/listings",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/facets",
      "auth": "none",
      "summary": "The whole catalog's counts by kind, provenance, category and repository state.",
      "grupo": "Catalog",
      "query": {
        "q": {
          "tipo": "string",
          "desc": "The same text query as /api/listings."
        },
        "kind": {
          "tipo": "string",
          "desc": "Resource kind."
        },
        "language": {
          "tipo": "string",
          "desc": "Repository code languages, comma-separated. Preserve case, for example Python."
        },
        "license": {
          "tipo": "string",
          "desc": "Repository licenses, comma-separated, for example MIT,Apache-2.0. Preserve case."
        },
        "min_stars": {
          "tipo": "int",
          "desc": "Minimum repository stars, from 0 to 999999999."
        },
        "min_forks": {
          "tipo": "int",
          "desc": "Minimum forks of a repository with collected activity data."
        },
        "min_prs": {
          "tipo": "int",
          "desc": "Minimum open pull requests of a repository with collected activity data."
        },
        "max_prs": {
          "tipo": "int",
          "desc": "Maximum open pull requests of a repository with collected activity data."
        },
        "added_since": {
          "tipo": "string",
          "desc": "Catalog arrival on or after YYYY-MM-DD. This is not the original publication date."
        },
        "pushed_since": {
          "tipo": "string",
          "desc": "Last repository code push on or after YYYY-MM-DD."
        },
        "has_code": {
          "tipo": "string",
          "desc": "Whether a repository link is available. This does not certify the code.",
          "valores": [
            "0",
            "1"
          ]
        }
      },
      "desc": "Exists to build a filter without sweeping the listings: there are tens of thousands, and asking for the list just to count would be expensive. Each dimension ignores its own selection and respects the other filters. These counts describe the search. For catalog tab totals, use the unfiltered response. Language and license come from repository metadata. Also brings `topico_inferido`, deduced from the repositories.",
      "retorno": "Facetas",
      "exemplo": "curl -s $ORIGIN/api/facets",
      "returns": "{ total, facetas, topico_inferido, interpretacao, publicador?, api }",
      "url": "https://agentalog.com/api/facets",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/v0.1/servers",
      "auth": "none",
      "summary": "MCP subregistry in the Official Registry format (spec v0.1), cursor-paginated.",
      "grupo": "Catalog",
      "desc": "Only `kind=mcp` and only `live`. It is the route a generic MCP client knows how to read without knowing this product. `GET /v0/servers` is an alias of the same resource, kept for whoever already pointed there — this is the canonical URL.",
      "query": {
        "search": {
          "tipo": "string",
          "desc": "Free text over the server's name and description."
        },
        "cursor": {
          "tipo": "string",
          "desc": "Opaque cursor of the next page, from `metadata.next_cursor`."
        },
        "limit": {
          "tipo": "int",
          "desc": "Servers per page.",
          "padrao": 30
        }
      },
      "retorno": "PaginaV01",
      "exemplo": "curl -s '$ORIGIN/v0.1/servers?search=postgres&limit=5'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "returns": "{ servers[{name,description,version,repository,remotes,packages}], metadata }",
      "url": "https://agentalog.com/v0.1/servers",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/listings/:id",
      "auth": "none",
      "summary": "One listing's page. The owner sees their own even when pending or hidden.",
      "grupo": "Catalog",
      "params": {
        "id": {
          "desc": "Listing ID, from `Anuncio.id`."
        }
      },
      "retorno": "Anuncio",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "The listing does not exist, or it is not yours and is not live/low.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/listings/ID",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ seguranca_nivel?, seguranca_estado?, seguranca_api?, moderation?, id, kind, category, name, tagline, body, url, status, origin, origin_id, install, source, transporte, ns, versao, oficial_status, repo_host, topico, linguagem, licenca, repo_topics, repo_slug, stars, forks, prs_abertos, pushed_at, repo_estado, likes, comments, visits, created_at, updated_at, mine, api, go, comments_api, readme_api?, historico?, readme_fonte?, readme_bytes, readme_sha, readme_em, payload }",
      "url": "https://agentalog.com/api/listings/:id",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/listings/:id/readme",
      "auth": "none",
      "summary": "README collected from the listing's repository, served on open.",
      "grupo": "Catalog",
      "desc": "The text lives in R2 (`mural-coleta`). This call does not write and does not fetch GitHub. Same visibility as the listing page. Call it only when the listing page carries `readme_api`: a page without it has no README collected, and this route answers 404.",
      "params": {
        "id": {
          "desc": "Listing ID, from `Anuncio.id`."
        }
      },
      "retorno": "Readme",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "The listing does not exist, is not visible, or no README was collected.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/listings/ID/readme",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ markdown, bytes, sha, repo_slug, fonte, truncated, api }",
      "url": "https://agentalog.com/api/listings/:id/readme",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/go/:id",
      "auth": "none",
      "summary": "Hop to the listing's URL: redirects and counts the visit.",
      "grupo": "Catalog",
      "desc": "Counts at most 1 visit per owner per day. The `X-Visit-Counted` header says whether this call counted — it is how the client knows without counting twice. A remote MCP server goes to its repository; without one, to the listing page `/l/:id`, which shows the endpoint to copy, and no visit counts.",
      "params": {
        "id": {
          "desc": "ID of the listing to visit.",
          "exemplo": "lst_9f3c2b1d7a4e58b0c2d4"
        }
      },
      "retorno": {
        "_texto": "`302` with `Location` to the listing's URL, and the `X-Visit-Counted` header."
      },
      "erros": {
        "404": "The listing does not exist or is not live/low."
      },
      "returns": "`302` with `Location` to the listing's URL, and the `X-Visit-Counted` header.",
      "url": "https://agentalog.com/api/go/:id",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/listings/:id/comments",
      "auth": "none",
      "summary": "Public comments on a live listing.",
      "grupo": "Community",
      "desc": "With a credential on the call, each comment of yours comes with `mine: true`.",
      "params": {
        "id": {
          "desc": "ID of the listing."
        }
      },
      "retorno": {
        "items": {
          "tipo": "Comentario[]",
          "desc": "The comments, newest first."
        },
        "total": {
          "tipo": "int",
          "desc": "How many comments the listing has."
        }
      },
      "erros": {
        "404": "The listing does not exist or is not live."
      },
      "exemplo": "curl -s $ORIGIN/api/listings/ID/comments",
      "returns": "{ items[{id,body,author,created_at,mine}], total }",
      "url": "https://agentalog.com/api/listings/:id/comments",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/listings/:id/comments",
      "auth": "guest",
      "summary": "Writes a comment on the listing. Cap of 20 per hour per owner.",
      "grupo": "Community",
      "params": {
        "id": {
          "desc": "ID of the listing to comment on."
        }
      },
      "corpo": {
        "body": {
          "tipo": "string",
          "desc": "The comment text.",
          "obrigatorio": true
        }
      },
      "body": {
        "body": "text"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true` when the comment went in."
        },
        "id": {
          "tipo": "string",
          "desc": "ID of the created comment."
        },
        "body": {
          "tipo": "string",
          "desc": "The stored text."
        }
      },
      "erros": {
        "400": "Empty or too long text.",
        "401": null,
        "404": "The listing does not exist.",
        "429": "More than 20 comments in the hour."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/listings/ID/comments -H \"X-Guest-Token: $MR\" -H 'content-type: application/json' -d '{\"body\":\"works well with Claude Code\"}'",
      "returns": "{ ok, id, body }",
      "url": "https://agentalog.com/api/listings/:id/comments",
      "auth_detail": "Guest token (`POST /api/guest`) in `X-Guest-Token: mr_…` or `Authorization: Bearer mr_…`. In the browser it also lives in the HttpOnly `mr_guest` cookie, which writes only from this site's exact Origin. A signed-in account (cookie) also works and takes precedence."
    },
    {
      "method": "DELETE",
      "path": "/api/comments/:id",
      "auth": "guest",
      "summary": "Deletes a comment of yours. Someone else's comment answers 404, not 403.",
      "grupo": "Community",
      "desc": "The 404 is on purpose: the API does not confirm that a comment with that id exists if it is not yours.",
      "params": {
        "id": {
          "desc": "Comment ID, from `Comentario.id`.",
          "exemplo": "cm_9f3c2b1d7a4e58b0c2"
        }
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true`."
        },
        "id": {
          "tipo": "string",
          "desc": "The id that was removed."
        }
      },
      "erros": [
        401,
        404
      ],
      "exemplo": "curl -s -XDELETE $ORIGIN/api/comments/CMT_ID -H \"X-Guest-Token: $MR\"",
      "returns": "{ ok, id }",
      "url": "https://agentalog.com/api/comments/:id",
      "auth_detail": "Guest token (`POST /api/guest`) in `X-Guest-Token: mr_…` or `Authorization: Bearer mr_…`. In the browser it also lives in the HttpOnly `mr_guest` cookie, which writes only from this site's exact Origin. A signed-in account (cookie) also works and takes precedence."
    },
    {
      "method": "POST",
      "path": "/api/listings/:id/like",
      "auth": "guest",
      "summary": "Likes the listing; DELETE undoes it. Calling again does not add up: the counter counts people.",
      "grupo": "Community",
      "params": {
        "id": {
          "desc": "ID of the listing to like."
        }
      },
      "retorno": "Like",
      "erros": [
        401,
        404
      ],
      "exemplo": "curl -s -XPOST $ORIGIN/api/listings/ID/like -H \"X-Guest-Token: $MR\"",
      "returns": "{ ok, liked, likes }",
      "url": "https://agentalog.com/api/listings/:id/like",
      "auth_detail": "Guest token (`POST /api/guest`) in `X-Guest-Token: mr_…` or `Authorization: Bearer mr_…`. In the browser it also lives in the HttpOnly `mr_guest` cookie, which writes only from this site's exact Origin. A signed-in account (cookie) also works and takes precedence."
    },
    {
      "method": "DELETE",
      "path": "/api/listings/:id/like",
      "auth": "guest",
      "summary": "Unlikes and gives the point back to the public counter.",
      "grupo": "Community",
      "params": {
        "id": {
          "desc": "ID of the listing to unlike."
        }
      },
      "retorno": "Like",
      "erros": [
        401,
        404
      ],
      "exemplo": "curl -s -XDELETE $ORIGIN/api/listings/ID/like -H \"X-Guest-Token: $MR\"",
      "returns": "{ ok, liked, likes }",
      "url": "https://agentalog.com/api/listings/:id/like",
      "auth_detail": "Guest token (`POST /api/guest`) in `X-Guest-Token: mr_…` or `Authorization: Bearer mr_…`. In the browser it also lives in the HttpOnly `mr_guest` cookie, which writes only from this site's exact Origin. A signed-in account (cookie) also works and takes precedence."
    },
    {
      "method": "GET",
      "path": "/api/feeds",
      "auth": "none",
      "colecao": {
        "porPagina": 50,
        "anda": "next"
      },
      "summary": "The feed index: RSS, Atom and JSON feeds, OPML reading lists and sites that only become a feed through a bridge.",
      "grupo": "Feeds",
      "desc": "Find feeds by text, format, language and availability. Filter and text search run in the SAME full-text query: values inside one parameter are OR'd, different parameters are AND'd. Without `q` the order is by newest in the index (`recentes`) and `next_cursor` is a keyset — follow `next` to walk everything. With `q` the order is relevance and paging is by `offset`. We index and link; the feeds belong to whoever publishes them.",
      "query": {
        "q": {
          "tipo": "string",
          "desc": "Free text over the feed name, its description and the domain. Every word must match; accents are ignored.",
          "exemplo": "linux"
        },
        "origem": {
          "tipo": "string",
          "desc": "Where the record comes from. Comma-separated values are OR'd.",
          "valores": [
            "index",
            "blogroll",
            "bridge"
          ]
        },
        "tipo": {
          "tipo": "string",
          "desc": "Feed format. Comma-separated values are OR'd.",
          "valores": [
            "rss2",
            "rss1",
            "atom",
            "json",
            "rss"
          ]
        },
        "midia": {
          "tipo": "string",
          "desc": "Enclosures the feed carries — this is how you find podcasts and video feeds.",
          "valores": [
            "audio",
            "video"
          ]
        },
        "comunidade": {
          "tipo": "string",
          "desc": "Community the publisher belongs to, as the source's bitmask declares it.",
          "valores": [
            "fediverse",
            "indieweb",
            "mastodon",
            "friendica",
            "wordpress",
            "funkwhale",
            "blogroll"
          ]
        },
        "recurso": {
          "tipo": "string",
          "desc": "Namespace seen in the feed: `content` means the whole post travels in the feed, `itunes`/`podcast` mean podcast metadata, `slash` means comment counts.",
          "valores": [
            "content",
            "itunes",
            "podcast",
            "media",
            "slash",
            "wfw",
            "georss"
          ]
        },
        "lista": {
          "tipo": "string",
          "desc": "For OPML lists only: how the list presents itself.",
          "valores": [
            "web",
            "catalogo",
            "planeta"
          ]
        },
        "ano": {
          "tipo": "string",
          "desc": "Year of the newest item the crawler saw. `0` means the source never dated the content. It is a year, not a moving window: the value never drifts.",
          "exemplo": "2026,2025"
        },
        "saude": {
          "tipo": "string",
          "desc": "What our own check saw: `ok` answered, `erro` refused or timed out, `sumiu` returned 404/410. A feed not checked yet matches none of them.",
          "valores": [
            "ok",
            "erro",
            "sumiu"
          ],
          "exemplo": "ok"
        },
        "pais": {
          "tipo": "string",
          "desc": "ISO-3166 alpha-2 of the IP that serves the host, lowercase or uppercase, resolved in the same check.",
          "exemplo": "br,pt"
        },
        "dominio": {
          "tipo": "string",
          "desc": "Exact domain — the fastest way to ask whether a site has a feed."
        },
        "idioma": {
          "tipo": "string",
          "desc": "Language of the site's home page, two or three letters: `pt` matches `pt` and `pt-br`.",
          "exemplo": "pt"
        },
        "imagem": {
          "tipo": "string",
          "desc": "`1` keeps only feeds whose site has a stored preview image (`imagem` is not empty) — the list that looks like a wall of link cards.",
          "valores": [
            "1"
          ]
        },
        "sort": {
          "tipo": "string",
          "desc": "Result order. `recentes` is insertion in the index (what just arrived). `postando` is the newest post first, read from the feed itself (feeds without a dated post are left out). `frequentes` is most posts in the last 30 days first (same). `densidade` is how much item text discovery found — the closest thing to 'this feed has substance'. `dominio` is A–Z by site.",
          "valores": [
            "recentes",
            "postando",
            "frequentes",
            "densidade",
            "dominio",
            "relevancia"
          ],
          "padrao": "relevancia with q, recentes otherwise"
        },
        "cursor": {
          "tipo": "string",
          "desc": "Opaque cursor from `next_cursor` (orders `recentes`, `densidade` and `dominio`). A cursor from another order restarts at the first page."
        },
        "limit": {
          "tipo": "int",
          "desc": "Feeds per page, 1–50.",
          "padrao": 20
        },
        "offset": {
          "tipo": "int",
          "desc": "Offset, capped at 10000. Ignored when `cursor` is present.",
          "padrao": 0
        }
      },
      "retorno": "PaginaDeFeeds",
      "exemplo": "curl -s '$ORIGIN/api/feeds?midia=audio&recurso=itunes&limit=5'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "returns": "{ items[{id,kind,dominio,url,nome,descricao,tipo,audio,video,comunidade,comunidades,ano,recursos,densidade,itens,saude,pais,site_titulo,site_descricao,site_nome,site_og,site_og_alt,site_cor,site_idioma,idioma_bandeira,icone,imagem,ultimo_post,posts_24h,posts_7d,posts_30d,posts_dias,posts_no_feed,posts_parcial,atividade_em,pagina,api}], limit, offset, next_cursor, next_offset, next, sort, api }",
      "url": "https://agentalog.com/api/feeds",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/feeds/facets",
      "auth": "none",
      "summary": "How many feeds exist in each filter value.",
      "grupo": "Feeds",
      "desc": "Counts reflect the latest catalog update.",
      "retorno": "FacetasDeFeeds",
      "exemplo": "curl -s $ORIGIN/api/feeds/facets",
      "returns": "{ total, facetas, api }",
      "url": "https://agentalog.com/api/feeds/facets",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/feeds/:id",
      "auth": "none",
      "summary": "One feed: address, format, what it carries and where it was found.",
      "grupo": "Feeds",
      "desc": "The same record the HTML page at `/feeds/<id>` shows. 404 when the id is unknown.",
      "params": {
        "id": {
          "tipo": "string",
          "desc": "Feed id, prefix `fd_`.",
          "exemplo": "fd_nytimes_com_1a2b3c4d5e6f7a8b"
        }
      },
      "retorno": "Feed",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "No feed in this index has that id.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/feeds/fd_nytimes_com_1a2b3c4d5e6f7a8b",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ id, kind, dominio, url, nome, descricao, tipo, audio, video, comunidade, comunidades, ano, recursos, densidade, itens, saude, pais, site_titulo, site_descricao, site_nome, site_og, site_og_alt, site_cor, site_idioma, idioma_bandeira, icone, imagem, ultimo_post, posts_24h, posts_7d, posts_30d, posts_dias, posts_no_feed, posts_parcial, atividade_em, pagina, api }",
      "url": "https://agentalog.com/api/feeds/:id",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/feeds/:id/items",
      "auth": "none",
      "summary": "The posts of one feed, as our queue read them.",
      "grupo": "Feeds",
      "desc": "Up to 40 posts, in the order the feed publishes them, WITHOUT the body — the body of one post comes from `/items/:ord`. It is OUR copy, read on our own schedule — not the live feed and not a proxy: the only thing this endpoint accepts is an id from this index, never a URL. `lido_em` says when we read it. Empty list when the feed has not been read yet.",
      "params": {
        "id": {
          "tipo": "string",
          "desc": "Feed id, prefix `fd_`.",
          "exemplo": "fd_nytimes_com_1a2b3c4d5e6f7a8b"
        }
      },
      "retorno": "PostsDeFeed",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "No feed in this index has that id. A feed we know but have not read yet answers 200 with an empty `itens` — the two are different answers on purpose.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/feeds/fd_nytimes_com_1a2b3c4d5e6f7a8b/items",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ id, itens[{ord,tags,media,comentarios,comentarios_n,titulo,link,quando,autor,resumo,bytes}], lido_em, api }",
      "url": "https://agentalog.com/api/feeds/:id/items",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/feeds/:id/items/:ord",
      "auth": "none",
      "summary": "One post of a feed, with the body — the author's HTML and the same text in Markdown.",
      "grupo": "Feeds",
      "desc": "Two bodies for the same post, both from the copy we stored when we READ the feed — a request never fetches the site: `conteudo_html` keeps the author's formatting through an allowlist (only known tags and attributes survive; script, style, iframe and event handlers are dropped with their content), and `conteudo` is the same text as Markdown — the shape an agent usually wants. Neither can carry script. 404 when the feed or the position is unknown.",
      "params": {
        "id": {
          "tipo": "string",
          "desc": "Feed id, prefix `fd_`.",
          "exemplo": "fd_nytimes_com_1a2b3c4d5e6f7a8b"
        },
        "ord": {
          "tipo": "int",
          "desc": "Position of the post in the feed; 0 is the newest.",
          "exemplo": "0"
        }
      },
      "retorno": "PostDeFeedInteiro",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "Unknown feed id, or a position this feed does not have.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/feeds/fd_nytimes_com_1a2b3c4d5e6f7a8b/items/0",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ id, ord, titulo, link, quando, autor, resumo, conteudo_html, conteudo, lido_em, api }",
      "url": "https://agentalog.com/api/feeds/:id/items/:ord",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/indices",
      "auth": "none",
      "summary": "The MCP indexes this catalog reads: credit, license, what each measures, counts and the last round.",
      "grupo": "MCP indexes",
      "desc": "Each index measures something different — one completes an MCP handshake, another reads the last commit, another only discovers that a resource exists — so `mede` comes with every source and every signal. Collected once a day on our own host, raw data kept, and credited on every response: the data is theirs. `coleta.falhou` says the last round failed; the error text stays private.",
      "retorno": "ListaDeIndices",
      "exemplo": "curl -s $ORIGIN/api/indices",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "returns": "{ ok, indices[{id,nome,url,licenca,mede,cadencia_h,sinais,no_catalogo,por_estado,coleta,_links}], _links }",
      "url": "https://agentalog.com/api/indices",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/indices/sinais",
      "auth": "none",
      "summary": "What each MCP index says about one listing of this catalog.",
      "grupo": "MCP indexes",
      "desc": "A signal belongs to a listing only when it is the SAME object: the name in the official MCP registry, the exact remote endpoint URL or the GitHub `owner/repo`, in that order. A shared domain never matches — two servers on one host are different products. Up to 20 signals, one per index and record.",
      "query": {
        "listing": {
          "tipo": "string",
          "desc": "Listing id from `/api/listings`.",
          "exemplo": "mcp_com_stripe_mcp_b890f1d0",
          "obrigatorio": true
        }
      },
      "retorno": "SinaisDoRegistro",
      "erros": {
        "400": "`listing` is missing.",
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s '$ORIGIN/api/indices/sinais?listing=mcp_com_stripe_mcp_b890f1d0'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ ok, listing, count, sinais[{fonte,credito,mede,kind,nome,descricao,url,repo,estado,estado_na_fonte,motivo,acesso,detalhe,ficha_na_fonte,no_catalogo,medido_em,visto_em}], _links }",
      "url": "https://agentalog.com/api/indices/sinais",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/indices/itens",
      "auth": "none",
      "colecao": {
        "porPagina": 50,
        "anda": "offset"
      },
      "summary": "Browse the signals, including servers this catalog does not list yet.",
      "grupo": "MCP indexes",
      "desc": "Newest change first. `casou=0` is what the indexes know and the catalog does not — the list to look at before submitting a server. Filters are AND'd. With `q`, `total` is the exact number of matches, including when the requested page is empty.",
      "query": {
        "fonte": {
          "tipo": "string",
          "desc": "Only the signals of this index — `/api/indices` says what each one measures.",
          "valores": [
            "wellknown",
            "agent_tools",
            "nerq",
            "truespar",
            "neuronto",
            "paygent",
            "hultra"
          ]
        },
        "estado": {
          "tipo": "string",
          "desc": "The state in this catalog's words.",
          "valores": [
            "vivo",
            "fora",
            "parado",
            "abandonado",
            "apagado",
            "desconhecido"
          ]
        },
        "casou": {
          "tipo": "string",
          "desc": "`1` only signals matched to a listing, `0` only unmatched.",
          "valores": [
            "0",
            "1"
          ]
        },
        "q": {
          "tipo": "string",
          "desc": "Substring of the name, the URL or the repository.",
          "exemplo": "postgres"
        },
        "limit": {
          "tipo": "int",
          "desc": "Signals per page, 1–50.",
          "padrao": 20
        },
        "offset": {
          "tipo": "int",
          "desc": "Offset, capped at 50000.",
          "padrao": 0
        }
      },
      "retorno": "PaginaDeSinais",
      "exemplo": "curl -s '$ORIGIN/api/indices/itens?fonte=truespar&estado=fora&casou=1&limit=5'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "returns": "{ ok, total, count, items[{fonte,credito,mede,kind,nome,descricao,url,repo,estado,estado_na_fonte,motivo,acesso,detalhe,ficha_na_fonte,no_catalogo,medido_em,visto_em}], _links }",
      "url": "https://agentalog.com/api/indices/itens",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/check",
      "auth": "none",
      "summary": "Check an MCP server address before installing it: what we already measured about it, without visiting it.",
      "grupo": "Catalog",
      "desc": "Send the endpoint URL. The answer never contacts that address: it reads what our weekly visits measured and what our domain data knows. `sinais_do_endereco` comes from the address alone (consumer tunnel, `http://` without TLS). `registros` lists the catalog listings with this exact address first (`exato: true`), then up to 20 others on the same host, each with its level and signals; `mesmo_host` counts them all. `dominio` has the facts about the host's domain. An address outside the catalog answers `no_catalogo: false` and `registrar`: submit it to get it reviewed. Cached for 5 minutes.",
      "query": {
        "url": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "The http(s) endpoint of the MCP server, without credentials.",
          "exemplo": "https://agentalog.com/mcp"
        }
      },
      "retorno": "Checagem",
      "erros": {
        "400": "Missing, invalid or credential-bearing `url`.",
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s '$ORIGIN/api/check?url=https%3A%2F%2Fagentalog.com%2Fmcp'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ url, host, no_catalogo, sinais_do_endereco, registros, mesmo_host, dominio, registrar, api }",
      "url": "https://agentalog.com/api/check",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/listings/:id/security",
      "auth": "none",
      "summary": "Security review of a remote MCP server or SKILL.md: level, measured signals, evidence and changes.",
      "grupo": "Catalog",
      "desc": "We visit remote MCP servers: `initialize` and `tools/list`, without credentials or tool calls, again 7 days after a success. A failure needs a second check. MCP signals: dns_morto, sem_https, tls_invalido, tunel, nao_responde, nao_mcp, texto_suspeito, redireciona_fora, repo_arquivado, repo_parado, dominio_recente, login, bloqueado. For skills, `tipo: skill` identifies a static SKILL.md review. It flags secret reads, download-and-execute commands, external uploads, invisible characters, long encoded text and broad allowed-tools. `revisao.achados` supplies the path, original line, excerpt and context. Examples and prohibitions do not raise the level. Excerpts hide sensitive values. The review does not run commands or follow references. Supported source: public raw.githubusercontent.com SKILL.md. Watched, visited, starred and new skills get priority within the shared GitHub governor and a daily cap. Unread or unsupported skills remain explicitly unchecked. Local MCP servers and plugins answer `nao_remoto`. No request fetches a third-party source. Cached for 5 minutes.",
      "params": {
        "id": {
          "desc": "Listing ID, from `Anuncio.id`."
        }
      },
      "query": {
        "lang": {
          "tipo": "string",
          "desc": "Language of the `aviso` sentence: `en` (default) or `pt`.",
          "exemplo": "pt"
        }
      },
      "retorno": "Seguranca",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "The listing does not exist or is not visible.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/listings/ID/security",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ id, conferido, motivo?, nivel, tipo?, revisao?, fonte?, caminho?, vigiavel?, sinais, servidor?, dominio?, ferramentas?, verificado_em?, proxima_em?, mudou_em?, eventos?, aviso, api }",
      "url": "https://agentalog.com/api/listings/:id/security",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/listings/:id/tools",
      "auth": "none",
      "summary": "The tools and instructions a remote MCP server announced at its last check.",
      "grupo": "Catalog",
      "desc": "The announced manifest, normalized: each tool's name, title, description (up to 4,000 characters), input schema (null above 8,000 characters) and protocol annotations, plus the server instructions. `capacidades` and `suspeitas` come from the current rules, applied when you read. Reading this endpoint never contacts the server. Cached for 5 minutes.",
      "params": {
        "id": {
          "desc": "Listing ID, from `Anuncio.id`."
        }
      },
      "retorno": "FerramentasAnunciadas",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "The listing does not exist or is not visible (`not_found`), or its tools were not read yet (`tools_not_read`).",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/listings/ID/tools",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ id, sha, verificado_em, mudou_em, instrucoes, ferramentas, capacidades, suspeitas, api }",
      "url": "https://agentalog.com/api/listings/:id/tools",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/me/vigia",
      "auth": "session_ou_carteira",
      "summary": "The MCP servers and skills you watch, with the current review, your slots and the plans.",
      "grupo": "Watch",
      "desc": "Daily checks cover MCP tools, state, level, country and version. Supported skills cover changes in SKILL.md text and review signals. Source quotas can delay a check; read proxima_em and verificado_em. The e-mail goes to the verified account address and includes an unsubscribe link. Wallet-only owners follow changes through the API.",
      "retorno": "Vigia",
      "erros": {
        "401": "Sign in with your account, or send the wallet credential (`Authorization: Bearer mmw_…`)."
      },
      "exemplo": "curl -s $ORIGIN/api/me/vigia -H \"Cookie: __Host-mm-auth=…\"",
      "returns": "{ itens, cota, planos, claude_code, api }",
      "url": "https://agentalog.com/api/me/vigia",
      "auth_detail": "The global account (the session cookie of this domain), or, for an agent without an account, the wallet credential in `Authorization: Bearer mmw_…` (`POST /api/auth/wallet/agent/start`, sign, `POST /api/auth/wallet/agent/token`). The wallet follows its watches through the API; the change e-mail goes only to an account."
    },
    {
      "method": "POST",
      "path": "/api/me/vigia",
      "auth": "session_ou_carteira",
      "summary": "Watch a remote MCP or supported SKILL.md. Uses a free slot; without one, answers 402 for another slot.",
      "grupo": "Watch",
      "desc": "Choose a live remote MCP or a skill with a supported public raw.githubusercontent.com SKILL.md, after skill collection is enabled. Unsupported skills are rejected before payment. Watching again is a no-op (`ja_vigiado`). Pay the 402 with x402 or prepaid credit and repeat the request. Slots last 30 days with no automatic renewal. Skills do not enter the Claude Code MCP allowlist.",
      "corpo": {
        "listing_id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Listing ID (`mcp_…` or `skl_…`) from `/api/listings`."
        }
      },
      "body": {
        "listing_id": "mcp_io_github_upstash_context7_d016de0d"
      },
      "retorno": "VigiaAlterada",
      "erros": {
        "400": "Invalid JSON, unavailable skill review, unsupported source or a listing that cannot be watched (`nao_vigiavel`).",
        "401": "Sign in with your account, or send the wallet credential (`Authorization: Bearer mmw_…`).",
        "402": "No free slot: pay for one more.",
        "403": "Missing or invalid X-CSRF-Token.",
        "409": "Expired passes leave paused tools in the list. Stop watching one or buy slots before adding another tool. A concurrent request can also use the last slot; refresh the list and retry."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/me/vigia -H \"Content-Type: application/json\" -H \"X-CSRF-Token: $CSRF\" -d '{\"listing_id\":\"mcp_…\"}'",
      "returns": "{ ok, id?, ja_vigiado?, cota }",
      "url": "https://agentalog.com/api/me/vigia",
      "auth_detail": "The global account (the session cookie of this domain), or, for an agent without an account, the wallet credential in `Authorization: Bearer mmw_…` (`POST /api/auth/wallet/agent/start`, sign, `POST /api/auth/wallet/agent/token`). The wallet follows its watches through the API; the change e-mail goes only to an account."
    },
    {
      "method": "DELETE",
      "path": "/api/me/vigia/:id",
      "auth": "session_ou_carteira",
      "summary": "Stop watching a tool; its slot becomes free.",
      "grupo": "Watch",
      "params": {
        "id": {
          "desc": "Listing ID (`mcp_…` or `skl_…`)."
        }
      },
      "retorno": "VigiaAlterada",
      "erros": {
        "401": "Sign in with your account, or send the wallet credential (`Authorization: Bearer mmw_…`).",
        "404": "The listing is not in your watch list."
      },
      "exemplo": "curl -s -XDELETE $ORIGIN/api/me/vigia/mcp_… -H \"X-CSRF-Token: $CSRF\"",
      "returns": "{ ok, id?, ja_vigiado?, cota }",
      "url": "https://agentalog.com/api/me/vigia/:id",
      "auth_detail": "The global account (the session cookie of this domain), or, for an agent without an account, the wallet credential in `Authorization: Bearer mmw_…` (`POST /api/auth/wallet/agent/start`, sign, `POST /api/auth/wallet/agent/token`). The wallet follows its watches through the API; the change e-mail goes only to an account."
    },
    {
      "method": "GET",
      "path": "/api/plans",
      "auth": "none",
      "summary": "The plans for sale and the authenticated account or wallet's active plan.",
      "desc": "Each purchase lasts 30 days, with no automatic renewal. Without an account or wallet credential, `account` is `null`.",
      "grupo": "Watch",
      "query": {
        "resumo": {
          "tipo": "string",
          "obrigatorio": false,
          "desc": "Use `1` to read the active plan without cancellation, retention and refund details.",
          "exemplo": "1"
        }
      },
      "retorno": {
        "plans": {
          "tipo": "object[]",
          "desc": "Each plan: `id`, `name`, `watched_tools`, `days`, `price_usd`, `automatic_renewal`, `charged_now` and the `buy` URL."
        },
        "account": {
          "tipo": "object",
          "desc": "`active` (the plan that ends last, with `valid_until`) and `cancel` (what cancelling now removes, the free-days offer and the refund).",
          "nulo": true
        }
      },
      "erros": {
        "401": "session_ended",
        "503": "auth_unavailable"
      },
      "exemplo": "curl -s $ORIGIN/api/plans",
      "returns": "{ plans, account }",
      "url": "https://agentalog.com/api/plans",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/plans/:plan",
      "auth": "none",
      "summary": "Buys a plan for the account or paying wallet.",
      "desc": "Each purchase lasts 30 days, with no automatic renewal. Without payment, the answer is 402 with the price. Pay with prepaid credit (`X-Credito`) or x402 (`PAYMENT-SIGNATURE` v2 or `X-PAYMENT` v1). Without an account, the verified paying wallet owns the purchase. Use wallet agent authentication to read its plan, or claim it after account sign-in. The `compra` mark prevents repeat credit debits. An x402 nonce can settle only once; keep the receipt after a delivery error.",
      "grupo": "Watch",
      "params": {
        "plan": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "`vaga` (1 more tool), `equipe` (50 more tools and up to 10 private projects), `empresa` (500 more tools and up to 10 private projects)",
          "exemplo": "vaga"
        }
      },
      "query": {
        "compra": {
          "tipo": "string",
          "obrigatorio": false,
          "desc": "Mark of one credit purchase, 8 to 64 letters, digits, `-` or `_`. Repeating it with the same credit token does not debit again.",
          "exemplo": "purchase-2026-10-12"
        }
      },
      "retorno": {
        "plan": {
          "tipo": "string",
          "desc": "The plan bought."
        },
        "watched_tools_added": {
          "tipo": "number",
          "desc": "Units granted by this purchase."
        },
        "valid_until": {
          "tipo": "string",
          "desc": "When this purchase ends (ISO 8601)."
        },
        "automatic_renewal": {
          "tipo": "bool",
          "desc": "`false` for Pix, USDC and credit."
        },
        "account": {
          "tipo": "object",
          "desc": "The active plan for the owner; `null` if its summary is unavailable.",
          "nulo": true
        },
        "_links": {
          "tipo": "object",
          "desc": "Plans URL and, for a wallet purchase, wallet authentication and claim URLs."
        }
      },
      "erros": {
        "401": "An explicit account, wallet or credit credential was refused.",
        "402": "Payment required: the price and the accepted payments.",
        "403": "Writes with the account cookie need the same Origin and `X-CSRF-Token`.",
        "404": "Unknown plan (`unknown_plan`).",
        "409": "Plans are not on sale now (`sales_closed`) or billing is off (`billing_off`)."
      },
      "exemplo": "curl -s -X POST \"$ORIGIN/api/plans/vaga?compra=purchase-2026-10-12\" -H \"X-CSRF-Token: $CSRF\" -H \"X-Credito: $CREDITO\" -b \"$COOKIE\"",
      "returns": "{ plan, watched_tools_added, valid_until, automatic_renewal, account, _links }",
      "url": "https://agentalog.com/api/plans/:plan",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/plans/cancel",
      "auth": "session",
      "summary": "Cancels the active plan now: the monthly card subscription stops, and a purchase under 7 days is refunded.",
      "desc": "Send `{ \"accept_data_removal\": true }`: what the plan added ends now (`account.cancel.losses` in `GET /api/plans` says what), including a period already paid that has not started yet, such as a renewal. A purchase made less than 7 days ago and a paid period that has not started go back the same way they were paid (card or Pix); USDC is refunded by the team.",
      "grupo": "Watch",
      "corpo": {
        "accept_data_removal": {
          "tipo": "bool",
          "obrigatorio": true,
          "desc": "Must be `true`: you accept losing what the plan added."
        }
      },
      "body": {
        "accept_data_removal": true
      },
      "retorno": {
        "canceled": {
          "tipo": "bool",
          "desc": "`true` when a valid plan ended."
        },
        "refund": {
          "tipo": "object",
          "desc": "`method` (`original`, `manual` or `none`), `amount_cents` and its `currency` (`brl` when Asaas refunds, `usd` when Stripe refunds; `null` when both do).",
          "nulo": true
        },
        "account": {
          "tipo": "object",
          "desc": "The account state after cancelling, as in `GET /api/plans`."
        }
      },
      "erros": {
        "400": "Missing `accept_data_removal: true` (`confirmation_required`).",
        "401": "Sign in first (`account_required`), or the session ended (`session_ended`).",
        "403": "Writes with the account cookie need the same Origin and `X-CSRF-Token`."
      },
      "exemplo": "curl -s -X POST $ORIGIN/api/plans/cancel -H \"Content-Type: application/json\" -H \"X-CSRF-Token: $CSRF\" -b \"$COOKIE\" -d '{\"accept_data_removal\":true}'",
      "returns": "{ canceled, refund, account }",
      "url": "https://agentalog.com/api/plans/cancel",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/plans/:plan/grace",
      "auth": "session",
      "summary": "Takes the free-days offer from the cancellation: the offered plan, free for 7 days, once per account.",
      "desc": "`account.cancel.offer` in `GET /api/plans` says which plan and for how long. Nothing renews by itself.",
      "grupo": "Watch",
      "params": {
        "plan": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "`vaga` (1 more tool), `equipe` (50 more tools and up to 10 private projects), `empresa` (500 more tools and up to 10 private projects)",
          "exemplo": "vaga"
        }
      },
      "retorno": {
        "plan": {
          "tipo": "string",
          "desc": "The plan granted."
        },
        "valid_until": {
          "tipo": "string",
          "desc": "When the free days end."
        },
        "price_usd": {
          "tipo": "number",
          "desc": "Always `0`."
        },
        "account": {
          "tipo": "object",
          "desc": "The account state after the offer, as in `GET /api/plans`."
        }
      },
      "erros": {
        "401": "Sign in first (`account_required`), or the session ended (`session_ended`).",
        "403": "Writes with the account cookie need the same Origin and `X-CSRF-Token`.",
        "404": "Unknown plan (`unknown_plan`).",
        "409": "No offer for this account or plan (`offer_unavailable`)."
      },
      "exemplo": "curl -s -X POST $ORIGIN/api/plans/vaga/grace -H \"X-CSRF-Token: $CSRF\" -b \"$COOKIE\"",
      "returns": "{ plan, valid_until, price_usd, account }",
      "url": "https://agentalog.com/api/plans/:plan/grace",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/me/vigia/claude-code",
      "auth": "session_ou_carteira",
      "summary": "Your watch list as Claude Code managed settings: an allowlist of the servers you watch, a denylist of the ones at risk.",
      "grupo": "Watch",
      "desc": "`managed_settings` goes into a Claude Code managed settings source (see `docs`). `allowManagedMcpServersOnly` restricts user-added servers to this list. Checked servers rated as `risco` go to `deniedMcpServers`. The exact URL and that URL followed by `?*` permit the checked route with optional query parameters. Expired or unchecked items stay out. `comandos` has one quoted `claude mcp add` command per allowed server.",
      "retorno": "ListaClaudeCode",
      "erros": {
        "401": "Sign in with your account, or send the wallet credential (`Authorization: Bearer mmw_…`)."
      },
      "exemplo": "curl -s $ORIGIN/api/me/vigia/claude-code -H \"Cookie: __Host-mm-auth=…\"",
      "returns": "{ managed_settings, comandos, fora, aviso, docs, api }",
      "url": "https://agentalog.com/api/me/vigia/claude-code",
      "auth_detail": "The global account (the session cookie of this domain), or, for an agent without an account, the wallet credential in `Authorization: Bearer mmw_…` (`POST /api/auth/wallet/agent/start`, sign, `POST /api/auth/wallet/agent/token`). The wallet follows its watches through the API; the change e-mail goes only to an account."
    },
    {
      "method": "GET",
      "path": "/api/monitor/projetos",
      "auth": "session",
      "grupo": "Installed agents",
      "summary": "List your private agent projects and their human labels.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Basic accounts can create three projects. An active Team or Business pass permits ten, with three active installations per project. The response includes current limits and their expiry. After the pass ends, existing projects remain readable and exportable. Archived references and decisions are read only. New projects and installation credentials return to basic capacity. Separate single-slot purchases do not combine into this benefit. A guest or a wide API key cannot read projects.",
      "retorno": {
        "projetos": {
          "tipo": "object[]",
          "desc": "Owned projects: id, nome, criado_em (Unix seconds) and apagando (pending erasure)."
        },
        "limites": {
          "tipo": "object",
          "desc": "Current capacity: projetos (3 or 10), instalacoes (3), expira_em (Unix seconds or null)."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/projetos\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ projetos, limites }",
      "url": "https://agentalog.com/api/monitor/projetos",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos",
      "auth": "session",
      "grupo": "Installed agents",
      "summary": "Create a private project with a retry ID and a short label.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Use the same ID on retry. A replay keeps the original name and performs no new domain write. Labels must not contain local paths, control characters or secrets.",
      "corpo": {
        "id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "32 lower-case hexadecimal characters, generated once per creation attempt."
        },
        "nome": {
          "tipo": "string",
          "desc": "A short human label, from 1 to 80 characters. No file path or secret."
        }
      },
      "retorno": {
        "id": {
          "tipo": "string",
          "desc": "The created or already owned project ID."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:JSON.stringify({id:crypto.randomUUID().replaceAll(\"-\",\"\"),nome:\"Build agent\"})});",
      "exemploLinguagem": "js",
      "returns": "{ id }",
      "url": "https://agentalog.com/api/monitor/projetos",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/instalacoes",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Issue one installation credential for this private project.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Requires authentication within five minutes and exact empty JSON. The secret is returned once; store its download privately with mode 0600. At most three active installations per project. If the account exceeds its current project capacity, renew the pass or delete excess projects before issuance. A new token expires within 30 days or at the active pass end, whichever comes first. It cannot approve, buy, create a project or issue another credential.",
      "corpo": {},
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "Credential contract version: credencial-1."
        },
        "projeto": {
          "tipo": "string",
          "desc": "The credential's single private project."
        },
        "instalacao": {
          "tipo": "string",
          "desc": "The credential's single installation ID."
        },
        "token": {
          "tipo": "string",
          "desc": "Private mmi_ bearer secret, returned only by this issuance response."
        },
        "expira_em": {
          "tipo": "int",
          "desc": "Expiry timestamp in Unix seconds."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/instalacoes\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:JSON.stringify({})});",
      "exemploLinguagem": "js",
      "returns": "{ esquema, projeto, instalacao, token, expira_em }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/instalacoes",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/monitor/projetos/:projeto/inventario",
      "summary": "Read the received inventory for your active installations.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Installation metadata and the preserved normalized reference. Null inventory means no reference has arrived. A partial scan does not remove prior items. Receiving metadata does not approve a tool or prove execution. With historico=1, return at most three current-epoch references: active installations first, then the most recent archived installations. Archived entries have ativa=false and are read only. This option does not authorize sends, links, approvals or signed policies. References become eligible for cleanup 45 days after credential expiry.",
      "query": {
        "historico": {
          "tipo": "int",
          "desc": "Optional. Use exactly 1 to include archived references."
        }
      },
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "Received inventory state contract: estado-remoto-1."
        },
        "projeto": {
          "tipo": "string",
          "desc": "The owned private project."
        },
        "instalacoes": {
          "tipo": "object[]",
          "desc": "At most three current-epoch installations: id, expira_em, confirmado_em and inventario. historico=1 also includes ativa. No secret."
        }
      },
      "exemploLinguagem": "js",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/inventario?historico=1\", {credentials: \"same-origin\"}).then(r => r.json());",
      "returns": "{ esquema, projeto, instalacoes }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/inventario",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/monitor/projetos/:projeto/vigias",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Read explicit inventory links and your active catalog watches.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. At most three current-epoch installations, 500 links per installation and 1,000 watches. Only the signed-in owner can read these links. A watch ID or inventory name does not prove that the tools match. An expired watch leaves its link inactive.",
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "Link state contract: vigias-inventario-1."
        },
        "projeto": {
          "tipo": "string",
          "desc": "The owned private project."
        },
        "alvos": {
          "tipo": "object[]",
          "desc": "Active owned catalog watches: id and valido_ate (expiry in Unix seconds). No private account information."
        },
        "instalacoes": {
          "tipo": "object[]",
          "desc": "Active installations: id and vinculos. Each link has item, alvo and ativa. No credential."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/vigias\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ esquema, projeto, alvos, instalacoes }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/vigias",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/vigias",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Link one received inventory item to an existing watch, or remove its link.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Requires the human account cookie and CSRF. Installation tokens and wide API keys cannot select watches. The item must be present in this active installation. The watch must already be active and owned by the account. Set alvo to null to remove a link, including after item removal. An exact retry writes nothing. Changed links share the global 512 registrations per day. This creates no watch, charge or approval.",
      "corpo": {
        "instalacao": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Owned installation ID: 32 lower-case hexadecimal characters."
        },
        "item": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Received inventory item ID: 64 lower-case hexadecimal characters."
        },
        "alvo": {
          "tipo": "string",
          "obrigatorio": true,
          "nulo": true,
          "desc": "Existing watch ID, or null to remove the link."
        }
      },
      "retorno": {
        "vinculado": {
          "tipo": "bool",
          "desc": "True when linked; false when the link is absent."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "Inventory is absent, the selected watch is inactive or the link limit is reached.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/vigias\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:JSON.stringify({instalacao:\"INSTALLATION_ID\",item:\"ITEM_ID\",alvo:\"WATCH_ID\"})});",
      "exemploLinguagem": "js",
      "returns": "{ vinculado }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/vigias",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/monitor/projetos/:projeto/eventos",
      "auth": "session_ou_monitor_reader",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Read committed inventory changes and native actions after a private project cursor.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Use the account cookie or, when configured, an mmq_ bearer reader for this project. Installation tokens cannot read the project cursor. Do not mix the reader with cookies or X-API-Key. Keyset pagination, up to five batches and 4 MiB per response. Store the returned cursor; the next page retains any batch omitted by the byte limit. Zero starts at available history. Future cursors fail. Expired history returns 410 with cursor_inicial; it is not an empty unchanged result. Events become eligible for deletion after 45 days. Reread the same page to check current notice state without creating another event or send.",
      "query": {
        "desde": {
          "tipo": "int",
          "desc": "Last confirmed project cursor. Start with zero."
        },
        "limite": {
          "tipo": "int",
          "desc": "Maximum batches per response, from 1 to 5."
        }
      },
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "Cursor response contract: eventos-inventario-1."
        },
        "projeto": {
          "tipo": "string",
          "desc": "The owned private project."
        },
        "itens": {
          "tipo": "EventoMonitor[]",
          "desc": "Committed inventory batches. evento-inventario-2 also contains up to 64 native metadata actions. Attempts, observed outcomes and monitor failures remain distinct. Notice state is current read metadata, not part of the committed event or an approval. Provider acceptance does not prove inbox delivery."
        },
        "cursor": {
          "tipo": "int",
          "desc": "Cursor to store after consuming this response. An empty page marks the current end."
        },
        "anterior_expirado": {
          "tipo": "bool",
          "desc": "True when starting at zero omitted already expired history. Report the coverage gap."
        },
        "avisos_ativos": {
          "tipo": "bool",
          "desc": "True when the durable notice queue is configured. False means notice state is unavailable. It does not prove that account mail is enabled."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "410": "History expired. Read cursor_inicial and report the coverage gap.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/eventos?desde=0&limite=5\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ esquema, projeto, itens[{esquema,numero,instalacao,lote,sequencia,quando,cobertura,cobertura_alertas?,mudancas,acoes?,vigias?,aviso}], cursor, anterior_expirado, avisos_ativos }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/eventos",
      "auth_detail": "The existing human account cookie, or a separate mmq_ bearer credential for one project's event GET. Do not mix the reader with cookies or X-API-Key. Account status, security version, expiry and revocation are checked on each use."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/instalacoes/:instalacao/revogar",
      "auth": "session",
      "grupo": "Installed agents",
      "summary": "Revoke one installation credential without changing local files.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. A repeated revocation is idempotent. New sends with this credential fail. This does not stop or uninstall the local agent, erase local state or reset the project's cursor.",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        },
        "instalacao": {
          "desc": "An installation ID inside this owned project."
        }
      },
      "corpo": {},
      "retorno": {
        "revogada": {
          "tipo": "bool",
          "desc": "True once the credential is revoked."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/instalacoes/INSTALLATION_ID/revogar\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:JSON.stringify({})});",
      "exemploLinguagem": "js",
      "returns": "{ revogada }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/instalacoes/:instalacao/revogar",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/excluir",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Delete an owned project and its private monitor data.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Requires authentication within five minutes, CSRF and exact empty JSON. Stop all project credentials immediately. Remove at most 64 events and 64 installations per call. Pending erasure resumes hourly, including after account deactivation. Local files, legacy watches and purchased credits remain. Installation tokens cannot erase a project.",
      "corpo": {},
      "retorno": {
        "excluido": {
          "tipo": "bool",
          "desc": "True when the project and all its private records are gone."
        },
        "pendente": {
          "tipo": "bool",
          "desc": "True while bounded erasure must continue. New sends remain disabled."
        },
        "eventos": {
          "tipo": "int",
          "desc": "Events removed in this batch, at most 64."
        },
        "instalacoes": {
          "tipo": "int",
          "desc": "Installations removed in this batch, at most 64."
        },
        "acoes": {
          "tipo": "int",
          "desc": "Native action IDs removed, at most 64. Optional."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/excluir\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:JSON.stringify({})});",
      "exemploLinguagem": "js",
      "returns": "{ excluido, pendente, eventos, instalacoes, acoes }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/excluir",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/monitor/instalacao",
      "auth": "monitor_installation",
      "grupo": "Installed agents",
      "summary": "Check the narrow credential and its confirmed remote reference.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. The fixed client authority is https://api.agentalog.com. This route returns no inventory, owner information or secret. Account epoch, revocation and expiry are checked on every call. A read does not update presence.",
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "Reference contract: instalacao-remota-1."
        },
        "projeto": {
          "tipo": "string",
          "desc": "The credential's single project."
        },
        "instalacao": {
          "tipo": "string",
          "desc": "The credential's installation."
        },
        "sequencia": {
          "tipo": "int",
          "desc": "Last committed installation sequence, zero before the first batch."
        },
        "lote": {
          "tipo": "string",
          "desc": "Last committed batch ID, null before the first batch.",
          "nulo": true
        },
        "expira_em": {
          "tipo": "int",
          "desc": "Credential expiry timestamp in Unix seconds."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "curl --fail -H \"Authorization: Bearer INSTALLATION_TOKEN\" \"$ORIGIN/api/monitor/instalacao\"",
      "returns": "{ esquema, projeto, instalacao, sequencia, lote, expira_em }",
      "url": "https://agentalog.com/api/monitor/instalacao",
      "auth_detail": "Private mmi_ credential in Authorization: Bearer, restricted to one installation and project. The account issues it after recent human sign-in. It cannot approve, buy or issue another credential."
    },
    {
      "method": "POST",
      "path": "/api/monitor/inventario",
      "auth": "monitor_installation",
      "grupo": "Installed agents",
      "summary": "Commit one bounded private inventory batch and return its receipt.",
      "desc": "Private and no-store. No catalog quota, paid read, public cache or CORS grant. Send only a persisted lote-1 or lote-2 body from the client outbox. lote-1 has no actions; lote-2 requires 1 to 64 distinct actions and the optional action receiver. The server checks the sequence and preceding ID, preserves incomplete sources and acknowledges after commit. Exact replays return the same receipt without an extra event or budget debit. Native IDs are deduplicated across batches. A changed action under the same ID returns 409. New actions share the global 512 registrations per day. Extra fields, raw URLs, local paths and raw arguments fail. Global limit: 256 batches and 32 MiB logical bytes per day. Per installation: 20 batches per day and 600 before expiry.",
      "corpo": {
        "esquema": {
          "tipo": "string",
          "obrigatorio": true,
          "valores": [
            "lote-1",
            "lote-2"
          ],
          "desc": "Persisted batch version. lote-2 requires the optional native action receiver."
        },
        "id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Persisted 64-character batch ID. Keep it unchanged on retry."
        },
        "sequencia": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Next positive installation sequence, in order."
        },
        "anterior": {
          "tipo": "string",
          "obrigatorio": true,
          "nulo": true,
          "desc": "Previous persisted batch ID, null for the first batch."
        },
        "inventario": {
          "tipo": "object",
          "obrigatorio": true,
          "desc": "Normalized inventario-1 from the client: agente, itens and cobertura. Item types: mcp, skill, plugin, dependencia or configuracao. Configuration contains only its hash, fixed categories and selected destination domains. Maximum 500 items and 1 MiB."
        },
        "acoes": {
          "tipo": "AcaoMonitor[]",
          "desc": "Required only for lote-2; forbidden in lote-1. From 1 to 64 distinct native metadata events. No prompts, transcripts, raw arguments, local paths or output text."
        }
      },
      "retorno": {
        "id": {
          "tipo": "string",
          "desc": "Exactly the submitted batch ID."
        },
        "sequencia": {
          "tipo": "int",
          "desc": "Exactly the submitted installation sequence."
        },
        "numero": {
          "tipo": "int",
          "desc": "Committed project cursor assigned under its transaction lock."
        }
      },
      "erros": {
        "400": "Invalid field, cursor or bounded request body.",
        "401": "A valid account session or installation credential is required.",
        "403": "Origin or CSRF proof is invalid for a human write.",
        "404": "The project or installation does not belong to this account.",
        "409": "The project, installation or sequence limit prevents the operation.",
        "429": "The daily budget is exhausted. Preserve pending local batches.",
        "503": "Monitoring is unavailable. Preserve the previous state and retry."
      },
      "exemplo": "curl --fail -H \"Authorization: Bearer INSTALLATION_TOKEN\" -H \"Content-Type: application/json\" --data-binary @lote.json \"$ORIGIN/api/monitor/inventario\"",
      "returns": "{ id, sequencia, numero }",
      "url": "https://agentalog.com/api/monitor/inventario",
      "auth_detail": "Private mmi_ credential in Authorization: Bearer, restricted to one installation and project. The account issues it after recent human sign-in. It cannot approve, buy or issue another credential."
    },
    {
      "method": "GET",
      "path": "/api/monitor/projetos/:projeto/consultas",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "List your project's event readers without their secrets.",
      "desc": "Private, no-store and no CORS grant. The optional project event reader must be configured. Installation tokens and wide API keys cannot manage readers. At most 64 records. No last-used tracking or write on read.",
      "retorno": {
        "consultas": {
          "tipo": "object[]",
          "desc": "Reader id, criado_em, expira_em (Unix seconds) and ativa. No token or digest."
        }
      },
      "erros": {
        "400": "Unknown field or invalid bounded request.",
        "401": "Sign in with the existing account. Issuance and revocation require authentication within five minutes.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The project or reader does not belong to this account.",
        "409": "Three active or 64 retained readers already exist in this project.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "The optional reader or current account authorization is unavailable."
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/consultas\", {credentials:\"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ consultas }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/consultas",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/consultas",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Issue one credential to read this project's event cursor.",
      "desc": "Private, no-store and no CORS grant. The optional project event reader must be configured. Installation tokens and wide API keys cannot manage readers. Requires recent authentication, CSRF and exact empty JSON. Return the secret once. Store it privately with mode 0600. At most three active readers per project. The mmq_ credential expires after 30 days and only permits GET /api/monitor/projetos/:projeto/eventos. It cannot ingest, approve, buy or issue credentials. A timeout can leave an issued reader without its secret; list and revoke it before another issuance.",
      "corpo": {},
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "Credential contract: consulta-inventario-1."
        },
        "consulta": {
          "tipo": "string",
          "desc": "Reader ID, 32 lower-case hexadecimal characters."
        },
        "projeto": {
          "tipo": "string",
          "desc": "The credential's single private project."
        },
        "token": {
          "tipo": "string",
          "desc": "Private mmq_ bearer secret. Returned only on issuance."
        },
        "expira_em": {
          "tipo": "int",
          "desc": "Credential expiry timestamp in Unix seconds."
        }
      },
      "erros": {
        "400": "Unknown field or invalid bounded request.",
        "401": "Sign in with the existing account. Issuance and revocation require authentication within five minutes.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The project or reader does not belong to this account.",
        "409": "Three active or 64 retained readers already exist in this project.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "The optional reader or current account authorization is unavailable."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/consultas\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:\"{}\"});",
      "exemploLinguagem": "js",
      "returns": "{ esquema, consulta, projeto, token, expira_em }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/consultas",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/consultas/:consulta/revogar",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        },
        "consulta": {
          "desc": "Reader ID inside this owned project."
        }
      },
      "summary": "Revoke one project event reader.",
      "desc": "Private, no-store and no CORS grant. The optional project event reader must be configured. Installation tokens and wide API keys cannot manage readers. Requires recent authentication, CSRF and exact empty JSON. Repeated revocation does not write. An already expired or invalidated reader remains inactive without another write. This preserves inventory, events, local files and purchased rights.",
      "corpo": {},
      "retorno": {
        "revogada": {
          "tipo": "bool",
          "desc": "True when this credential can no longer read events."
        }
      },
      "erros": {
        "400": "Unknown field or invalid bounded request.",
        "401": "Sign in with the existing account. Issuance and revocation require authentication within five minutes.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The project or reader does not belong to this account.",
        "409": "Three active or 64 retained readers already exist in this project.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "The optional reader or current account authorization is unavailable."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/consultas/READER_ID/revogar\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:\"{}\"});",
      "exemploLinguagem": "js",
      "returns": "{ revogada }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/consultas/:consulta/revogar",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/monitor/projetos/:projeto/webhooks",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Read your project's webhook status and recent delivery results.",
      "desc": "Private, no-store and no CORS grant. Requires the configured optional webhook service. Only the human account owner can manage destinations. Installation tokens and API keys are refused. At most 16 destination records and ten delivery records. Returns the domain without the URL path or signing key. Reads perform no write.",
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "webhooks-inventario-1."
        },
        "destinos": {
          "tipo": "object[]",
          "desc": "Scoped ID, domain, active state and Unix creation, expiry and revocation times."
        },
        "envios": {
          "tipo": "object[]",
          "desc": "Scoped delivery and webhook IDs, event number or null for the test, state, attempts, Unix times and optional HTTP status. No remote response body."
        }
      },
      "erros": {
        "400": "Invalid field, request ID or destination. Use public HTTPS on port 443 without a query or fragment.",
        "401": "Sign in with the existing account. Creation and revocation require authentication within five minutes.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The project or webhook does not belong to this account.",
        "409": "An active destination exists, 16 retained destinations exist, or this request ID has another destination.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "The optional webhook or current account authorization is unavailable."
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/webhooks\", {credentials:\"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ esquema, destinos, envios }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/webhooks",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/webhooks",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        }
      },
      "summary": "Create one signed webhook and download its private signing key.",
      "desc": "Private, no-store and no CORS grant. Requires the configured optional webhook service. Only the human account owner can manage destinations. Installation tokens and API keys are refused. Requires recent authentication and CSRF. Generate and retain one random request ID. Retry an uncertain request only with the same ID and exact URL; this returns the same key without another test or registration. One active destination per project, valid for 30 days. Creation queues a separate signed test. Changed inventory, activity that needs attention and changed incomplete coverage use the same committed event as the cursor. The initial reference and routine approved actions do not notify. Delivery uses Standard Webhooks headers webhook-id, webhook-timestamp and webhook-signature. Verify the signature and timestamp before use, then deduplicate webhook-id before any effect. Lost receipts can repeat a delivery. At most six attempts share the global 512 daily attempts with email. Public HTTPS only; no private network or redirect. Recover missing events through the cursor.",
      "corpo": {
        "id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Random request ID: 32 lower-case hexadecimal characters. Preserve it for an explicit retry."
        },
        "url": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Public HTTPS destination, at most 512 characters. No credentials, IP address, query, fragment or nonstandard port."
        }
      },
      "retorno": {
        "esquema": {
          "tipo": "string",
          "desc": "webhook-credencial-1."
        },
        "projeto": {
          "tipo": "string",
          "desc": "The single private project."
        },
        "webhook": {
          "tipo": "string",
          "desc": "The destination ID."
        },
        "segredo": {
          "tipo": "string",
          "desc": "Private whsec_ signing key. Store outside the repository and logs. Only creation or its explicit identical retry returns it."
        },
        "expira_em": {
          "tipo": "int",
          "desc": "Expiry timestamp in Unix seconds."
        }
      },
      "erros": {
        "400": "Invalid field, request ID or destination. Use public HTTPS on port 443 without a query or fragment.",
        "401": "Sign in with the existing account. Creation and revocation require authentication within five minutes.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The project or webhook does not belong to this account.",
        "409": "An active destination exists, 16 retained destinations exist, or this request ID has another destination.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "The optional webhook or current account authorization is unavailable."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nconst id = crypto.randomUUID().replaceAll(\"-\",\"\");\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/webhooks\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:JSON.stringify({id,url:\"https://receiver.example/events\"})});",
      "exemploLinguagem": "js",
      "returns": "{ esquema, projeto, webhook, segredo, expira_em }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/webhooks",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/webhooks/:webhook/revogar",
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private project ID owned by the signed-in account."
        },
        "webhook": {
          "desc": "Webhook ID in this owned project."
        }
      },
      "summary": "Stop future sends to one project webhook.",
      "desc": "Private, no-store and no CORS grant. Requires the configured optional webhook service. Only the human account owner can manage destinations. Installation tokens and API keys are refused. Requires recent authentication, CSRF and exact empty JSON. Revocation prevents a reserved delivery from starting. A request already in flight can still arrive. Repeated revocation performs no write. Inventory, email, event readers and purchased rights remain available.",
      "corpo": {},
      "retorno": {
        "revogado": {
          "tipo": "bool",
          "desc": "True when this destination cannot start another delivery."
        }
      },
      "erros": {
        "400": "Invalid field, request ID or destination. Use public HTTPS on port 443 without a query or fragment.",
        "401": "Sign in with the existing account. Creation and revocation require authentication within five minutes.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The project or webhook does not belong to this account.",
        "409": "An active destination exists, 16 retained destinations exist, or this request ID has another destination.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "The optional webhook or current account authorization is unavailable."
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/webhooks/WEBHOOK_ID/revogar\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:\"{}\"});",
      "exemploLinguagem": "js",
      "returns": "{ revogado }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/webhooks/:webhook/revogar",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "auth": "monitor_notices",
      "grupo": "Notice delivery service",
      "erros": {
        "400": "Invalid bounded JSON, receipt, result or query.",
        "401": "The dedicated product notice credential is absent or invalid.",
        "405": "Only POST is permitted.",
        "409": "The reservation expired or the project or installation is no longer active.",
        "413": "The request body exceeds 4 KiB.",
        "415": "Content-Type must be application/json.",
        "429": "The shared daily reservation or delivery-attempt budget is exhausted. No send is authorized.",
        "503": "Notice delivery is unavailable or another service operation is active."
      },
      "method": "POST",
      "path": "/api/monitor/avisos/reivindicar",
      "summary": "Reserve at most one committed notice for the existing product mail service.",
      "desc": "Private and no-store. Set ORIGIN to the fixed service authority https://api.agentalog.com. Dedicated service only; no customer or MCP tool authority. Exact empty JSON and no query. Reads the indexed pending range, then revalidates account epoch, project and installation. MAT covers changes after the initial reference and native observations that need attention, including unlinked items. Approved routine activity stays in the private cursor without mail. Active human-selected watch links add catalog context; they are optional. Empty polling writes nothing. Reservation lasts two minutes. Reply contains bounded event metadata, owner ID and reservation proof, never email or installation credentials. No send occurs here.",
      "corpo": {},
      "retorno": {
        "aviso": {
          "tipo": "object",
          "nulo": true,
          "desc": "Null when no eligible notice exists; otherwise produto, projeto, numero, lease, dono, nome and evento. Maximum 4 MiB."
        }
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/avisos/reivindicar\", {method:\"POST\", redirect:\"manual\", headers:{\"Authorization\":\"Bearer NOTICE_SERVICE_TOKEN\",\"Content-Type\":\"application/json\"}, body:JSON.stringify({})});",
      "exemploLinguagem": "js",
      "returns": "{ aviso }",
      "url": "https://agentalog.com/api/monitor/avisos/reivindicar",
      "auth_detail": "Dedicated mmn_ bearer credential for the existing product mail service. Only reserve, start and confirm one product's notices. Account cookies, API keys and installation tokens are refused."
    },
    {
      "auth": "monitor_notices",
      "grupo": "Notice delivery service",
      "erros": {
        "400": "Invalid bounded JSON, receipt, result or query.",
        "401": "The dedicated product notice credential is absent or invalid.",
        "405": "Only POST is permitted.",
        "409": "The reservation expired or the project or installation is no longer active.",
        "413": "The request body exceeds 4 KiB.",
        "415": "Content-Type must be application/json.",
        "429": "The shared daily reservation or delivery-attempt budget is exhausted. No send is authorized.",
        "503": "Notice delivery is unavailable or another service operation is active."
      },
      "method": "POST",
      "path": "/api/monitor/avisos/iniciar",
      "summary": "Revalidate the reservation before one mail attempt.",
      "desc": "Private and no-store. Account epoch, project, installation and recorded notice evidence must remain valid. Records send intent and reserves one of 512 shared delivery attempts per UTC day in the same transaction before authorizing mail. Retries consume this same budget. Exhaustion preserves preparation and returns 429 without authorizing a send. Missing or invalid budget returns 503. Returns only catalog links still active from the committed event; the list can be empty for an unlinked change or native observation. It does not send mail or grant tool approval. After two minutes, interrupted preparation can be recovered and send intent without a receipt is eligible for uncertain recovery. Hourly maintenance performs bounded recovery. Uncertain sends are not automatically resent.",
      "corpo": {
        "projeto": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Reserved private project ID: 32 hexadecimal characters."
        },
        "numero": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Reserved positive committed event number."
        },
        "lease": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Private reservation proof: 64 hexadecimal characters."
        }
      },
      "retorno": {
        "autorizado": {
          "tipo": "bool",
          "desc": "True only after the send intent is durably recorded."
        },
        "vigias": {
          "tipo": "object[]",
          "desc": "Zero to 500 active item/alvo pairs; a subset of the committed event links."
        }
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/avisos/iniciar\", {method:\"POST\", redirect:\"manual\", headers:{\"Authorization\":\"Bearer NOTICE_SERVICE_TOKEN\",\"Content-Type\":\"application/json\"}, body:JSON.stringify({projeto:\"PROJECT_ID\",numero:1,lease:\"RESERVATION_PROOF\"})});",
      "exemploLinguagem": "js",
      "returns": "{ autorizado, vigias }",
      "url": "https://agentalog.com/api/monitor/avisos/iniciar",
      "auth_detail": "Dedicated mmn_ bearer credential for the existing product mail service. Only reserve, start and confirm one product's notices. Account cookies, API keys and installation tokens are refused."
    },
    {
      "auth": "monitor_notices",
      "grupo": "Notice delivery service",
      "erros": {
        "400": "Invalid bounded JSON, receipt, result or query.",
        "401": "The dedicated product notice credential is absent or invalid.",
        "405": "Only POST is permitted.",
        "409": "The reservation expired or the project or installation is no longer active.",
        "413": "The request body exceeds 4 KiB.",
        "415": "Content-Type must be application/json.",
        "429": "The shared daily reservation or delivery-attempt budget is exhausted. No send is authorized.",
        "503": "Notice delivery is unavailable or another service operation is active."
      },
      "method": "POST",
      "path": "/api/monitor/avisos/finalizar",
      "summary": "Confirm the result of the single reserved mail attempt.",
      "desc": "Private and no-store. Accept enviado, adiado, rejeitado or incerto. enviado means provider acceptance, not inbox delivery. adiado is valid only when no send occurred: retry after one hour, with at most six reservations. rejeitado discards the notice. incerto prevents automatic resend. A late matching receipt can confirm an uncertain send. Exact confirmation replay does not write or extend a deadline.",
      "corpo": {
        "projeto": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Reserved private project ID: 32 hexadecimal characters."
        },
        "numero": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Reserved positive committed event number."
        },
        "lease": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Private reservation proof: 64 hexadecimal characters."
        },
        "resultado": {
          "tipo": "string",
          "obrigatorio": true,
          "valores": [
            "enviado",
            "adiado",
            "rejeitado",
            "incerto"
          ],
          "desc": "Observed mail result. Never infer success after a timeout."
        }
      },
      "retorno": {
        "estado": {
          "tipo": "string",
          "valores": [
            "enviado",
            "pendente",
            "descartado",
            "incerto"
          ],
          "desc": "Durably confirmed current notice state."
        }
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/avisos/finalizar\", {method:\"POST\", redirect:\"manual\", headers:{\"Authorization\":\"Bearer NOTICE_SERVICE_TOKEN\",\"Content-Type\":\"application/json\"}, body:JSON.stringify({projeto:\"PROJECT_ID\",numero:1,lease:\"RESERVATION_PROOF\",resultado:\"incerto\"})});",
      "exemploLinguagem": "js",
      "returns": "{ estado }",
      "url": "https://agentalog.com/api/monitor/avisos/finalizar",
      "auth_detail": "Dedicated mmn_ bearer credential for the existing product mail service. Only reserve, start and confirm one product's notices. Account cookies, API keys and installation tokens are refused."
    },
    {
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private owned project ID: 32 lower-case hexadecimal characters."
        },
        "instalacao": {
          "desc": "Current-epoch installation in this project: 32 hexadecimal characters. A decision requires an active credential."
        }
      },
      "erros": {
        "400": "Invalid field, bounded JSON or cursor.",
        "401": "A human cookie is required. Reauthenticate within five minutes before a decision.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The owned active project or installation was not found.",
        "405": "Only the declared method is permitted.",
        "409": "The observed candidate, sequence or review version changed; coverage is incomplete; or a cursor is in the future.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "Review is unconfigured or unavailable. No permission is granted."
      },
      "method": "GET",
      "path": "/api/monitor/projetos/:projeto/instalacoes/:instalacao/revisoes",
      "summary": "Compare observed candidates with your reviewed reference and read decision receipts.",
      "desc": "Private and no-store. Requires the human account cookie. Expired or revoked current-epoch installations remain readable. This read does not authorize a new decision or signed policy. One request reads at most 500 current candidates and 500 reviewed references. Each candidate includes the server's fingerprint, comparison state and changed fields. Incomplete coverage cannot grant approval. No installation secret or local path is returned. Read at most five audit receipts after the cursor. Future cursors fail. This reads no public catalog and writes nothing. Available only when the optional review service is configured.",
      "colecao": {
        "porPagina": 5,
        "anda": "desde"
      },
      "query": {
        "desde": {
          "tipo": "int",
          "padrao": 0,
          "desc": "Last consumed decision number, from 0 to 600."
        },
        "limite": {
          "tipo": "int",
          "padrao": 5,
          "desc": "Maximum audit receipts in this page, from 1 to 5."
        }
      },
      "retorno": {
        "esquema": {
          "tipo": "string",
          "valores": [
            "revisoes-inventario-1"
          ],
          "desc": "Review state contract."
        },
        "instalacao": {
          "tipo": "string",
          "desc": "The owned installation."
        },
        "sequencia": {
          "tipo": "int",
          "desc": "Current inventory sequence. Send this exact number in a decision."
        },
        "versao": {
          "tipo": "int",
          "desc": "Current review version. Send this exact number in a decision."
        },
        "candidatos": {
          "tipo": "object[]",
          "desc": "At most 500 records: item, candidato, estado and campos. Each item uses inventario-1 metadata, including selected configuration hashes and fixed permission categories. estado is novo, igual, alterado or incompleto. campos identifies changed captured metadata. Use candidato in the human decision; do not recompute it in the browser."
        },
        "revisoes": {
          "tipo": "object[]",
          "desc": "At most 500 item/candidato/decisao/responsavel/decidido_em/numero records. Each item uses inventario-1 metadata. An observed upgrade preserves the previous reviewed reference."
        },
        "historico": {
          "tipo": "object[]",
          "desc": "Up to five receipts: id, item, candidato, decisao, quando, numero and responsavel. No request hash or secret."
        },
        "cursor": {
          "tipo": "int",
          "desc": "Last returned receipt number. Use it as desde for the next page."
        },
        "fim": {
          "tipo": "bool",
          "desc": "True at the current end of the audit."
        }
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/instalacoes/INSTALLATION_ID/revisoes?desde=0&limite=5\", {credentials:\"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ esquema, instalacao, sequencia, versao, candidatos, revisoes, historico, cursor, fim }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/instalacoes/:instalacao/revisoes",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "auth": "session",
      "grupo": "Installed agents",
      "params": {
        "projeto": {
          "desc": "Private owned project ID: 32 lower-case hexadecimal characters."
        },
        "instalacao": {
          "desc": "Current-epoch installation in this project: 32 hexadecimal characters. A decision requires an active credential."
        }
      },
      "erros": {
        "400": "Invalid field, bounded JSON or cursor.",
        "401": "A human cookie is required. Reauthenticate within five minutes before a decision.",
        "403": "Origin or CSRF proof is invalid.",
        "404": "The owned active project or installation was not found.",
        "405": "Only the declared method is permitted.",
        "409": "The observed candidate, sequence or review version changed; coverage is incomplete; or a cursor is in the future.",
        "413": "Body exceeds 4 KiB.",
        "415": "Content-Type must be application/json.",
        "429": "The shared daily registration budget is exhausted.",
        "503": "Review is unconfigured or unavailable. No permission is granted."
      },
      "method": "POST",
      "path": "/api/monitor/projetos/:projeto/instalacoes/:instalacao/revisoes",
      "summary": "Approve exact observed content or suspend it with a durable human receipt.",
      "desc": "Private and no-store. Requires a human cookie authenticated within five minutes, exact Origin and CSRF. Refuses installation bearer credentials and API keys. Recheck candidate fingerprint, inventory sequence and review version under the project lock. Partial coverage cannot grant approval. A suspension can retain a reviewed item after removal. Retry with the same ID and exact body to obtain the original receipt without writes. A changed body under the same ID fails. Limits: 500 references, 600 total decisions per installation, 2 MiB stored state, and the shared 512 registrations per day. No tool runs or is installed by this endpoint. A model result never grants permission.",
      "corpo": {
        "id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Generate 32 lower-case hexadecimal characters once per human decision. Keep it on retry."
        },
        "item": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Received inventory item ID: 64 hexadecimal characters."
        },
        "candidato": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "64-character SHA-256 fingerprint from @mm/revisao/inventario-candidato. Covers identity, content hash and all captured metadata; it is not the content hash alone."
        },
        "decisao": {
          "tipo": "string",
          "obrigatorio": true,
          "valores": [
            "aprovar",
            "suspender"
          ],
          "desc": "Explicit human decision for the selected candidate."
        },
        "versao": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Review version read for this installation, from 0 to 600."
        },
        "sequencia": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Positive inventory sequence shown to the reviewer."
        }
      },
      "retorno": {
        "id": {
          "tipo": "string",
          "desc": "Decision retry ID: 32 lower-case hexadecimal characters."
        },
        "item": {
          "tipo": "string",
          "desc": "The reviewed inventory item ID: 64 hexadecimal characters."
        },
        "candidato": {
          "tipo": "string",
          "desc": "Fingerprint of the exact content and captured metadata."
        },
        "decisao": {
          "tipo": "string",
          "valores": [
            "aprovar",
            "suspender"
          ],
          "desc": "The human decision."
        },
        "quando": {
          "tipo": "int",
          "desc": "Decision timestamp in Unix seconds, assigned by the server."
        },
        "numero": {
          "tipo": "int",
          "desc": "The installation's durable review version."
        },
        "responsavel": {
          "tipo": "string",
          "desc": "Account identity from the authenticated cookie, never the body."
        }
      },
      "exemplo": "const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\nawait fetch(\"$ORIGIN/api/monitor/projetos/PROJECT_ID/instalacoes/INSTALLATION_ID/revisoes\", {method:\"POST\", credentials:\"same-origin\", headers:{\"Content-Type\":\"application/json\",\"X-CSRF-Token\":csrf}, body:JSON.stringify({id:crypto.randomUUID().replaceAll(\"-\",\"\"),item:\"ITEM_ID\",candidato:\"CANDIDATE_FINGERPRINT\",decisao:\"aprovar\",versao:0,sequencia:1})});",
      "exemploLinguagem": "js",
      "returns": "{ id, item, candidato, decisao, quando, numero, responsavel }",
      "url": "https://agentalog.com/api/monitor/projetos/:projeto/instalacoes/:instalacao/revisoes",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/monitor/politica",
      "auth": "monitor_installation",
      "grupo": "Installed agents",
      "summary": "Read a signed short-lived policy for this installation only.",
      "desc": "Private and no-store. Set ORIGIN to https://api.agentalog.com. Exact path, no query and no write. Revalidate credential expiry, revocation and account epoch on each read. Ed25519 signature; at most 500 rules, 1 MiB and 15 minutes, shortened to credential expiry. Client 0.4.0 pins the public key and verifies product/project/installation/epoch through its trusted connection. Reject expired, future, changed, differently scoped or older policies. An already cached policy can remain valid until expiry after an online revocation. policy downloads a signed decision. check recollects the selected configurations and target item before checking their exact candidates. The policy and check commands do not activate tools or install hooks. Optional hooks-install can install project hooks after preview consent. In enforce mode, covered calls require exact reviewed configuration and tool metadata. Removing a reviewed configuration prevents confirmation until that configuration is restored and reviewed. This does not freeze a remote MCP's code or guarantee universal blocking. Available only when the optional review service is configured.",
      "retorno": {
        "esquema": {
          "tipo": "string",
          "valores": [
            "politica-assinada-1"
          ],
          "desc": "Signed envelope contract."
        },
        "politica": {
          "tipo": "object",
          "desc": "politica-inventario-1: produto, projeto, instalacao, epoca, versao, emitida_em, expira_em and revisoes. Rules contain exact item metadata, candidate fingerprint, human decision, responsible account, decision timestamp and number."
        },
        "assinatura": {
          "tipo": "string",
          "desc": "86 base64url characters. Verify with the separately trusted Ed25519 public key; never trust a key supplied by an untrusted envelope."
        }
      },
      "erros": {
        "400": "Unexpected query.",
        "401": "The installation credential is absent, expired or revoked.",
        "405": "Only GET is permitted.",
        "503": "The optional review service is unconfigured or unavailable."
      },
      "exemplo": "await fetch(\"$ORIGIN/api/monitor/politica\", {headers:{\"Authorization\":\"Bearer INSTALLATION_TOKEN\"}, redirect:\"manual\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ esquema, politica, assinatura }",
      "url": "https://agentalog.com/api/monitor/politica",
      "auth_detail": "Private mmi_ credential in Authorization: Bearer, restricted to one installation and project. The account issues it after recent human sign-in. It cannot approve, buy or issue another credential."
    },
    {
      "method": "GET",
      "path": "/api/a2a/agents",
      "auth": "none",
      "colecao": {
        "porPagina": 50,
        "teto": 20000,
        "anda": "_links.next"
      },
      "grupo": "A2A agents",
      "summary": "The A2A agent index: agents that publish an AgentCard, with text search and filters.",
      "desc": "Collected from public A2A registries and served as it comes — no review queue hides a record; quality is the order, never visibility. One row per agent, merged across the registries that list it: `fontes` says which, and `creditos` carries each one's license, which travels with the data. Values inside one parameter are OR'd, different parameters are AND'd. Cached for 60 seconds. A MAT catalog read, served by the index host `https://api.agentalog.com`; this host forwards the call there.",
      "query": {
        "q": {
          "tipo": "string",
          "desc": "Substring of the name, description, key, publisher or the card's skills, in any letter case (`%` and `_` are taken literally); up to 80 characters.",
          "exemplo": "weather"
        },
        "saude": {
          "tipo": "string",
          "desc": "Health the registries measured: `sim` answered, `nao` did not, `sem_medida` never measured. Comma-separated values are OR'd (up to 12, each up to 200 characters).",
          "valores": [
            "sim",
            "nao",
            "sem_medida"
          ]
        },
        "protocolo": {
          "tipo": "string",
          "desc": "A2A protocol version as normalized (`0.3`, `1.0`…); `/api/a2a/facets` lists the ones present. Comma-separated values are OR'd (up to 12, each up to 200 characters).",
          "exemplo": "0.3,1.0"
        },
        "fonte": {
          "tipo": "string",
          "desc": "Only agents listed by this registry. Comma-separated values are OR'd (up to 12, each up to 200 characters).",
          "valores": [
            "a2a_registry",
            "a2a_global",
            "agenstry"
          ]
        },
        "tag": {
          "tipo": "string",
          "desc": "Exact tag of the card's skills, case-sensitive; `/api/a2a/facets` lists the 40 most used. Comma-separated values are OR'd (up to 12, each up to 200 characters).",
          "exemplo": "x402"
        },
        "publicador": {
          "tipo": "string",
          "desc": "Exact publisher, as `publicador` shows it. Comma-separated values are OR'd (up to 12, each up to 200 characters)."
        },
        "skills": {
          "tipo": "string",
          "desc": "`1` keeps only agents whose card lists at least one skill.",
          "valores": [
            "1"
          ]
        },
        "limit": {
          "tipo": "int",
          "desc": "Items per page, 1–50; more is capped at 50, anything else means 20.",
          "padrao": 20
        },
        "offset": {
          "tipo": "int",
          "desc": "Offset, capped at 20000 (a larger value reads as 20000). Prefer `_links.next`.",
          "padrao": 0
        }
      },
      "retorno": "PaginaDeAgentesA2A",
      "exemplo": "curl -s '$ORIGIN/api/a2a/agents?saude=sim&protocolo=0.3,1.0&limit=5'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "returns": "{ ok, total, count, items[{chave,dominio,nome,descricao,url,cartao,publicador,protocolo,saudavel,conforme,verificado,uptime,skills_n,tags,fontes,creditos,visto_em}], _links }",
      "url": "https://agentalog.com/api/a2a/agents",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/a2a/agents/:chave",
      "auth": "none",
      "grupo": "A2A agents",
      "summary": "One A2A agent: its card's skills and capabilities, protocol, health and the registries that list it.",
      "desc": "The same row as the list plus what the card declares: every skill, the `capabilities` object, the protocol version as written, the documentation and icon URLs, and when we first saw it. Cached for 60 seconds; a MAT catalog read, like the list.",
      "params": {
        "chave": {
          "tipo": "string",
          "desc": "The agent's `chave` from `/api/a2a/agents` — usually the card's domain. URL-encode it; up to 200 characters are read.",
          "exemplo": "coinrailz.com"
        }
      },
      "retorno": "FichaDeAgenteA2A",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "No agent is indexed under that key (`error: not_found`).",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/a2a/agents/coinrailz.com",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ ok, agent{chave,dominio,nome,descricao,url,cartao,publicador,protocolo,saudavel,conforme,verificado,uptime,skills_n,tags,fontes,creditos,visto_em,protocolo_declarado,documentacao,icone,capacidades,skills,primeiro_em} }",
      "url": "https://agentalog.com/api/a2a/agents/:chave",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/a2a/facets",
      "auth": "none",
      "grupo": "A2A agents",
      "summary": "How many A2A agents exist per health state, protocol, registry, tag and publisher.",
      "desc": "The counts behind the filters of `/api/a2a/agents`, over the whole index — no filter applies here. The index host checks collection checkpoints about every 9 minutes and recounts after a change or once a day. The last valid response survives restarts on disk; while it renews, a previously confirmed response is served for up to 6 hours. Free and outside the MAT read allowance. This host answers with a 308 to the index host `https://api.agentalog.com` — follow the redirect.",
      "retorno": "FacetasA2A",
      "erros": {
        "503": "No count in memory yet and the database did not answer; retry after `Retry-After` seconds."
      },
      "exemplo": "curl -sL $ORIGIN/api/a2a/facets",
      "returns": "{ ok, facets, _links }",
      "url": "https://agentalog.com/api/a2a/facets",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/a2a/acervo",
      "auth": "none",
      "colecao": {
        "porPagina": 50,
        "teto": 50000,
        "anda": "offset"
      },
      "grupo": "A2A agents",
      "summary": "What came along with the A2A registries — MCP servers, skills, paid APIs, workflows, repositories — matched to this catalog.",
      "desc": "Agent registries ship more than agents: Agenstry's feed also carries MCP servers, skills, paid APIs and workflows, and the curated GitHub lists cite repositories and domains. Every item is kept and shown with its source and license; `no_catalogo` says whether this catalog already lists it (same GitHub repository or same URL) — provenance, never a visibility filter. Filters are AND'd, one value each. Items the catalog does not have yet come first; `total` counts the filter and paging is by `offset` (there is no `next` link). Cached for 60 seconds; a MAT catalog read.",
      "query": {
        "kind": {
          "tipo": "string",
          "desc": "What the item is: see `kind` in the item.",
          "valores": [
            "mcp",
            "skill",
            "paid_api",
            "workflow",
            "repo",
            "semente",
            "lista"
          ]
        },
        "fonte": {
          "tipo": "string",
          "desc": "Only the items of this source.",
          "valores": [
            "agenstry",
            "a2a_github"
          ]
        },
        "q": {
          "tipo": "string",
          "desc": "Substring of the name, description or key, in any letter case (`%` and `_` are taken literally); up to 80 characters.",
          "exemplo": "postgres"
        },
        "casou": {
          "tipo": "string",
          "desc": "`1` only items this catalog already lists, `0` only the ones it does not.",
          "valores": [
            "0",
            "1"
          ]
        },
        "limit": {
          "tipo": "int",
          "desc": "Items per page, 1–50; more is capped at 50, anything else means 20.",
          "padrao": 20
        },
        "offset": {
          "tipo": "int",
          "desc": "Offset, capped at 50000 (a larger value reads as 50000).",
          "padrao": 0
        }
      },
      "retorno": "PaginaDoAcervoA2A",
      "exemplo": "curl -s '$ORIGIN/api/a2a/acervo?kind=paid_api&casou=0&limit=5'",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "returns": "{ ok, total, count, items[{fonte,credito,chave,kind,nome,descricao,url,dominio,repo,no_catalogo,visto_em}], _links }",
      "url": "https://agentalog.com/api/a2a/acervo",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/a2a/stats",
      "auth": "none",
      "grupo": "A2A agents",
      "summary": "Where the A2A index comes from: records per source, credit and license, and each source's last collection round.",
      "desc": "An index that does not show where its data came from asks for trust instead of giving proof. `bruto_por_fonte` counts the raw records kept per source, `acervo_por_kind` sizes `/api/a2a/acervo`, and `coleta` gives each source's last round: when, how many, how long, the error if it failed and when the next is due. The same collector reads the MCP indexes, so they appear here too, with `credito: null` — `/api/indices` credits them. The index host checks collection checkpoints about every 9 minutes and recounts after a change or once a day. The last valid response survives restarts on disk; while it renews, a previously confirmed response is served for up to 6 hours. Free and outside the MAT read allowance. This host answers with a 308 to the index host `https://api.agentalog.com` — follow the redirect.",
      "retorno": "EstadoDaColetaA2A",
      "erros": {
        "503": "No count in memory yet and the database did not answer; retry after `Retry-After` seconds."
      },
      "exemplo": "curl -sL $ORIGIN/api/a2a/stats",
      "returns": "{ ok, agentes, agentes_com_skills, bruto_por_fonte[{fonte,itens,credito}], acervo_por_kind[{kind,itens,no_catalogo}], coleta[{fonte,credito,rodada_em,itens,novos,mudados,ms,http,erro,proxima_em}], _links }",
      "url": "https://agentalog.com/api/a2a/stats",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/listings",
      "auth": "session_ou_x402",
      "summary": "Registers an MCP server, a skill or a plugin in the catalog. It comes in as `pending`.",
      "grupo": "Publish",
      "desc": "Automatic review approves supported low-risk MCP listings; uncertain cases wait for a person. Poll `status_api` (`GET /api/listings/:id/status`, no credential) to learn the decision. A person or agent can submit without an account. While billing is off, no payment is required. Each owner can submit once a day and keep up to three submissions in the queue. For a skill, provide its SKILL.md URL. If agent billing is enabled, the reference price is US$ 0.10 per submission, paid through x402 or prepaid credit. The service checks the body and quota before charging. An invalid body returns 400; an exhausted quota returns 429.",
      "corpo": {
        "kind": {
          "tipo": "string",
          "desc": "What is being registered.",
          "valores": [
            "mcp",
            "skill",
            "plugin",
            "okf"
          ],
          "obrigatorio": true
        },
        "url": {
          "tipo": "string",
          "desc": "MCP endpoint, SKILL.md URL, the plugin's repository or the OKF bundle's `index.md`. For an OKF bundle on a domain you control, `POST /api/okf/ping` is free.",
          "obrigatorio": true
        },
        "name": {
          "tipo": "string",
          "desc": "Display name; without it, taken from the source."
        },
        "tagline": {
          "tipo": "string",
          "desc": "One line saying what it is for."
        },
        "body": {
          "tipo": "string",
          "desc": "Long description, optional."
        },
        "category": {
          "tipo": "string",
          "desc": "Category so the listing shows up under the right filter."
        }
      },
      "body": {
        "kind": "mcp",
        "category": "tools",
        "name": "Name",
        "tagline": "One line",
        "url": "https://example.com/mcp"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true` when the request went in."
        },
        "id": {
          "tipo": "string",
          "desc": "ID of the created listing."
        },
        "status": {
          "tipo": "string",
          "desc": "Always `pending`: everything goes through the queue before turning live."
        },
        "status_api": {
          "tipo": "string",
          "desc": "Where to poll for the review, with no credential (`GET /api/listings/:id/status`)."
        }
      },
      "erros": {
        "400": "`kind` or `url` missing, invalid URL, URL that does not answer or refused field.",
        "402": null,
        "429": "1 per day, at most 3 pending — applies to both doors, and is checked before charging.",
        "502": "The payment settled and the write failed. The body carries `transaction`: keep it and talk to support."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/listings -H \"X-PAYMENT: $PAYMENT\" -H 'content-type: application/json' -d '{\"kind\":\"mcp\",\"url\":\"https://example.com/mcp\",\"name\":\"My MCP\"}'",
      "returns": "{ ok, id, status, status_api }",
      "url": "https://agentalog.com/api/listings",
      "auth_detail": "A person can submit with the account cookie or a guest identity. An agent can submit without an account. Both paths are free while billing is off and use the same submission limits. When billing is enabled, the agent path accepts x402 or prepaid credit."
    },
    {
      "method": "PATCH",
      "path": "/api/listings/:id",
      "auth": "guest",
      "summary": "Edits a listing of yours. Changing its public content sends it back to moderation.",
      "grupo": "Publish",
      "desc": "The URL and public text are what moderation checks; changing either after approval sends the listing back to `pending`.",
      "params": {
        "id": {
          "desc": "ID of the listing to edit."
        }
      },
      "corpo": {
        "name": {
          "tipo": "string",
          "desc": "New display name."
        },
        "tagline": {
          "tipo": "string",
          "desc": "New summary line."
        },
        "body": {
          "tipo": "string",
          "desc": "New long description."
        },
        "category": {
          "tipo": "string",
          "desc": "New category."
        },
        "url": {
          "tipo": "string",
          "desc": "New URL — changing this sends the listing back to `pending`, as with public text edits."
        }
      },
      "body": {
        "tagline": "…"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true`."
        },
        "id": {
          "tipo": "string",
          "desc": "ID of the edited listing."
        },
        "status": {
          "tipo": "string",
          "desc": "State after the edit; back to `pending` if public content changed."
        }
      },
      "erros": {
        "400": "Invalid field in the body.",
        "401": null,
        "404": "The listing is not yours or does not exist."
      },
      "exemplo": "(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/listings/ID\", {method: \"PATCH\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({tagline: \"now with SSE support\"})});\n  return r.json();\n})();",
      "exemploLinguagem": "js",
      "returns": "{ ok, id, status }",
      "url": "https://agentalog.com/api/listings/:id",
      "auth_detail": "Guest token (`POST /api/guest`) in `X-Guest-Token: mr_…` or `Authorization: Bearer mr_…`. In the browser it also lives in the HttpOnly `mr_guest` cookie, which writes only from this site's exact Origin. A signed-in account (cookie) also works and takes precedence."
    },
    {
      "method": "GET",
      "path": "/api/me/listings",
      "auth": "guest",
      "summary": "The owner's listings in any state, including pending and hidden.",
      "grupo": "Publish",
      "desc": "It is the only route that shows what is not live yet — the public mosaic never does. A temporary guest sees its own submissions here and keeps them when it links an account.",
      "retorno": {
        "items": {
          "tipo": "Anuncio[]",
          "desc": "This owner’s listings, in any state."
        }
      },
      "erros": [
        401
      ],
      "exemplo": "await fetch(\"$ORIGIN/api/me/listings\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ items[{seguranca_nivel?,seguranca_estado?,seguranca_api?,moderation?,id,kind,category,name,tagline,body,url,status,origin,origin_id,install,source,transporte,ns,versao,oficial_status,repo_host,topico,linguagem,licenca,repo_topics,repo_slug,stars,forks,prs_abertos,pushed_at,repo_estado,likes,comments,visits,created_at,updated_at,mine,api,go,comments_api,readme_api?,historico?,readme_fonte?,readme_bytes,readme_sha,readme_em,payload}] }",
      "url": "https://agentalog.com/api/me/listings",
      "auth_detail": "Guest token (`POST /api/guest`) in `X-Guest-Token: mr_…` or `Authorization: Bearer mr_…`. In the browser it also lives in the HttpOnly `mr_guest` cookie, which writes only from this site's exact Origin. A signed-in account (cookie) also works and takes precedence."
    },
    {
      "method": "GET",
      "path": "/api/me",
      "auth": "session",
      "summary": "The session's account and, for the admin, the load state.",
      "desc": "The account is the global account; `user.id` is its id — the same id that owns the listings, likes and comments made with it, and the guest's after the claim.",
      "grupo": "Account",
      "retorno": {
        "user": {
          "tipo": "Conta",
          "desc": "The person who owns the session."
        },
        "profile": {
          "tipo": "object",
          "desc": "Global profile: `name`, `locale`, `timeZone`, `theme`, `revision`."
        },
        "admin": {
          "tipo": "bool",
          "desc": "Whether this account is the `ADMIN_EMAIL`."
        },
        "carga": {
          "tipo": "Carga",
          "desc": "State of the load sources; admin only.",
          "opcional": true
        }
      },
      "erros": {
        "401": "invalid_session",
        "503": "auth_unavailable"
      },
      "exemplo": "await fetch(\"$ORIGIN/api/me\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ user{id,email}, profile, admin, carga?{fontes,falhas,runs,orcamento} }",
      "url": "https://agentalog.com/api/me",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/me/ui",
      "auth": "session",
      "summary": "The owner's screen preferences: search, filter, sort and theme.",
      "grupo": "Account",
      "desc": "Exists so what the person set up survives an F5 and reopening the app on another device. A refresh is not a new screen — see AGENTS-UI.md. A guest has none: without an account there is nobody to give the data back to later, so the guest stays in the browser's `localStorage` only.",
      "retorno": "PreferenciasUi",
      "erros": [
        401
      ],
      "exemplo": "await fetch(\"$ORIGIN/api/me/ui\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ prefs, api }",
      "url": "https://agentalog.com/api/me/ui",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "PUT",
      "path": "/api/me/ui",
      "auth": "session",
      "summary": "Stores the owner's screen preferences, replacing the previous ones.",
      "grupo": "Account",
      "desc": "It is PUT and not PATCH on purpose: the client sends the whole screen state, not a delta. Cap of 8 KB — this is a screen preference, not a blob store.",
      "corpo": {
        "prefs": {
          "tipo": "object",
          "desc": "The interface state to keep. Opaque to the server: any JSON within the cap works.",
          "obrigatorio": true
        }
      },
      "body": {
        "prefs": {
          "q": "postgres",
          "kind": "mcp",
          "sort": "likes",
          "tema": "escuro"
        }
      },
      "retorno": "Ok",
      "erros": {
        "400": "Body that is not JSON (`bad_json`) or without the `prefs` key (`prefs`).",
        "401": null,
        "405": "Method other than GET or PUT on this route.",
        "413": "Preferences above the 8 KB cap (`grande`)."
      },
      "exemplo": "(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/me/ui\", {method: \"PUT\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({prefs: {sort: \"likes\"}})});\n  return r.json();\n})();",
      "exemploLinguagem": "js",
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/me/ui",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/auth/bootstrap",
      "auth": "none",
      "grupo": "Account",
      "summary": "Prepare the browser for global sign-in.",
      "desc": "Sets a host-only HttpOnly browser cookie. CSRF is bound to the current session. No CORS.",
      "retorno": {
        "csrf": {
          "tipo": "string",
          "desc": "X-CSRF-Token"
        },
        "context": {
          "tipo": "string",
          "desc": "Opaque view context, also in X-MM-Context; not a credential / contexto opaco da vista, não é credencial."
        }
      },
      "erros": {
        "400": "invalid_request",
        "403": "invalid_origin / invalid_csrf",
        "503": "auth_unavailable: a sessão anterior é preservada / the previous session is preserved"
      },
      "returns": "{ csrf, context }",
      "url": "https://agentalog.com/api/auth/bootstrap",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/account/profile",
      "auth": "session",
      "grupo": "Account",
      "exemplo": "await fetch(\"$ORIGIN/api/account/profile\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "summary": "Read your global profile.",
      "desc": "Reads current preferences from the account. Edit them on your account page; products never own a separate profile.",
      "retorno": {
        "_texto": "{profile:{name,locale,timeZone,theme,revision}}"
      },
      "erros": {
        "401": "invalid_session",
        "503": "auth_unavailable"
      },
      "returns": "{profile:{name,locale,timeZone,theme,revision}}",
      "url": "https://agentalog.com/api/account/profile",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/account/avatar",
      "auth": "session",
      "grupo": "Account",
      "exemplo": "await fetch(\"$ORIGIN/api/account/avatar\", {credentials: \"same-origin\"}).then(r => {if (!r.ok) throw new Error(\"HTTP \" + r.status); return r.blob();});",
      "exemploLinguagem": "js",
      "summary": "Read your global profile photo.",
      "desc": "Private WebP, up to 64 KiB, no cache. Change it on your account. No user ID or object URL accepted.",
      "retorno": {
        "_texto": "image/webp; Cache-Control: no-store"
      },
      "erros": {
        "401": "invalid_session",
        "404": "not_found: no photo / sem foto",
        "503": "auth_unavailable"
      },
      "returns": "image/webp; Cache-Control: no-store",
      "url": "https://agentalog.com/api/account/avatar",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/auth/logout",
      "auth": "session",
      "grupo": "Account",
      "exemplo": "// Execute no console da página do produto / Run in the product page console.\n(async () => {\n  const origin = \"$ORIGIN\";\n  const {csrf} = await fetch(origin + \"/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(origin + \"/api/auth/logout\", {\n    method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({})\n  });\n  if (!r.ok) throw new Error(\"Auth HTTP \" + r.status);\n  return r.json();\n})();",
      "exemploLinguagem": "js",
      "summary": "Revoke this product session.",
      "desc": "Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active.",
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "true"
        }
      },
      "erros": {
        "400": "invalid_request",
        "403": "invalid_origin / invalid_csrf",
        "503": "auth_unavailable: a sessão anterior é preservada / the previous session is preserved"
      },
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/auth/logout",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/account/keys",
      "auth": "session",
      "grupo": "Account",
      "summary": "List your API keys in this product.",
      "desc": "Never returns the key itself: name, last 4 characters, organization, creation, last use (hourly) and whether it still works.",
      "retorno": {
        "keys": {
          "tipo": "object[]",
          "desc": "`id`, `name`, `organizationId`, `last4`, `createdAt`, `lastUsedAt`, `revokedAt`, `active` (false when revoked or stopped by a password change / ending all sessions)."
        }
      },
      "erros": {
        "401": "invalid_session",
        "503": "auth_unavailable"
      },
      "exemplo": "await fetch(\"$ORIGIN/api/account/keys\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ keys }",
      "url": "https://agentalog.com/api/account/keys",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/account/keys/create",
      "auth": "session",
      "grupo": "Account",
      "summary": "Create an API key for agents and scripts.",
      "desc": "Needs a sign-in in the last 5 minutes; an organization key also needs a second factor in the session and the owner/admin role with this product enabled. At most 10 live keys per account and product. The key (`secret`) is returned ONCE.",
      "corpo": {
        "name": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Up to 60 characters."
        },
        "organizationId": {
          "tipo": "string",
          "nulo": true,
          "obrigatorio": true,
          "desc": "`null` for an account key."
        }
      },
      "body": {
        "name": "agent",
        "organizationId": null
      },
      "retorno": {
        "key": {
          "tipo": "object",
          "desc": "`id`, `name`, `organizationId`, `last4`, `createdAt`."
        },
        "secret": {
          "tipo": "string",
          "desc": "`mmk_…`, shown once."
        }
      },
      "erros": {
        "400": "invalid_key_name / invalid_organization",
        "401": "invalid_session / reauth_required",
        "403": "invalid_origin / invalid_csrf / organization_forbidden / organization_mfa_required",
        "409": "key_limit_reached",
        "503": "auth_unavailable"
      },
      "exemplo": "(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/keys/create\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({name: \"agent\", organizationId: null})});\n  return r.json();\n})();",
      "exemploLinguagem": "js",
      "returns": "{ key, secret }",
      "url": "https://agentalog.com/api/account/keys/create",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/account/keys/revoke",
      "auth": "session",
      "grupo": "Account",
      "summary": "Revoke one of your API keys.",
      "desc": "Stops the key at once. Repeating is harmless.",
      "corpo": {
        "id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "The key `id`."
        }
      },
      "body": {
        "id": "…"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "true"
        }
      },
      "erros": {
        "400": "invalid_key_id",
        "401": "invalid_session",
        "403": "invalid_origin / invalid_csrf",
        "404": "key_not_found",
        "503": "auth_unavailable"
      },
      "exemplo": "(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/keys/revoke\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({id: \"…\"})});\n  return r.json();\n})();",
      "exemploLinguagem": "js",
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/account/keys/revoke",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/account/apps",
      "auth": "session",
      "grupo": "Account",
      "summary": "List the apps connected to your account in this product.",
      "desc": "The MCP clients you signed in with (OAuth), such as claude.ai or ChatGPT. Never returns a token.",
      "retorno": {
        "apps": {
          "tipo": "object[]",
          "desc": "Up to 50: `id`, `nome` (the app; its host when it identifies itself by a metadata document), `criadoEm`, `usadoEm` (hourly, or null)."
        }
      },
      "erros": {
        "401": "invalid_session",
        "503": "auth_unavailable"
      },
      "exemplo": "await fetch(\"$ORIGIN/api/account/apps\", {credentials: \"same-origin\"}).then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ apps }",
      "url": "https://agentalog.com/api/account/apps",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/account/apps/revoke",
      "auth": "session",
      "grupo": "Account",
      "summary": "Disconnect an app from your account.",
      "desc": "Stops the app's access at once; it asks you to sign in again. Repeating is harmless.",
      "corpo": {
        "id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "The app `id`."
        }
      },
      "body": {
        "id": "…"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "true"
        }
      },
      "erros": {
        "400": "invalid_app_id",
        "401": "invalid_session",
        "403": "invalid_origin / invalid_csrf",
        "404": "app_not_found",
        "503": "auth_unavailable"
      },
      "exemplo": "(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/apps/revoke\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({id: \"…\"})});\n  return r.json();\n})();",
      "exemploLinguagem": "js",
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/account/apps/revoke",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/auth/wallet/agent/start",
      "auth": "none",
      "grupo": "Account",
      "summary": "Start the wallet credential of an agent without an account.",
      "desc": "No account: the wallet proves it is hers by signing the message (EIP-4361). Signing does not pay or transfer anything. The message names this product and lasts 5 minutes. Sign it with personal_sign and send it to /api/auth/wallet/agent/token.",
      "corpo": {
        "address": {
          "tipo": "string",
          "desc": "0x…, a carteira (EOA ou contrato na Base)",
          "obrigatorio": true
        }
      },
      "body": {
        "address": "0x2c7536E3605D9C16a7a3D7b1898e529396a65c23"
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/auth/wallet/agent/start -H 'content-type: application/json' -d '{\"address\":\"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23\"}'",
      "retorno": {
        "message": {
          "tipo": "string",
          "desc": "EIP-4361"
        },
        "issuedAt": {
          "tipo": "number",
          "desc": "segundos / seconds"
        },
        "expiresIn": {
          "tipo": "number",
          "desc": "300"
        }
      },
      "erros": {
        "400": "invalid_wallet_address",
        "503": "auth_unavailable"
      },
      "returns": "{ message, issuedAt, expiresIn }",
      "url": "https://agentalog.com/api/auth/wallet/agent/start",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/auth/wallet/agent/token",
      "auth": "none",
      "grupo": "Account",
      "summary": "Get the wallet credential (mmw_…) of this product.",
      "desc": "The wallet's signature of the start message, checked here (own key) or on Base (contract, EIP-1271/6492). The credential lasts 30 days: send `Authorization: Bearer mmw_…` to the routes that accept the wallet as owner (owner `x402:<address>`). Once the wallet is linked to an account, what it did here moves to the account when the person signs in.",
      "corpo": {
        "address": {
          "tipo": "string",
          "desc": "0x…, a mesma carteira do start / the same wallet as in start",
          "obrigatorio": true
        },
        "issuedAt": {
          "tipo": "number",
          "desc": "o issuedAt do start / start's issuedAt",
          "obrigatorio": true
        },
        "signature": {
          "tipo": "string",
          "desc": "personal_sign (0x…)",
          "obrigatorio": true
        }
      },
      "body": {
        "address": "0x2c7536E3605D9C16a7a3D7b1898e529396a65c23",
        "issuedAt": 1791400000,
        "signature": "0x…"
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/auth/wallet/agent/token -H 'content-type: application/json' -d '{\"address\":\"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23\",\"issuedAt\":1791400000,\"signature\":\"0x…\"}'",
      "retorno": {
        "token": {
          "tipo": "string",
          "desc": "mmw_…"
        },
        "owner": {
          "tipo": "string",
          "desc": "x402:0x…"
        },
        "expiresAt": {
          "tipo": "number",
          "desc": "segundos / seconds"
        }
      },
      "erros": {
        "400": "invalid_body",
        "401": "invalid_wallet",
        "429": "wallet_limited",
        "503": "wallet_unavailable / auth_unavailable"
      },
      "returns": "{ token, owner, expiresAt }",
      "url": "https://agentalog.com/api/auth/wallet/agent/token",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/auth/claim/wallets",
      "auth": "session",
      "grupo": "Account",
      "summary": "Move to the account what its wallets did without an account.",
      "desc": "The sign-in window calls it after every sign-in. For each wallet linked to the account: the rights bought here by x402 (owner x402:<address>) and what this product keeps for that owner. Repeating moves nothing.",
      "exemplo": "await MMConta.fetch(new URL(\"$ORIGIN/api/auth/claim/wallets\").pathname, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: \"{}\" })",
      "retorno": {
        "carteiras": {
          "tipo": "number",
          "desc": "wallets"
        },
        "direitos": {
          "tipo": "number",
          "desc": "rights moved"
        }
      },
      "erros": {
        "401": "invalid_session",
        "503": "auth_unavailable"
      },
      "returns": "{ carteiras, direitos }",
      "url": "https://agentalog.com/api/auth/claim/wallets",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/auth/claim",
      "auth": "session",
      "grupo": "Account",
      "summary": "Moves what the guest created to the signed-in account: its listings, likes and comments.",
      "desc": "Bootstrap/CSRF of this browser required; the page does it right after sign-in. Only what the guest still owns moves, in one transaction, and anything that collides with what the account already has stays with the guest. What the guest bought moves too. An old unsigned token that owns nothing here is refused. Repeating it is harmless (moves zero).",
      "corpo": {
        "guest_token": {
          "tipo": "string",
          "obrigatorio": false,
          "desc": "Guest `mr_…`; omitted, the `guest` cookie of this browser."
        }
      },
      "body": {},
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Whether the guest was recognized and moved."
        },
        "claimed": {
          "tipo": "object",
          "desc": "`product.movidos` (rows moved, per table), `product.apagados` (guest duplicates dropped) and `product.direitos` (purchases moved)."
        }
      },
      "erros": {
        "400": "invalid_product_claim / invalid_body",
        "401": "invalid_session",
        "403": "invalid_origin / invalid_csrf",
        "409": "unknown_guest (em `claimed.reason` / in `claimed.reason`)",
        "503": "product_claim_pending / auth_unavailable"
      },
      "exemplo": "(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/auth/claim\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: \"{}\"});\n  return r.json();\n})();",
      "exemploLinguagem": "js",
      "returns": "{ ok, claimed }",
      "url": "https://agentalog.com/api/auth/claim",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/api/billing",
      "auth": "none",
      "summary": "x402 configuration in force and the agent prices for contact and publishing.",
      "grupo": "Billing",
      "retorno": "Billing",
      "exemplo": "curl -s $ORIGIN/api/billing",
      "returns": "{ provider, mode, network, chain_id, pay_to, homolog, dev, dev_gate, alternavel, gratis?, cobrados?, facilitator, asset, asset_address, faucet, wallets, product, prices{listing_agent_usd} }",
      "url": "https://agentalog.com/api/billing",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/contact",
      "auth": "none",
      "summary": "Write to the people behind the product — free, for people and agents alike.",
      "grupo": "Contact",
      "desc": "One route for a question and for a sponsorship, partnership or ad proposal (`tipo`, with the placements of `GET /api/partners`). No captcha, no account, no payment. One message every 10 seconds per network: one that arrives sooner waits its turn and then goes out — no error. The message reaches the team by e-mail, with `email` as the reply address. For voice, send multipart/form-data: `dados` is this JSON (up to 32 KiB), and `audio` is one WebM, Ogg or M4A audio file (up to 2 MB). Audio can replace message. The browser records up to two minutes. Audio is attached to the owner's e-mail.",
      "corpo": {
        "name": {
          "tipo": "string",
          "desc": "What to call the person writing.",
          "obrigatorio": true
        },
        "email": {
          "tipo": "string",
          "desc": "Where to reply.",
          "obrigatorio": true
        },
        "message": {
          "tipo": "string",
          "desc": "What you want to say.",
          "obrigatorio": true
        },
        "whatsapp": {
          "tipo": "string",
          "desc": "Optional reply number with country code, such as +5561999999999."
        },
        "prefer_whatsapp": {
          "tipo": "bool",
          "desc": "Request a WhatsApp reply. Requires whatsapp."
        },
        "tipo": {
          "tipo": "string",
          "desc": "Proposal: `patrocinio`, `parceria`, `anuncio` or `consultoria`. Turns on the fields below."
        },
        "empresa": {
          "tipo": "string",
          "desc": "Who is proposing, when it is a company."
        },
        "site": {
          "tipo": "string",
          "desc": "Website of who is proposing."
        },
        "orcamento": {
          "tipo": "string",
          "desc": "Advertising: `ate_100`, `100_500`, `500_2000`, `2000_mais` or `a_combinar`. Consulting, in US dollars: `ate_2000`, `2000_5000`, `5000_10000`, `10000_mais` or `nao_sei`."
        },
        "espaco": {
          "tipo": "string[]",
          "desc": "Placement ids from `GET /api/partners`, up to 6."
        },
        "duracao": {
          "tipo": "string",
          "desc": "Exposure in days: `30`, `90` or `365`."
        },
        "pagamento": {
          "tipo": "string",
          "desc": "`usdc`, `deposito` or `a_combinar`."
        },
        "projeto": {
          "tipo": "string",
          "desc": "Consulting: the kind of project (`llm_privado`, `voz`, `dados_sensiveis`, `gpu`, `integracao` or `outro`)."
        },
        "prazo": {
          "tipo": "string",
          "desc": "Consulting: when to start (`agora`, `1_mes`, `1_3_meses` or `explorando`)."
        },
        "formato": {
          "tipo": "string",
          "desc": "Consulting: `projeto` (per scope), `mensal` (monthly) or `assessoria` (advisory)."
        },
        "pais": {
          "tipo": "string",
          "desc": "Consulting: the country of the person asking."
        },
        "fuso": {
          "tipo": "string",
          "desc": "Consulting: the IANA time zone, such as `America/New_York`."
        },
        "horarios": {
          "tipo": "string[]",
          "desc": "Consulting: up to 3 times for the call, `YYYY-MM-DDTHH:MM` in that time zone."
        }
      },
      "body": {
        "name": "Agent",
        "email": "agent@example.com",
        "message": "hello from an agent"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true` when the message was accepted."
        }
      },
      "erros": {
        "400": "Validation: `code` names the field.",
        "503": "Contact is not configured on this server."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/contact -H 'content-type: application/json' -d '{\"name\":\"Agent\",\"email\":\"agent@example.com\",\"message\":\"hello from an agent\"}'",
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/contact",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/visit",
      "auth": "none",
      "summary": "Ping from the interface that increments the day's visits. Agents need not call it.",
      "grupo": "Billing",
      "desc": "Smoke does not count: `X-MM-Smoke`, User-Agent `mm-smoke` or `smoke: true` in the body come in as `counted: false`. Only the page's own ping counts: a call from outside a browser page of the same site (robot User-Agent, or no `Sec-Fetch-Site: same-origin`) comes in as `counted: false` with `reason: \"robo\"`.",
      "corpo": {
        "p": {
          "tipo": "string",
          "desc": "Path of the visited page."
        },
        "smoke": {
          "tipo": "bool",
          "desc": "`true` marks the call as a test and it does not enter the count."
        }
      },
      "body": {
        "p": "/"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true`."
        },
        "counted": {
          "tipo": "bool",
          "desc": "Whether the visit entered the day's count."
        },
        "reason": {
          "tipo": "string",
          "desc": "Why it did not count, when `counted` is `false`.",
          "opcional": true
        }
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/visit -H 'content-type: application/json' -d '{\"p\":\"/\",\"smoke\":true}'",
      "returns": "{ ok, counted, reason? }",
      "url": "https://agentalog.com/api/visit",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/erro-cliente",
      "auth": "none",
      "summary": "Browser error report, sent by the interface itself. Agents need not call it.",
      "grupo": "Operations",
      "desc": "The interface reports on its own JS errors, unhandled rejections, scripts/CSS that failed to load and CSP blocks — once per session — and the app reports handled failures through `window.mmErro.relata`. The server validates the envelope, redacts credentials, e-mails and phone numbers, merges repeats of the same failure per minute and records an operational event; nothing is written to a database. It keeps no IP, cookie, query string or full User-Agent. Always answers 204, even for an invalid report.",
      "corpo": {
        "code": {
          "tipo": "string",
          "desc": "Failure code, `UI-` + letters/digits (`UI-JS-001` global error, `UI-PROMESSA-001`, `UI-RECURSO-001`, `UI-CSP-001`, `UI-APP-001` app report).",
          "obrigatorio": true
        },
        "phase": {
          "tipo": "string",
          "desc": "Where it broke, lowercase: `global`, `promessa`, `script`, `load_list`…",
          "obrigatorio": true
        },
        "path": {
          "tipo": "string",
          "desc": "Path of the open page, without query; numbers, hashes and tokens in it are kept as `:id`."
        },
        "message": {
          "tipo": "string",
          "desc": "Error message, up to 2000 characters."
        },
        "stack": {
          "tipo": "string",
          "desc": "Stack trace, up to 12000 characters."
        },
        "source": {
          "tipo": "string",
          "desc": "Originating script; only its path is kept."
        },
        "line": {
          "tipo": "int",
          "desc": "Line in the originating script."
        },
        "column": {
          "tipo": "int",
          "desc": "Column in the originating script."
        },
        "visivel": {
          "tipo": "bool",
          "desc": "Whether the tab was visible when it broke."
        },
        "build": {
          "tipo": "string",
          "desc": "Build of the reporting page (its `<meta name=\"build\">`), up to 64 letters, digits, `.`, `_` or `-`; it dates the failure."
        }
      },
      "body": {
        "code": "UI-APP-001",
        "phase": "carregar_lista",
        "path": "/",
        "message": "lista 500"
      },
      "retorno": {
        "_texto": "204 with no body, always — an invalid, repeated or over-cap report also gets 204."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/erro-cliente -H 'content-type: application/json' -d '{\"code\":\"UI-APP-001\",\"phase\":\"carregar_lista\",\"path\":\"/\",\"message\":\"lista 500\"}'",
      "returns": "204 with no body, always — an invalid, repeated or over-cap report also gets 204.",
      "url": "https://agentalog.com/api/erro-cliente",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/pagamento/aberto",
      "auth": "none",
      "statusOk": 202,
      "summary": "The interface reports a visible payment prompt. Agents must not call this route.",
      "grupo": "Operations",
      "desc": "An empty same-origin report, sent automatically when a payment prompt becomes visible. It starts no payment, grants no access and receives no identity or credentials. It writes no database row per report. Counts events, not unique people. The private operator dashboard separates API payment requests and browser payment views per UTC day; the two counts may overlap.",
      "headers": {
        "Origin": {
          "tipo": "string",
          "desc": "The page origin, identical to this route's origin.",
          "obrigatorio": true
        },
        "Sec-Fetch-Site": {
          "tipo": "string",
          "desc": "`same-origin`, set by the browser.",
          "obrigatorio": true
        },
        "X-MM-Payment-View": {
          "tipo": "string",
          "desc": "`1`, set by the shared component.",
          "obrigatorio": true
        }
      },
      "retorno": {
        "_texto": "202 with no body when accepted; 204 when ignored. Always no-store."
      },
      "returns": "202 with no body when accepted; 204 when ignored. Always no-store.",
      "url": "https://agentalog.com/api/pagamento/aberto",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/funil",
      "auth": "none",
      "statusOk": 202,
      "summary": "The interface reports the steps of a visit (conversion funnel). Agents must not call this route.",
      "grupo": "Operations",
      "desc": "A same-origin batch sent by the page itself: page views, engagement, offer in view, buy click, payment window, payment sent or accepted. It keeps the browser's random id, the path without query, the referring host and the utm tags; never IP, e-mail or account. It writes no database row: one line per batch in the day's journal, with a cap. Declared robots and smoke tests are left out.",
      "headers": {
        "Origin": {
          "tipo": "string",
          "desc": "The page origin, identical to this route's origin.",
          "obrigatorio": false
        },
        "Content-Type": {
          "tipo": "string",
          "desc": "`application/json` or `text/plain`.",
          "obrigatorio": true
        }
      },
      "corpo": {
        "v": {
          "tipo": "number",
          "desc": "Batch version: `1`.",
          "obrigatorio": true
        },
        "vid": {
          "tipo": "string",
          "desc": "This browser's random id (UUID v4).",
          "obrigatorio": true
        },
        "sid": {
          "tipo": "string",
          "desc": "Session id (30 idle minutes end it).",
          "obrigatorio": true
        },
        "sn": {
          "tipo": "number",
          "desc": "This browser's session number.",
          "obrigatorio": true
        },
        "pv": {
          "tipo": "string",
          "desc": "Page view id.",
          "obrigatorio": true
        },
        "e": {
          "tipo": "object[]",
          "desc": "Up to 40 events `{ t, n, p? }` from the funnel vocabulary.",
          "obrigatorio": true
        }
      },
      "retorno": {
        "_texto": "202 with no body when stored; 204 when ignored. Always no-store."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/funil -H 'content-type: text/plain' -H 'x-mm-smoke: 1' -d '{\"v\":1,\"vid\":\"0f8b9c1e-2a3b-4c5d-8e6f-7a8b9c0d1e2f\",\"sid\":\"s1abcdefgh\",\"sn\":1,\"pv\":\"p1abcdefgh\",\"e\":[{\"t\":0,\"n\":\"pagina\"}]}'",
      "returns": "202 with no body when stored; 204 when ignored. Always no-store.",
      "url": "https://agentalog.com/api/funil",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/funil/arquivos",
      "auth": "none",
      "summary": "Operator: the funnel journal days kept by this app, with the size of each.",
      "grupo": "Operations",
      "headers": {
        "Authorization": {
          "tipo": "string",
          "desc": "`Bearer <METRICS_TOKEN>`.",
          "obrigatorio": true
        }
      },
      "retorno": {
        "v": {
          "tipo": "number",
          "desc": "Stored batch version."
        },
        "produto": {
          "tipo": "string",
          "desc": "The product."
        },
        "teto": {
          "tipo": "object",
          "desc": "`bytesDia` and `dias` kept."
        },
        "dias": {
          "tipo": "object[]",
          "desc": "`{ dia, bytes }`, oldest to today."
        }
      },
      "erros": {
        "401": "Unauthorized",
        "503": "Not configured"
      },
      "exemplo": "curl -s $ORIGIN/api/funil/arquivos -H \"Authorization: Bearer $METRICS_TOKEN\"",
      "returns": "{ v, produto, teto, dias }",
      "url": "https://agentalog.com/api/funil/arquivos",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/funil/arquivo",
      "auth": "none",
      "summary": "Operator: a slice of one funnel journal day, as NDJSON, from a byte offset.",
      "grupo": "Operations",
      "desc": "Up to 4 MiB per response, cut at the last whole line. `X-MM-Funil-Proximo` says where to ask for the rest; `X-MM-Funil-Tamanho`, the day's size now.",
      "headers": {
        "Authorization": {
          "tipo": "string",
          "desc": "`Bearer <METRICS_TOKEN>`.",
          "obrigatorio": true
        }
      },
      "query": {
        "dia": {
          "tipo": "string",
          "desc": "The day, `YYYY-MM-DD` (UTC).",
          "obrigatorio": true
        },
        "desde": {
          "tipo": "number",
          "desc": "The byte to read from; `0` at the start.",
          "obrigatorio": false
        }
      },
      "retorno": {
        "_texto": "JSON lines, one per stored batch."
      },
      "erros": {
        "400": "Invalid parameters",
        "401": "Unauthorized",
        "503": "Not configured"
      },
      "exemplo": "curl -s \"$ORIGIN/api/funil/arquivo?dia=2026-09-27&desde=0\" -H \"Authorization: Bearer $METRICS_TOKEN\"",
      "returns": "JSON lines, one per stored batch.",
      "url": "https://agentalog.com/api/funil/arquivo",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/vitrine",
      "auth": "none",
      "grupo": "Public stats",
      "summary": "The product's public numbers: traffic, agents, usage and reliability, no money.",
      "desc": "Projection published hourly by the house collector, rounded to two significant digits; `null` is a missing measurement, never zero. 15-minute cache with ETag (`If-None-Match` → 304). There is no way to send numbers through this route: publishing belongs to the collector, with its own token.",
      "retorno": {
        "v": {
          "tipo": "int",
          "desc": "Contract version (1)."
        },
        "produto": {
          "tipo": "string",
          "desc": "Product id."
        },
        "publicado": {
          "tipo": "bool",
          "desc": "`false` before the collector's first publication; then only these five keys come."
        },
        "atualizado_em": {
          "tipo": "string",
          "desc": "When the collector published (ISO 8601).",
          "nulo": true
        },
        "stale": {
          "tipo": "bool",
          "desc": "`true` when the projection is older than 26 h."
        },
        "nome": {
          "tipo": "string",
          "desc": "Product name.",
          "opcional": true
        },
        "desde": {
          "tipo": "string",
          "desc": "First day the series covers.",
          "nulo": true,
          "opcional": true
        },
        "fuso": {
          "tipo": "string",
          "desc": "Time zone of the days (`UTC`).",
          "opcional": true
        },
        "hoje": {
          "tipo": "object",
          "desc": "Today: pages by class (human, AI, bot), API calls by class, machine-surface reads and product usage.",
          "opcional": true
        },
        "dias": {
          "tipo": "object[]",
          "desc": "Up to 31 days, oldest first: `dia`, `paginas`, `api`, `api_ia`, `maquina`, `visitantes`, `uso`.",
          "opcional": true
        },
        "janelas": {
          "tipo": "object",
          "desc": "7- and 30-day sums (`d7`, `d30`).",
          "opcional": true
        },
        "visitantes": {
          "tipo": "object",
          "desc": "Unique visitors at the edge over 7 days.",
          "opcional": true
        },
        "pessoas": {
          "tipo": "object",
          "desc": "GA4 when available: users, sessions, countries, devices and who arrived from AI.",
          "nulo": true,
          "opcional": true
        },
        "agentes": {
          "tipo": "object",
          "desc": "The AI agents and bots that read the most, 7 days.",
          "opcional": true
        },
        "superficies": {
          "tipo": "object",
          "desc": "Reads of OKF, llms, well-known, OpenAPI and MCP over 7 days.",
          "opcional": true
        },
        "mcp": {
          "tipo": "object",
          "desc": "MCP calls over 7 days.",
          "opcional": true
        },
        "uso": {
          "tipo": "object",
          "desc": "Real product usage per resource: label, today, 7 and 30 days.",
          "opcional": true
        },
        "contas": {
          "tipo": "object",
          "desc": "Users and guests.",
          "nulo": true,
          "opcional": true
        },
        "confiabilidade": {
          "tipo": "object",
          "desc": "Share of requests without 5xx over 7 days, and the live build.",
          "opcional": true
        },
        "catalogo": {
          "tipo": "object",
          "desc": "Size of the catalog, when the product has one.",
          "nulo": true,
          "opcional": true
        },
        "apoio": {
          "tipo": "object",
          "desc": "Impressions and clicks per sponsor, when any.",
          "opcional": true
        }
      },
      "exemplo": "curl -s $ORIGIN/api/vitrine",
      "returns": "{ v, produto, publicado, atualizado_em, stale, nome?, desde?, fuso?, hoje?, dias?, janelas?, visitantes?, pessoas?, agentes?, superficies?, mcp?, uso?, contas?, confiabilidade?, catalogo?, apoio? }",
      "url": "https://agentalog.com/api/vitrine",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/vitrine/operador",
      "auth": "none",
      "grupo": "Public stats",
      "summary": "The product's full document on the operator panel — operator token only.",
      "headers": {
        "Authorization": {
          "tipo": "string",
          "desc": "`Bearer <METRICS_TOKEN>` — the operator class.",
          "obrigatorio": true
        }
      },
      "retorno": {
        "produto": {
          "tipo": "string",
          "desc": "Product id."
        },
        "atualizado_em": {
          "tipo": "string",
          "desc": "When the collector published.",
          "nulo": true
        },
        "operador": {
          "tipo": "object",
          "desc": "The collector's full document, with what the public projection leaves out.",
          "nulo": true
        }
      },
      "erros": {
        "401": "No token, wrong token or a token of another class.",
        "503": "Worker without `METRICS_TOKEN` or without the control plane."
      },
      "exemplo": "curl -s $ORIGIN/api/vitrine/operador -H \"Authorization: Bearer $METRICS_TOKEN\"",
      "returns": "{ produto, atualizado_em, operador }",
      "url": "https://agentalog.com/api/vitrine/operador",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/vitrine/painel",
      "auth": "none",
      "grupo": "Public stats",
      "summary": "The whole house panel, in the shape the gm reads — operator token only.",
      "headers": {
        "Authorization": {
          "tipo": "string",
          "desc": "`Bearer <METRICS_TOKEN>` — the operator class.",
          "obrigatorio": true
        }
      },
      "retorno": {
        "apps": {
          "tipo": "object[]",
          "desc": "One operator document per product, ordered by id."
        },
        "updated": {
          "tipo": "string",
          "desc": "When the collector closed the round.",
          "opcional": true
        },
        "totals": {
          "tipo": "object",
          "desc": "House totals.",
          "opcional": true
        }
      },
      "erros": {
        "401": "No token, wrong token or a token of another class.",
        "503": "Worker without `METRICS_TOKEN` or without the control plane."
      },
      "exemplo": "curl -s $ORIGIN/api/vitrine/painel -H \"Authorization: Bearer $METRICS_TOKEN\"",
      "returns": "{ apps, updated?, totals? }",
      "url": "https://agentalog.com/api/vitrine/painel",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/vitrine/cursores",
      "auth": "none",
      "grupo": "Public stats",
      "summary": "The resolved-error cursor per product (`borda`, `cli`) — operator token only.",
      "headers": {
        "Authorization": {
          "tipo": "string",
          "desc": "`Bearer <METRICS_TOKEN>` — the operator class.",
          "obrigatorio": true
        }
      },
      "retorno": {
        "_texto": "JSON: `{ [product]: { borda?: ISO, cli?: ISO } }`; empty is `{}`."
      },
      "erros": {
        "401": "No token, wrong token or a token of another class.",
        "503": "Worker without `METRICS_TOKEN` or without the control plane."
      },
      "exemplo": "curl -s $ORIGIN/api/vitrine/cursores -H \"Authorization: Bearer $METRICS_TOKEN\"",
      "returns": "JSON: `{ [product]: { borda?: ISO, cli?: ISO } }`; empty is `{}`.",
      "url": "https://agentalog.com/api/vitrine/cursores",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/partners",
      "auth": "none",
      "grupo": "Partnership",
      "summary": "Partnership, sponsorship and advertising: the product's placements with a suggested price, the public numbers next to them and how to propose.",
      "desc": "Information on request, no activation: placements from the house catalogue priced in USD per 30 days (90 and 365 days discounted), sponsors in effect, an excerpt of `/api/vitrine`, the house wallet (USDC on Base) and the contact path — bank deposit, PIX or invoice are arranged in the reply. Cached for 1 hour.",
      "retorno": {
        "status": {
          "tipo": "string",
          "desc": "`sob_consulta`: information and proposal, no activation and no charge."
        },
        "produto": {
          "tipo": "string",
          "desc": "Product name."
        },
        "idioma": {
          "tipo": "string",
          "desc": "Language of the texts (the product's)."
        },
        "titulo": {
          "tipo": "string",
          "desc": "Title of the offer."
        },
        "descricao": {
          "tipo": "string",
          "desc": "One sentence about the offer."
        },
        "publico": {
          "tipo": "string",
          "desc": "Who uses the product — the audience a sponsor reaches."
        },
        "modalidades": {
          "tipo": "object[]",
          "desc": "`{ id, nome }`: patrocinio, parceria, anuncio."
        },
        "placements": {
          "tipo": "object[]",
          "desc": "The product's placements: `id`, `nome`, `onde`, `formato`, `exclusivo`, `medicao`, `price_usd_30d` (suggested; `null` is on request), `exposure[{ dias, price_usd }]` for 30, 90 and 365 days, `disponivel`."
        },
        "house_bundle": {
          "tipo": "object",
          "desc": "The house bundle: footer and agent mention across the ten products, discounted."
        },
        "parcerias": {
          "tipo": "string[]",
          "desc": "Partnership ideas the product is open to discuss."
        },
        "current_sponsors": {
          "tipo": "object[]",
          "desc": "Sponsors in effect: `id`, `nome`, `url`, `frase`, `espacos`, `ate`."
        },
        "stats": {
          "tipo": "object",
          "desc": "Excerpt of the public numbers (`hoje`, `janelas`, `agentes`, `confiabilidade`) and the `link` to `/api/vitrine`; `publicado: false` before the first publication."
        },
        "payment": {
          "tipo": "object",
          "desc": "How to pay: `rede`, `chain_id`, `ativo`, `pay_to`, `eip681` (the house wallet, when declared), `alternativas` and the `nota` — bank deposit, PIX or invoice in the reply."
        },
        "contact": {
          "tipo": "object",
          "desc": "`email`, `form_url`, `api_url` (`POST /api/contact`, free: one message every 10 s per network), `campos` (required), `campos_proposta` (the optional proposal fields, each with its accepted values), `message_template`, `instructions`."
        },
        "politica": {
          "tipo": "object",
          "desc": "Placement label, refused sectors, prepayment, deadlines."
        },
        "_links": {
          "tipo": "object",
          "desc": "`self`, `stats`, `page` (`null` until the page exists), `contact`, `casa` (the same path on the ten products)."
        }
      },
      "exemplo": "curl -s $ORIGIN/api/partners",
      "returns": "{ status, produto, idioma, titulo, descricao, publico, modalidades, placements, house_bundle, parcerias, current_sponsors, stats, payment, contact, politica, _links }",
      "url": "https://agentalog.com/api/partners",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/metrics",
      "auth": "none",
      "summary": "Metrics of the last 7 days. With the operator token, includes payments.",
      "grupo": "Billing",
      "desc": "Without credentials it returns visits, usage and accounts. With `METRICS_TOKEN` as Bearer it adds `payments` — and only on Base mainnet, because staging numbers on a finance panel mislead.",
      "headers": {
        "Authorization": {
          "tipo": "string",
          "desc": "`Bearer <METRICS_TOKEN>` to include the finance block.",
          "obrigatorio": false
        }
      },
      "retorno": "Metricas",
      "exemplo": "curl -s $ORIGIN/api/metrics -H \"Authorization: Bearer $METRICS_TOKEN\"",
      "returns": "{ app, today, today_visits, today_contacts?, days, usage, accounts, financeiro?, payments? }",
      "url": "https://agentalog.com/api/metrics",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/listings/:id/status",
      "auth": "none",
      "summary": "Moderation state of a listing — how the submitter polls for approval, with no credential.",
      "grupo": "Publish",
      "desc": "Every submission is born `pending`. An automatic safety check looks for concrete signs of fraud, malware or data theft. Listings without these signs can be approved. A risk finding or an unreadable source keeps the listing private for a person to review. This is the receipt you poll after `POST /api/listings` (its response carries this URL as `status_api`). Only the decision comes back, never the unreviewed content: the id (`lst_…`, unguessable) is all it takes, and the page itself keeps its rule — owner only until it is public. Answers are cached for 60 s per point of presence: poll every few minutes, not every second.",
      "params": {
        "id": {
          "desc": "Listing ID, from the `id` of the `POST /api/listings` response."
        }
      },
      "retorno": {
        "id": {
          "tipo": "string",
          "desc": "Listing ID."
        },
        "status": {
          "tipo": "string",
          "desc": "Moderation state. `pending` is waiting; `live` and `low` are approved; `hidden` and `blocked` are not published.",
          "valores": [
            "pending",
            "live",
            "low",
            "hidden",
            "blocked"
          ]
        },
        "public": {
          "tipo": "bool",
          "desc": "`true` when the listing is reachable in the catalog (`live` or `low`)."
        },
        "message": {
          "tipo": "string",
          "desc": "What the state means and what to do next."
        },
        "reason": {
          "tipo": "string",
          "desc": "Why it was hidden or blocked, when the moderator left a reason. Absent otherwise.",
          "opcional": true
        },
        "api": {
          "tipo": "string",
          "desc": "The listing's page (`GET /api/listings/:id`): the owner reads it with the token that created it; everybody else once it is public."
        },
        "status_api": {
          "tipo": "string",
          "desc": "This URL, to poll again."
        }
      },
      "erros": {
        "404": "No listing with this id."
      },
      "exemplo": "curl -s $ORIGIN/api/listings/ID/status",
      "returns": "{ id, status, public, message, reason?, api, status_api }",
      "url": "https://agentalog.com/api/listings/:id/status",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/okf/ping",
      "auth": "none",
      "statusOk": 202,
      "summary": "Submits OKF bundles from a domain you control, using the IndexNow protocol.",
      "grupo": "Publish",
      "desc": "No account, no payment: ownership is proved by a key file on the host, exactly as IndexNow does it. Host `https://<host>/<key>.txt` containing the key (or point `keyLocation` at another path on the SAME host), then send the bundle URLs. We answer **202**: the key has not been checked yet. Verification and reading happen on our collector, never at the edge — so nothing is published, and no URL of yours is fetched, before the key matches. Re-sending a URL is how you say the bundle changed; it goes back in line to be re-read. At most 100 URLs per request and 200 per host per UTC day. The same queue is served by `POST https://okfindex.com/api/ping`, the index's own home — search, bundle cards and statistics live there.",
      "corpo": {
        "host": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "The host that owns the bundles."
        },
        "key": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "8 to 128 characters of [a-zA-Z0-9-]."
        },
        "keyLocation": {
          "tipo": "string",
          "desc": "Where the key file lives. Defaults to `https://<host>/<key>.txt`; must be on `host`."
        },
        "urlList": {
          "tipo": "string[]",
          "obrigatorio": true,
          "desc": "Bundle `index.md` URLs. https, on `host`, ending in .md. No fixed path: the spec defines no discovery convention."
        }
      },
      "body": {
        "host": "example.com",
        "key": "a1b2c3d4e5f60718",
        "urlList": [
          "https://example.com/okf/index.md"
        ]
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "The submission was queued."
        },
        "estado": {
          "tipo": "string",
          "desc": "Always `pendente`: the key has not been checked yet."
        },
        "recebidos": {
          "tipo": "int",
          "desc": "How many distinct URLs entered the queue."
        },
        "chave_em": {
          "tipo": "string",
          "desc": "Where we will look for the key file. Check it if you are unsure."
        }
      },
      "erros": {
        "400": "Malformed body, `host`/`key` invalid or `urlList` missing.",
        "422": "A URL is not https, is not .md, or does not belong to `host` — `keyLocation` on another host too.",
        "429": "This host reached 200 bundles for the UTC day."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/okf/ping -H 'content-type: application/json' -d '{\"host\":\"example.com\",\"key\":\"a1b2c3d4e5f60718\",\"urlList\":[\"https://example.com/okf/index.md\"]}'",
      "returns": "{ ok, estado, recebidos, chave_em }",
      "url": "https://agentalog.com/api/okf/ping",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/bundles",
      "auth": "none",
      "colecao": {
        "porPagina": 24,
        "teto": 1000,
        "anda": "next_offset"
      },
      "summary": "Paginated search of the index: every live OKF bundle, from GitHub and from live domains.",
      "grupo": "Index",
      "desc": "Only `live` bundles. Free text matches the name, the tagline, the description and the origin identifier (`owner/repo:path` or the bundle URL). No `total` on purpose: `GET /api/okf/stats` has it.",
      "query": {
        "q": {
          "tipo": "string",
          "desc": "Free text over name, tagline, description and origin identifier.",
          "exemplo": "agent"
        },
        "origin": {
          "tipo": "string",
          "desc": "Provenance: found by the GitHub sweep, or submitted by a domain.",
          "valores": [
            "github",
            "domain"
          ]
        },
        "repo": {
          "tipo": "string",
          "desc": "Only bundles of one repository, `owner/repo` (case-insensitive).",
          "exemplo": "fastendpoints/fastendpoints"
        },
        "version": {
          "tipo": "string",
          "desc": "Only bundles declaring one of these `okf_version` values; comma-separated, up to 5.",
          "exemplo": "0.1,0.2"
        },
        "concept": {
          "tipo": "string",
          "desc": "Text in the indexed root content, including listed concept names and summaries (first 1000 characters); up to 80 characters."
        },
        "concepts": {
          "tipo": "string",
          "desc": "Number of entries listed by the root. Up to 5 comma-separated bands: 0,1-5,6-20,21-100,101+."
        },
        "type": {
          "tipo": "string",
          "desc": "Type declared by the root, not the types of every concept. Up to 5 comma-separated values, 40 characters each."
        },
        "license": {
          "tipo": "string",
          "desc": "Repository license. Up to 5 comma-separated values, 40 characters each."
        },
        "language": {
          "tipo": "string",
          "desc": "Only bundles whose repository language is one of these; comma-separated, up to 5 (GitHub bundles).",
          "exemplo": "TypeScript,Go"
        },
        "sort": {
          "tipo": "string",
          "desc": "Result order: arrival, last content change, name or repository stars.",
          "valores": [
            "recent",
            "updated",
            "name",
            "stars"
          ],
          "padrao": "recent"
        },
        "limit": {
          "tipo": "int",
          "desc": "Bundles per page, at most 100.",
          "padrao": 24
        },
        "offset": {
          "tipo": "int",
          "desc": "How many bundles to skip. Use `next_offset` from the previous response; the list ends at 1000.",
          "padrao": 0
        }
      },
      "retorno": "PaginaDeBundles",
      "exemplo": "curl -s '$ORIGIN/api/bundles?q=agent&sort=stars&limit=5'",
      "returns": "{ items[{id,name,tagline,description,okf_version,concepts,concept_list,type,index_url,page_url,source,repo,indexed_at,updated_at,api}], limit, offset, next_offset, next }",
      "url": "https://agentalog.com/api/bundles",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/bundles/:id",
      "auth": "none",
      "summary": "One bundle's card, by id.",
      "grupo": "Index",
      "desc": "`live` and `low` (example or fixture bundles kept out of the search) both answer here.",
      "params": {
        "id": {
          "desc": "Bundle id, the `id` of every item in the list.",
          "exemplo": "okf-fastendpoints"
        }
      },
      "retorno": "Bundle",
      "erros": {
        "404": "No bundle with that id, or it is not public."
      },
      "exemplo": "curl -s $ORIGIN/api/bundles/<id>",
      "returns": "{ id, name, tagline, description, okf_version, concepts, concept_list[{name,url,summary}], type, index_url, page_url, source{origin,via,url,host,repo,dir,path}, repo{stars,forks,pushed_at,state,language,license}, indexed_at, updated_at, api }",
      "url": "https://agentalog.com/api/bundles/:id",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/okf/stats",
      "auth": "none",
      "summary": "Size of the index by provenance, and when it last changed.",
      "grupo": "Index",
      "retorno": "IndexStats",
      "exemplo": "curl -s $ORIGIN/api/okf/stats",
      "returns": "{ total, by_origin, by_version[{v,n}], by_type[{v,n}], by_concepts[{v,n}], by_license[{v,n}], by_language[{v,n}], last_update }",
      "url": "https://agentalog.com/api/okf/stats",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/volatil",
      "auth": "none",
      "grupo": "Catalog",
      "summary": "Fresh download, install and version counters for up to 100 listings.",
      "desc": "The catalog stores the values seen at the last real change of a listing; counters and package versions change over time. These values may be cached for up to 15 minutes; `gerado_em` gives their reference date. Listings without a record are simply absent. `GET /api/listings/:id` already applies these values on top of the record.",
      "query": {
        "ids": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Comma-separated listing ids, at most 100."
        }
      },
      "retorno": {
        "itens": {
          "tipo": "object",
          "desc": "`{id: {downloads?, installs?, version?, pacotes?}}` — `pacotes` maps `registry:identifier` to its version."
        },
        "gerado_em": {
          "tipo": "string",
          "desc": "When the oldest slice read was generated (UTC)."
        },
        "ttl_s": {
          "tipo": "int",
          "desc": "How long a slice stays in the edge cache."
        }
      },
      "erros": {
        "400": "`ids` missing, invalid, or more than 100."
      },
      "exemplo": "curl -s '$ORIGIN/api/volatil?ids=skl_a,skl_b'",
      "returns": "{ itens, gerado_em, ttl_s }",
      "url": "https://agentalog.com/api/volatil",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/admin/volatil",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Publishes one group of updated counters.",
      "desc": "CARGA_TOKEN only. One slice = 1/256 of the ids (by hash), whole; submit only slices whose content changed. Nothing here touches the catalog database — that is the point.",
      "corpo": {
        "fatia": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Two hex digits; every id in `itens` must hash to it."
        },
        "gerado_em": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "UTC instant the slice was built."
        },
        "itens": {
          "tipo": "object",
          "obrigatorio": true,
          "desc": "`{id: record}`, at most 5000 ids and 1 MB."
        }
      },
      "body": {
        "fatia": "0a",
        "gerado_em": "2026-09-08 12:00:00",
        "itens": {
          "skl_a": {
            "downloads": 138,
            "version": "1.1"
          }
        }
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Stored."
        },
        "fatia": {
          "tipo": "string",
          "desc": "The slice stored."
        },
        "itens": {
          "tipo": "int",
          "desc": "Records in it."
        }
      },
      "erros": {
        "400": "Malformed slice, id outside the slice, or above the ceilings.",
        "401": "CARGA_TOKEN required.",
        "503": "Object storage not configured."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/volatil -H \"Authorization: Bearer $CARGA_TOKEN\" -d @fatia.json",
      "returns": "{ ok, fatia, itens }",
      "url": "https://agentalog.com/api/admin/volatil",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/sitemap",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Receives one shard of the listings sitemap (or its manifest) for publication.",
      "desc": "CARGA_TOKEN only. Submit catalog shards (up to 50,000 listings each, ordered by id) and sends only the shard whose content changed, then the manifest (how many shards, when). The Worker serves `/sitemap-listings.xml` (index) and `/sitemap-listings-N.xml` (shard) from that storage, with cache at the edge; the catalog database is never read for it.",
      "corpo": {
        "parte": {
          "tipo": "int",
          "desc": "Shard number, 1-based (at most 200). Omit when sending the manifest."
        },
        "gerado_em": {
          "tipo": "string",
          "desc": "UTC instant the shard was built."
        },
        "urls": {
          "tipo": "object[]",
          "desc": "`{id, lastmod?}` per listing, at most 50,000; `lastmod` is the listing's `updated_at`."
        },
        "manifesto": {
          "tipo": "object",
          "desc": "`{partes, gerado_em}` — sent once after the shards; replaces the previous manifest."
        }
      },
      "body": {
        "parte": 1,
        "gerado_em": "2026-09-13 12:00:00",
        "urls": [
          {
            "id": "mcp_x",
            "lastmod": "2026-09-10 08:00:00"
          }
        ]
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Stored."
        },
        "parte": {
          "tipo": "int",
          "desc": "The shard stored (absent for the manifest).",
          "opcional": true
        },
        "urls": {
          "tipo": "int",
          "desc": "Listings in it (absent for the manifest).",
          "opcional": true
        },
        "manifesto": {
          "tipo": "object",
          "desc": "The manifest stored (absent for a shard).",
          "opcional": true
        }
      },
      "erros": {
        "400": "Malformed shard or manifest, invalid id, or above the ceilings.",
        "401": "CARGA_TOKEN required.",
        "503": "Object storage not configured."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/sitemap -H \"Authorization: Bearer $CARGA_TOKEN\" -d @parte-1.json",
      "returns": "{ ok, parte?, urls?, manifesto? }",
      "url": "https://agentalog.com/api/admin/sitemap",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/listings/:id/history",
      "auth": "none",
      "summary": "Timeline of the listing's repository: the last events (stale, gone, renamed, README or manifest changed).",
      "grupo": "Catalog",
      "desc": "The listing page carries the same list as `historico`; updates may be cached for up to 15 minutes. An empty list means no change since the series began — the listing still exists. Stale means no push for 12 months. Reading this endpoint does not refresh the record.",
      "params": {
        "id": {
          "desc": "Listing ID, from `Anuncio.id`."
        }
      },
      "retorno": "Historico",
      "erros": {
        "401": "Invalid MAT pass.",
        "402": "Free allowance or MAT credits exhausted; buy a package.",
        "404": "The listing does not exist or is not visible.",
        "409": "Retry conflict or pending read.",
        "413": "Basic read exceeds 1 MiB.",
        "429": "Temporary reading capacity.",
        "503": "Origin or payment verification temporarily unavailable."
      },
      "exemplo": "curl -s $ORIGIN/api/listings/ID/history",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "returns": "{ id, historico, gerado_em, ttl_s, api }",
      "url": "https://agentalog.com/api/listings/:id/history",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/contadores",
      "auth": "none",
      "summary": "Likes, comments and visits of every listing that has any, read from where they are written.",
      "grupo": "Catalog",
      "desc": "Counters include visits, likes and comments. The app and catalog read the same counter table; there is no collection delay. Only listings with a counter above zero are returned. Smoke traffic never counts. Cached for 60 seconds.",
      "retorno": "Contadores",
      "exemplo": "curl -s $ORIGIN/api/contadores",
      "returns": "{ gerado_em, total, truncado, itens }",
      "url": "https://agentalog.com/api/contadores",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/fila",
      "auth": "none",
      "summary": "The public snapshot of the enrichment queue: how much of the catalog has been checked.",
      "grupo": "Operation",
      "desc": "It is public because it is about the catalog's health, not about anyone: aggregate numbers only, no identifiable listing.",
      "retorno": "EstadoFila",
      "exemplo": "curl -s $ORIGIN/api/fila",
      "returns": "{ ok, fila{total,concluidos,vencidos,com_falha,processados,estados,motivos} }",
      "url": "https://agentalog.com/api/fila",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/admin/fila",
      "auth": "token",
      "summary": "The enrichment robot pushes the snapshot of its own queue here.",
      "grupo": "Operation",
      "desc": "Robot credential only: this does not write to the catalog, so there is no reason to accept admin.",
      "corpo": {
        "fila": {
          "tipo": "object",
          "desc": "The queue snapshot: totals, states and reasons.",
          "obrigatorio": true
        }
      },
      "body": {
        "fila": {
          "total": 20182,
          "concluidos": 11675
        }
      },
      "retorno": "Ok",
      "erros": {
        "400": "Body without `fila`.",
        "401": null
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/fila -H \"Authorization: Bearer $TOKEN_ROBO\" -H 'content-type: application/json' -d '{\"fila\":{}}'",
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/admin/fila",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/repos",
      "auth": "token",
      "summary": "The enricher writes here what it found out about a repository: stars, forks, state.",
      "grupo": "Operation",
      "desc": "Accepts the enricher's credential OR the admin's — the robot has its own, with less privilege, and the admin gets in to operate by hand without depending on the robot. The Worker collects nothing: it only stores what was already checked outside it.",
      "corpo": {
        "itens": {
          "tipo": "object[]",
          "desc": "Up to 500 checked repositories with repo_slug, stars, forks, PRs, pushed_at and state. Optional listing_ids is an array of up to 50 listing IDs (1–160 letters, digits, underscore or hyphen); only matching listings of that repository are updated. An empty array stores only the repository fact. Omit it only for legacy fanout, still subject to the daily budget.",
          "obrigatorio": true
        }
      },
      "body": {
        "itens": [
          {
            "repo_slug": "x/y",
            "stars": 120,
            "repo_estado": "ativo"
          }
        ]
      },
      "retorno": "Ok",
      "erros": {
        "400": "Body without `itens` or malformed item.",
        "401": "Neither the enricher's nor the admin's credential.",
        "429": "Daily publication budget exhausted; retain pending facts."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/repos -H \"Authorization: Bearer $TOKEN_ROBO\" -H 'content-type: application/json' -d '{\"itens\":[]}'",
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/admin/repos",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/admin/listings",
      "auth": "token",
      "summary": "The moderation queue. Without a filter, brings what is pending.",
      "grupo": "Operation",
      "desc": "Accepts `ADMIN_TOKEN` as Bearer or the `ADMIN_EMAIL` session. Each item includes the last automatic moderation reason and review time in `moderation`.",
      "query": {
        "status": {
          "tipo": "string",
          "desc": "Which state to list.",
          "valores": [
            "pending",
            "live",
            "hidden",
            "blocked"
          ],
          "padrao": "pending"
        }
      },
      "retorno": {
        "items": {
          "tipo": "Anuncio[]",
          "desc": "The listings in that state."
        }
      },
      "erros": [
        401
      ],
      "exemplo": "curl -s '$ORIGIN/api/admin/listings?status=pending' -H \"Authorization: Bearer $ADMIN_TOKEN\"",
      "returns": "{ items[{seguranca_nivel?,seguranca_estado?,seguranca_api?,moderation?,id,kind,category,name,tagline,body,url,status,origin,origin_id,install,source,transporte,ns,versao,oficial_status,repo_host,topico,linguagem,licenca,repo_topics,repo_slug,stars,forks,prs_abertos,pushed_at,repo_estado,likes,comments,visits,created_at,updated_at,mine,api,go,comments_api,readme_api?,historico?,readme_fonte?,readme_bytes,readme_sha,readme_em,payload}] }",
      "url": "https://agentalog.com/api/admin/listings",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/admin/listings/:id",
      "auth": "token",
      "summary": "Reads one submitted listing for moderation, even beyond the first queue page.",
      "grupo": "Operation",
      "desc": "Accepts `ADMIN_TOKEN` as Bearer or the `ADMIN_EMAIL` session. Includes the full submitted description and URL; it never approves on GET.",
      "params": {
        "id": {
          "desc": "Listing ID, 1–160 letters, digits, underscores or hyphens."
        }
      },
      "retorno": "Anuncio",
      "erros": [
        401,
        404
      ],
      "exemplo": "curl -s $ORIGIN/api/admin/listings/ID -H \"Authorization: Bearer $ADMIN_TOKEN\"",
      "returns": "{ seguranca_nivel?, seguranca_estado?, seguranca_api?, moderation?, id, kind, category, name, tagline, body, url, status, origin, origin_id, install, source, transporte, ns, versao, oficial_status, repo_host, topico, linguagem, licenca, repo_topics, repo_slug, stars, forks, prs_abertos, pushed_at, repo_estado, likes, comments, visits, created_at, updated_at, mine, api, go, comments_api, readme_api?, historico?, readme_fonte?, readme_bytes, readme_sha, readme_em, payload }",
      "url": "https://agentalog.com/api/admin/listings/:id",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/listings/:id",
      "auth": "token",
      "summary": "Decides the fate of a listing in the queue: approve, hide or block.",
      "grupo": "Operation",
      "desc": "A submitter with an account gets one e-mail per decision (the decision, the reason and the page or the receipt); repeating the same state sends nothing. A guest or agent owner has no e-mail and polls `GET /api/listings/:id/status`.",
      "params": {
        "id": {
          "desc": "ID of the listing to moderate."
        }
      },
      "corpo": {
        "action": {
          "tipo": "string",
          "desc": "What to do with the listing.",
          "valores": [
            "approve",
            "hide",
            "block"
          ],
          "obrigatorio": true
        },
        "reason": {
          "tipo": "string",
          "desc": "Why, for whoever submitted: it comes back in `GET /api/listings/:id/status`. Required for `block`, optional for `hide`, ignored for `approve` (which clears an earlier reason). Up to 300 characters."
        },
        "fix": {
          "tipo": "object",
          "desc": "Corrections applied together with `approve`, any of `name`, `tagline`, `body`, `category`, with the same validation as a submission. `url` and `kind` are refused: a new URL is what sends a listing back to the queue."
        }
      },
      "body": {
        "action": "hide",
        "reason": "The URL has answered 404 since yesterday."
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always `true`."
        },
        "status": {
          "tipo": "string",
          "desc": "The state the listing ended up in."
        },
        "reason": {
          "tipo": "string",
          "desc": "The reason stored with the decision; empty when none."
        }
      },
      "erros": {
        "400": "`action` outside the list; `reason` missing on `block` or above 300 characters; `fix` outside `approve`; `fix_url` (URL or kind inside the fix); or the refused field of the fix (`name`, `tagline`, `category`, `golpe`).",
        "401": null,
        "404": null
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/listings/ID -H \"Authorization: Bearer $ADMIN_TOKEN\" -H 'content-type: application/json' -d '{\"action\":\"approve\"}'",
      "returns": "{ ok, status, reason }",
      "url": "https://agentalog.com/api/admin/listings/:id",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "DELETE",
      "path": "/api/admin/listings/:id",
      "auth": "token",
      "summary": "Permanently deletes one community submission and its catalog data.",
      "grupo": "Operation",
      "desc": "Admin only. A browser session also requires the standard CSRF header. Send the current name and updated_at to confirm the exact record. Imported records are refused. The transaction removes comments, likes, visits, README and security results. Paid watch and billing history remain. No decision e-mail is sent.",
      "params": {
        "id": {
          "desc": "ID of the community submission."
        }
      },
      "corpo": {
        "name": {
          "tipo": "string",
          "desc": "Exact current name.",
          "obrigatorio": true
        },
        "updated_at": {
          "tipo": "string",
          "desc": "Exact current updated_at.",
          "obrigatorio": true
        }
      },
      "body": {
        "name": "Test submission",
        "updated_at": "2026-10-14T10:00:00.000Z"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Always true."
        },
        "deleted": {
          "tipo": "string",
          "desc": "Deleted listing ID."
        }
      },
      "erros": {
        "400": "Confirmation fields missing.",
        "401": null,
        "403": "Invalid CSRF proof.",
        "404": null,
        "409": "Imported record or record changed since it was read."
      },
      "exemplo": "curl -s -XDELETE $ORIGIN/api/admin/listings/ID -H \"Authorization: Bearer $ADMIN_TOKEN\" -H 'content-type: application/json' -d '{\"name\":\"Test submission\",\"updated_at\":\"2026-10-14T10:00:00.000Z\"}'",
      "returns": "{ ok, deleted }",
      "url": "https://agentalog.com/api/admin/listings/:id",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/admin/carga",
      "auth": "token",
      "summary": "State of the catalog's load sources: last batch, count and failures.",
      "grupo": "Operation",
      "desc": "Accepts `ADMIN_TOKEN` as Bearer or the `ADMIN_EMAIL` session.",
      "query": {
        "fonte": {
          "tipo": "string",
          "desc": "Restricts to one source, e.g. `official_mcp`."
        }
      },
      "retorno": "Carga",
      "erros": [
        401
      ],
      "exemplo": "curl -s $ORIGIN/api/admin/carga -H \"Authorization: Bearer $ADMIN_TOKEN\"",
      "returns": "{ fontes, falhas, runs, orcamento }",
      "url": "https://agentalog.com/api/admin/carga",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/carga",
      "auth": "token",
      "summary": "Requests an update or marks a failure alert as seen.",
      "desc": "run/reset enqueue a request for the next scheduled operation. They do not run synchronously.",
      "grupo": "Operation",
      "corpo": {
        "action": {
          "tipo": "string",
          "desc": "What to do with the source.",
          "valores": [
            "run",
            "visto",
            "reset"
          ],
          "obrigatorio": true
        },
        "fonte": {
          "tipo": "string",
          "desc": "Which source to load or mark, e.g. `official_mcp`."
        }
      },
      "body": {
        "action": "run",
        "fonte": "official_mcp"
      },
      "retorno": "Ok",
      "erros": {
        "400": "`action` outside the list or unknown source.",
        "401": null
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/carga -H \"Authorization: Bearer $ADMIN_TOKEN\" -H 'content-type: application/json' -d '{\"action\":\"run\",\"fonte\":\"official_mcp\"}'",
      "returns": "{ ok }",
      "url": "https://agentalog.com/api/admin/carga",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/internal/moderation",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Reads one new community listing for automatic review on c3.",
      "desc": "MODERATION_TOKEN only. Returns the newest pending community listing not yet analyzed, with a snapshot bound to its exact content. No admin or imported catalog access.",
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Request accepted."
        },
        "item": {
          "tipo": "object",
          "desc": "Listing and SHA-256 snapshot, or null when the queue is empty."
        }
      },
      "erros": {
        "401": "MODERATION_TOKEN required."
      },
      "exemplo": "curl -s $ORIGIN/api/internal/moderation -H \"Authorization: Bearer $MODERATION_TOKEN\"",
      "returns": "{ ok, item }",
      "url": "https://agentalog.com/api/internal/moderation",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/internal/moderation",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Confirms a bounded automatic review result.",
      "desc": "MODERATION_TOKEN only. `approve` is confined to a pending community listing with an HTTPS URL. The review checks for concrete signs of fraud, malware or data theft. `review` leaves the listing private and sends the owner the reason. The URL, update time and content snapshot must still match.",
      "corpo": {
        "id": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Pending listing ID."
        },
        "url": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Exact URL read from the queue."
        },
        "updated_at": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Listing update time read from the queue."
        },
        "snapshot": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "SHA-256 content snapshot read from the queue, including installation and source fields."
        },
        "decision": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "approve or review."
        },
        "reason": {
          "tipo": "string",
          "desc": "Required for review; maximum 300 characters."
        },
        "description": {
          "tipo": "string",
          "desc": "Optional text for an empty listing body. Existing author text is preserved. The automatic classifier does not rewrite the description."
        },
        "budget_notice": {
          "tipo": "string",
          "desc": "near_limit only when the monthly moderation budget crosses 80%."
        }
      },
      "body": {
        "id": "lst_ID",
        "url": "https://example.com/tools",
        "updated_at": "2026-09-27 19:00:00",
        "snapshot": "SHA256",
        "decision": "review",
        "reason": "Cannot verify the source."
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Decision recorded."
        },
        "decision": {
          "tipo": "string",
          "desc": "approve or review."
        },
        "id": {
          "tipo": "string",
          "desc": "Listing ID."
        },
        "owner_notified": {
          "tipo": "bool",
          "desc": "The owner's mail server accepted the result notice."
        }
      },
      "erros": {
        "400": "Invalid result or approval outside the narrow scope.",
        "401": "MODERATION_TOKEN required.",
        "409": "Listing changed or was already reviewed."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/internal/moderation -H \"Authorization: Bearer $MODERATION_TOKEN\" -H \"content-type: application/json\" -d @result.json",
      "returns": "{ ok, decision, id, owner_notified }",
      "url": "https://agentalog.com/api/internal/moderation",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/admin/okf/pendentes",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Reads the queue of OKF bundles submitted through `POST /api/okf/ping`.",
      "desc": "CARGA_TOKEN only. Up to 50 submissions, oldest first. The edge never fetches a key file or a bundle: submissions require key verification before reading the submitter's host — otherwise a stranger could make us fetch arbitrary URLs.",
      "retorno": {
        "pendentes": {
          "tipo": "object[]",
          "desc": "{bundle_url, host, chave, chave_url} still waiting for key verification."
        },
        "lote": {
          "tipo": "int",
          "desc": "Batch ceiling; a full page may have more pending items."
        }
      },
      "erros": {
        "401": "CARGA_TOKEN required."
      },
      "exemplo": "curl -s $ORIGIN/api/admin/okf/pendentes -H \"Authorization: Bearer $CARGA_TOKEN\"",
      "returns": "{ pendentes, lote }",
      "url": "https://agentalog.com/api/admin/okf/pendentes",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/okf/pendentes",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Records verification of submitted bundles.",
      "desc": "CARGA_TOKEN only. Changes the QUEUE, never the catalog: an approved bundle reaches the mosaic through the normal catalog difference, because two doors writing listings would be two truths. A network failure is not a verdict — the submission stays pending and comes back next round.",
      "corpo": {
        "resultados": {
          "tipo": "object[]",
          "obrigatorio": true,
          "desc": "{bundle_url, estado: verificado|recusado, motivo}. At most 50; `motivo` is chave|bundle|okf_version."
        }
      },
      "body": {
        "resultados": [
          {
            "bundle_url": "https://example.com/okf/index.md",
            "estado": "verificado"
          }
        ]
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "The batch was applied."
        },
        "marcados": {
          "tipo": "int",
          "desc": "How many queue rows were touched."
        }
      },
      "erros": {
        "400": "Missing `resultados`, more than 50, or an unknown state.",
        "401": "CARGA_TOKEN required."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/okf/pendentes -H \"Authorization: Bearer $CARGA_TOKEN\" -H 'content-type: application/json' -d '{\"resultados\":[]}'",
      "returns": "{ ok, marcados }",
      "url": "https://agentalog.com/api/admin/okf/pendentes",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/feeds",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Applies prepared feed-index differences for publication.",
      "desc": "Requires CARGA_TOKEN. Maximum 100 items and 2 MB. A daily budget slice of its own stops publication with 429 (`alvo: \"feeds\"`) without holding the catalog back; unconfirmed items remain pending.",
      "corpo": {
        "itens": {
          "tipo": "object[]",
          "obrigatorio": true,
          "desc": "Each delta has id, novo, and either valores (changed columns only) or remove:true."
        },
        "contagens": {
          "tipo": "object[]",
          "desc": "Optional `{ chave, n }` list with the count per facet value, computed on the collector."
        }
      },
      "body": {
        "itens": []
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "The complete batch was accepted."
        },
        "aceitos": {
          "tipo": "int",
          "desc": "Accepted items, including idempotent retries."
        },
        "recusados": {
          "tipo": "int",
          "desc": "Zero on success; invalid batches fail in full."
        }
      },
      "erros": {
        "400": "Invalid delta or facet count.",
        "401": "CARGA_TOKEN required.",
        "413": "More than 100 items or a body over 2 MB.",
        "429": "Daily feed slice exhausted; retain pending items."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/feeds -H \"Authorization: Bearer $CARGA_TOKEN\" -d @lote.json",
      "returns": "{ ok, aceitos, recusados }",
      "url": "https://agentalog.com/api/admin/feeds",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/catalogo",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Applies prepared catalog differences for publication.",
      "desc": "Requires CARGA_TOKEN. Imported sources only; no SQL, community records or user fields. Maximum 25 items and 2 MB. An atomic daily budget stops publication with 429; retain unconfirmed differences.",
      "corpo": {
        "itens": {
          "tipo": "object[]",
          "obrigatorio": true,
          "desc": "Each delta has id, origin, origin_id, novo, valores (changed catalog columns only), optional prepared pacotes and owner for new rows."
        }
      },
      "body": {
        "itens": []
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "The complete batch was accepted."
        },
        "aceitos": {
          "tipo": "int",
          "desc": "Accepted items, including idempotent retries."
        },
        "recusados": {
          "tipo": "int",
          "desc": "Zero on success; invalid batches fail in full."
        }
      },
      "erros": {
        "400": "Invalid delta.",
        "401": "CARGA_TOKEN required.",
        "409": "Identity differs from destination.",
        "413": "Batch or body too large.",
        "429": "Daily publication budget exhausted; `alvo` names the slice that ran out (`catalogo` or `okf`, each with its own cap)."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/catalogo -H \"Authorization: Bearer $CARGA_TOKEN\" -H 'content-type: application/json' -d '{\"itens\":[]}'",
      "returns": "{ ok, aceitos, recusados }",
      "url": "https://agentalog.com/api/admin/catalogo",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/readmes",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Stores documentation for listings without a repository.",
      "desc": "Requires CARGA_TOKEN. The listing exposes the document with attribution. Unchanged text is not written again. Maximum 20 items and 2 MB.",
      "corpo": {
        "itens": {
          "tipo": "object[]",
          "obrigatorio": true,
          "desc": "{listing_id, fonte: npm|pypi, readme} — README of 1 to 200,000 characters; no repeated listing_id."
        }
      },
      "body": {
        "itens": [
          {
            "listing_id": "mcp_x",
            "fonte": "npm",
            "readme": "# X"
          }
        ]
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "The batch was processed."
        },
        "aceitos": {
          "tipo": "int",
          "desc": "READMEs stored (new or changed)."
        },
        "iguais": {
          "tipo": "int",
          "desc": "Unchanged READMEs: nothing written."
        },
        "recusados": {
          "tipo": "string[]",
          "desc": "listing_ids unknown to the catalog; the rest of the batch is applied."
        }
      },
      "erros": {
        "400": "Malformed item.",
        "401": "CARGA_TOKEN required.",
        "413": "More than 20 items or body over 2 MB.",
        "429": "Daily publication budget exhausted; retain pending documents.",
        "503": "R2 not configured: nothing indexed."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/readmes -H \"Authorization: Bearer $CARGA_TOKEN\" -H 'content-type: application/json' -d '{\"itens\":[]}'",
      "returns": "{ ok, aceitos, iguais, recusados }",
      "url": "https://agentalog.com/api/admin/readmes",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/fts",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Indexes one page of live listings into the full-text search index.",
      "desc": "Requires CARGA_TOKEN. Pages by rowid: `apos` is the last rowid already indexed, `limite` the page size (≤ 500). Each page reserves 5 write units per listing in the daily catalog budget before writing; 429 means try tomorrow. An empty page marks the index ready (`fts:pronto`) and the search switches from LIKE to the index.",
      "corpo": {
        "apos": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Last rowid already indexed; 0 to start."
        },
        "limite": {
          "tipo": "int",
          "desc": "Page size, 1–500 (default 500)."
        }
      },
      "body": {
        "apos": 0,
        "limite": 500
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "The page was processed."
        },
        "indexados": {
          "tipo": "int",
          "desc": "Listings written to the index in this page."
        },
        "ultimo": {
          "tipo": "int",
          "desc": "Last rowid indexed — send it back as `apos`."
        },
        "pronto": {
          "tipo": "bool",
          "desc": "`true` when there was nothing left: the index covers the catalog."
        }
      },
      "erros": {
        "400": "Invalid page.",
        "401": "CARGA_TOKEN required.",
        "429": "Daily catalog budget exhausted."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/fts -H \"Authorization: Bearer $CARGA_TOKEN\" -H 'content-type: application/json' -d '{\"apos\":0,\"limite\":500}'",
      "returns": "{ ok, indexados, ultimo, pronto }",
      "url": "https://agentalog.com/api/admin/fts",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/admin/carga/c3",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Reads pending operator commands and an indexed community delta.",
      "desc": "CARGA_TOKEN only. Up to 100 community rows ordered by (updated_at,id), older than one minute. Imported catalog rows are never read. A full page advances to its last row; a short page advances to ate with empty apos.",
      "query": {
        "desde": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "UTC cursor, YYYY-MM-DD HH:mm:ss."
        },
        "apos": {
          "tipo": "string",
          "desc": "ID after the last received row; empty for a new time boundary."
        }
      },
      "retorno": {
        "pedidos": {
          "tipo": "object[]",
          "desc": "Commands {fonte,id,acao}; restricted to the operation service."
        },
        "comunidade": {
          "tipo": "object[]",
          "desc": "Changed {id,source,status,updated_at} records."
        },
        "ate": {
          "tipo": "string",
          "desc": "Exclusive UTC upper bound of the feed."
        }
      },
      "erros": {
        "400": "Invalid cursor.",
        "401": "CARGA_TOKEN required."
      },
      "exemplo": "curl -sG $ORIGIN/api/admin/carga/c3 --data-urlencode \"desde=2026-09-06 00:00:00\" -H \"Authorization: Bearer $CARGA_TOKEN\"",
      "returns": "{ pedidos, comunidade, ate }",
      "url": "https://agentalog.com/api/admin/carga/c3",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/carga/c3",
      "auth": "token",
      "grupo": "Operation",
      "summary": "Publishes source status and acknowledges operator commands completed by the operation service.",
      "desc": "CARGA_TOKEN only. Up to 12 statuses and acknowledgements. A retry with the same run ID does not rewrite status; an old acknowledgement cannot erase a newer command.",
      "corpo": {
        "estados": {
          "tipo": "object[]",
          "obrigatorio": true,
          "desc": "Source run summaries: fonte,id,status,cursor,updated_since,erro,pages,imported,skipped,more,started_at,finished_at."
        },
        "aceites": {
          "tipo": "object[]",
          "obrigatorio": true,
          "desc": "Completed command {fonte,id} pairs."
        }
      },
      "body": {
        "estados": [],
        "aceites": []
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Accepted."
        },
        "estados": {
          "tipo": "int",
          "desc": "Accepted statuses."
        },
        "aceites": {
          "tipo": "int",
          "desc": "Accepted command acknowledgements."
        }
      },
      "erros": {
        "400": "Invalid status or acknowledgement.",
        "401": "CARGA_TOKEN required.",
        "429": "Daily budget exhausted."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/carga/c3 -H \"Authorization: Bearer $CARGA_TOKEN\" -H 'content-type: application/json' -d '{\"estados\":[],\"aceites\":[]}'",
      "returns": "{ ok, estados, aceites }",
      "url": "https://agentalog.com/api/admin/carga/c3",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/credito",
      "auth": "none",
      "summary": "Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house.",
      "grupo": "Credit",
      "preco_usd_faixa": [
        0.1,
        25
      ],
      "query": {
        "usd": {
          "tipo": "number",
          "desc": "Package: 0.1, 1, 5, 10 or 25 dollars.",
          "obrigatorio": true,
          "enum": [
            0.1,
            1,
            5,
            10,
            25
          ]
        }
      },
      "retorno": {
        "token": {
          "tipo": "string",
          "desc": "Bearer token for the balance (`cred_…`). Shown ONCE — it cannot be recovered."
        },
        "saldo_usd": {
          "tipo": "string",
          "desc": "Credited balance."
        },
        "guarde": {
          "tipo": "string",
          "desc": "Warning that the token is the bearer of the credit."
        },
        "usar": {
          "tipo": "string",
          "desc": "How to present the token on paid routes."
        },
        "saldo_em": {
          "tipo": "string",
          "desc": "Where to check balance and statement."
        }
      },
      "erros": {
        "400": "Package outside the list (0.1, 1, 5, 10 or 25).",
        "402": "Unpaid — the body carries the x402 `accepts[]`."
      },
      "exemplo": "curl -s -XPOST '$ORIGIN/api/credito?usd=10'",
      "returns": "{ token, saldo_usd, guarde, usar, saldo_em }",
      "url": "https://agentalog.com/api/credito",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/credito",
      "auth": "credito",
      "summary": "Credit balance and statement — the latest movements, without returning the token.",
      "grupo": "Credit",
      "retorno": {
        "saldo_micros": {
          "tipo": "int",
          "desc": "Balance in micro-dollars (1e-6 USD)."
        },
        "saldo_usd": {
          "tipo": "string",
          "desc": "Formatted balance."
        },
        "criado_em": {
          "tipo": "string",
          "desc": "When the credit was opened."
        },
        "movimentos": {
          "tipo": "object[]",
          "desc": "Recent credits and debits, with product and resource."
        }
      },
      "erros": {
        "401": "No token, or unknown token."
      },
      "exemplo": "curl -s $ORIGIN/api/credito -H 'Authorization: Bearer cred_…'",
      "returns": "{ saldo_micros, saldo_usd, criado_em, movimentos }",
      "url": "https://agentalog.com/api/credito",
      "auth_detail": "Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance."
    },
    {
      "method": "GET",
      "path": "/api/credito/pix",
      "auth": "none",
      "summary": "Credit by Pix (Brazil): the key, the fixed rate, the packs in reais and what the receipt accepts.",
      "grupo": "Credit",
      "retorno": {
        "chave": {
          "tipo": "string",
          "desc": "The Pix key that receives the payment."
        },
        "brl_por_usd": {
          "tipo": "number",
          "desc": "Fixed rate used for the packs."
        },
        "pacotes": {
          "tipo": "object[]",
          "desc": "The packs (3, 5, 10 or 25 dollars), each with `brl_centavos` and `copia_e_cola` (the Pix copy-and-paste code for the amount, the same text as the QR: the bank app comes with the amount filled in)."
        },
        "comprovante": {
          "tipo": "object",
          "desc": "Accepted types (photo or PDF) and the maximum size, in bytes."
        },
        "liberacao": {
          "tipo": "string",
          "desc": "`manual`: the owner checks the Pix and releases it."
        }
      },
      "exemplo": "curl -s $ORIGIN/api/credito/pix",
      "returns": "{ chave, brl_por_usd, pacotes, comprovante, liberacao }",
      "url": "https://agentalog.com/api/credito/pix",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/credito/pix",
      "auth": "none",
      "summary": "Request credit paid by Pix: multipart with `usd`, `comprovante` (photo or PDF up to 2 MB) and `email`; the rest is optional.",
      "desc": "The credit code comes back in the response and works once the owner checks the Pix and releases it (by hand, usually the same day). `email` is required: it is how the owner reaches the person. Optional: `nome`, `pagina` (the page the request came from, up to 2,000 characters) and what the person was buying when the 402 came — `recurso` (up to 2,000), `descricao` (up to 300) and `preco_usd` (decimal, e.g. `0.50`); and `navegador_id` (a UUID that links the requests from the same browser). Everything that arrives is recorded with the request — the receipt included —, with the signed-in account (checked by the session cookie), the network and browser.",
      "grupo": "Credit",
      "retorno": {
        "id": {
          "tipo": "string",
          "desc": "Request id, to follow it."
        },
        "estado": {
          "tipo": "string",
          "desc": "`pendente` until the decision."
        },
        "credito": {
          "tipo": "string",
          "desc": "The `cred_…` token, shown ONCE; it works after the release."
        },
        "estado_em": {
          "tipo": "string",
          "desc": "Where to follow the request."
        }
      },
      "erros": {
        "400": "Pack outside the list (3, 5, 10 or 25), no receipt or no valid e-mail.",
        "413": "Receipt above 2 MB.",
        "415": "Receipt that is neither a photo (JPEG, PNG, WebP) nor a PDF.",
        "429": "This network already sent today's requests.",
        "502": "The e-mail to the owner did not go out: the request is recorded as `falhou`; send it again.",
        "503": "Review queue full, or Pix not available in this app."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/credito/pix -F usd=5 -F email=you@company.com -F comprovante=@pix.pdf",
      "returns": "{ id, estado, credito, estado_em }",
      "url": "https://agentalog.com/api/credito/pix",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/credito/pix/:id",
      "auth": "none",
      "summary": "Status of a Pix credit request: `pendente`, `liberado`, `recusado` or `falhou`.",
      "grupo": "Credit",
      "params": {
        "id": {
          "desc": "Request id (32 hex).",
          "exemplo": "0123456789abcdef0123456789abcdef"
        }
      },
      "retorno": {
        "estado": {
          "tipo": "string",
          "desc": "`pendente`, `liberado`, `recusado` or `falhou` (the e-mail to the owner did not go out; send again)."
        },
        "usd": {
          "tipo": "int",
          "desc": "The requested pack."
        },
        "decidido_em": {
          "tipo": "string",
          "desc": "When the owner decided, or `null`."
        }
      },
      "erros": {
        "404": "Unknown request."
      },
      "exemplo": "curl -s $ORIGIN/api/credito/pix/0123456789abcdef0123456789abcdef",
      "returns": "{ estado, usd, decidido_em }",
      "url": "https://agentalog.com/api/credito/pix/:id",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/credito/asaas/:id/cancelar",
      "auth": "none",
      "grupo": "Crédito",
      "summary": "Cancels a pending charge when the payment dialog closes.",
      "desc": "Requires the `cancelamento` capability returned at creation. An older credit charge accepts its token in `credito`. The product and environment must match. This does not refund payments or remove records. 202 means cancellation is pending; the scheduled worker retries provider failures.",
      "params": {
        "id": {
          "desc": "Charge id (32 hex).",
          "exemplo": "0123456789abcdef0123456789abcdef"
        }
      },
      "retorno": {
        "id": {
          "tipo": "string",
          "desc": "Charge id."
        },
        "estado": {
          "tipo": "string",
          "desc": "`cancelando`, `vencido`, or the confirmed final state."
        }
      },
      "erros": {
        "404": "Invalid charge or capability, or a different product or environment."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef/cancelar -H 'content-type: application/json' -d '{\"cancelamento\":\"<bilhete>\"}'",
      "returns": "{ id, estado }",
      "url": "https://agentalog.com/api/credito/asaas/:id/cancelar",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/credito/asaas",
      "auth": "none",
      "summary": "Automatic Pix: whether it is available in this app, the packs in reais and the balance the product sells.",
      "grupo": "Crédito",
      "retorno": {
        "disponivel": {
          "tipo": "boolean",
          "desc": "`false` when the app has no Asaas configured (use the Pix with receipt)."
        },
        "pacotes": {
          "tipo": "object[]",
          "desc": "The credit packs (3, 5, 10 or 25 dollars), with `brl_centavos`."
        },
        "exatos": {
          "tipo": "object[]",
          "desc": "Prices declared by the app, with `usd` and `brl_centavos`. Amounts start at R$ 5.00 and cannot exceed R$ 10,000."
        },
        "saldo": {
          "tipo": "object",
          "desc": "When the product sells a balance in reais: the range and whether the account can buy."
        },
        "precisa_documento": {
          "tipo": "boolean",
          "desc": "Whether the payer's CPF or CNPJ is still required."
        }
      },
      "exemplo": "curl -s $ORIGIN/api/credito/asaas",
      "returns": "{ disponivel, pacotes, exatos, saldo, precisa_documento }",
      "url": "https://agentalog.com/api/credito/asaas",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/credito/asaas",
      "auth": "none",
      "summary": "Creates a dynamic Pix: JSON with `oferta` (`pacote` with `usd`, or `saldo` with `centavos`) and the payer.",
      "desc": "The payment releases what was bought by itself: the pack becomes the `cred_…` token already in the response; the balance goes to the logged-in account's organization. The first purchase needs `documento` (CPF or CNPJ, sent to the gateway and not stored here) and `nome`; `email`, `pagina` and `navegador_id` are optional. With `forma: \"cartao_boleto\"` the charge is open: the response brings `pagamento_em`, the gateway page where you pay by card, boleto or Pix (due in three days). With `forma: \"cartao\"` and `cartao` (`titular`, `numero`, `mes`, `ano`, `cvv`, `documento`, `email`, `cep`, `numero_endereco`, `telefone`), the charge is paid by card in the same request: 200 with `estado: \"pago\"`, 202 with `conferir` while the issuer reviews it, 422 when the card is declined; the card is not stored. Set `usd` to an amount from `pacotes` or `exatos` in the GET response. The server sets the amount in cents and rejects amounts that the app has not declared.",
      "grupo": "Crédito",
      "retorno": {
        "id": {
          "tipo": "string",
          "desc": "Charge id, to follow up."
        },
        "credito": {
          "tipo": "string",
          "desc": "For a pack: the `cred_…` token, shown ONCE; valid when the payment arrives."
        },
        "forma": {
          "tipo": "string",
          "desc": "`pix` (the default), `cartao` or `cartao_boleto`."
        },
        "pix": {
          "tipo": "object",
          "desc": "`copia_e_cola`, `imagem` (PNG QR, data URI) and `expira_em`; `pix` form only."
        },
        "pagamento_em": {
          "tipo": "string",
          "desc": "In the `cartao_boleto` form: the gateway payment page."
        },
        "estado": {
          "tipo": "string",
          "desc": "In the `cartao` form: `pago`, or `pendente` with `conferir`."
        },
        "estado_em": {
          "tipo": "string",
          "desc": "Where to follow the payment."
        },
        "cancelamento": {
          "tipo": "string",
          "desc": "Capability to cancel a pending Pix or boleto charge."
        }
      },
      "erros": {
        "400": "Credit amount outside `pacotes` and `exatos`, amount out of range, invalid CPF/CNPJ, name or e-mail, invalid card data (`cartao_dados`, with the `campo`), or the gateway refused the payer (`pagador_recusado`, with the reason in `detalhe`).",
        "422": "Card declined (`cartao_recusado`, with the `campo` when the gateway says which); try another card with `POST /api/credito/asaas/:id/cartao`.",
        "429": "Limit of 3 attempts per minute or 10 per day, per account or network, or the card limit.",
        "502": "The gateway did not create the Pix; try again.",
        "503": "Automatic Pix unavailable in this app, the gateway is busy (`asaas_ocupado`, wait `retry_after_s`), or too many charges from people not signed in waiting for payment."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/credito/asaas -H 'content-type: application/json' -d '{\"oferta\":\"pacote\",\"usd\":5,\"documento\":\"000.000.000-00\",\"nome\":\"Ana\"}'",
      "returns": "{ id, credito, forma, pix, pagamento_em, estado, estado_em, cancelamento }",
      "url": "https://agentalog.com/api/credito/asaas",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/credito/asaas/:id",
      "auth": "none",
      "summary": "State of an automatic Pix charge: `pendente`, `pago`, `vencido`, `estornado` or `falhou`.",
      "grupo": "Crédito",
      "params": {
        "id": {
          "desc": "Charge id (32 hex).",
          "exemplo": "0123456789abcdef0123456789abcdef"
        }
      },
      "retorno": {
        "estado": {
          "tipo": "string",
          "desc": "`pago` releases the pack token or the balance; a Pix paid after the due date counts."
        },
        "pago_em": {
          "tipo": "string",
          "desc": "When the payment was confirmed, or `null`."
        }
      },
      "erros": {
        "404": "Unknown charge."
      },
      "exemplo": "curl -s $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef",
      "returns": "{ estado, pago_em }",
      "url": "https://agentalog.com/api/credito/asaas/:id",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/credito/asaas/:id/cartao",
      "auth": "none",
      "summary": "Pays a card charge whose card was declined with another card: the same charge, never charged twice.",
      "desc": "JSON with the `cartao` (the same fields as `POST /api/credito/asaas`) and, without an account, the `navegador_id` that created the charge. Only a card charge waiting for payment, by whoever created it, and up to five attempts per charge.",
      "grupo": "Crédito",
      "params": {
        "id": {
          "desc": "Id da cobrança (32 hex).",
          "exemplo": "0123456789abcdef0123456789abcdef"
        }
      },
      "retorno": {
        "estado": {
          "tipo": "string",
          "desc": "`pago`, or `pendente` with `conferir` while the issuer reviews it."
        },
        "estado_em": {
          "tipo": "string",
          "desc": "Where to follow the payment."
        }
      },
      "erros": {
        "400": "Invalid card data (`cartao_dados`, with the `campo`).",
        "404": "Unknown charge, someone else's charge, or not a card charge.",
        "409": "The charge expired or was closed; start the payment again.",
        "422": "Card declined (`cartao_recusado`).",
        "429": "Used up the card attempts for this charge or for today."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef/cartao -H 'content-type: application/json' -d '{\"cartao\":{…}}'",
      "returns": "{ estado, estado_em }",
      "url": "https://agentalog.com/api/credito/asaas/:id/cartao",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/credito/asaas/saude",
      "auth": "none",
      "summary": "Health of this app's Pix and enabled subscriptions: failures and reasons for the dashboard.",
      "grupo": "Crédito",
      "retorno": {
        "ativo": {
          "tipo": "boolean",
          "desc": "`false` when Asaas and subscriptions are disabled."
        },
        "tarefas": {
          "tipo": "object[]",
          "desc": "Each problem has `id`, `falhando`, and `motivo`. Includes Pix and, when enabled, subscription recovery, queue, and budget. Does not call the provider."
        }
      },
      "exemplo": "curl -s $ORIGIN/api/credito/asaas/saude",
      "returns": "{ ativo, tarefas }",
      "url": "https://agentalog.com/api/credito/asaas/saude",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/boletim/config",
      "auth": "none",
      "grupo": "Newsletter",
      "summary": "Available newsletter topics, account support and delivery interval.",
      "retorno": {
        "disponivel": {
          "tipo": "bool",
          "desc": "Subscription service is configured."
        },
        "conta": {
          "tipo": "bool",
          "desc": "Verified accounts can manage their own subscription."
        },
        "topicos": {
          "tipo": "object[]",
          "desc": "Published topic slugs and translated names."
        },
        "intervaloDias": {
          "tipo": "int",
          "desc": "Minimum delivery interval in days."
        }
      },
      "exemplo": "curl -s $ORIGIN/api/boletim/config",
      "returns": "{ disponivel, conta, topicos, intervaloDias }",
      "url": "https://agentalog.com/api/boletim/config",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/boletim/assinatura",
      "auth": "session",
      "grupo": "Newsletter",
      "summary": "The subscription for the account's verified email.",
      "desc": "Private response. No email parameter. Returns email, state, revision, topics, channels and language.",
      "retorno": {
        "assinatura": {
          "tipo": "object",
          "desc": "Current account subscription."
        }
      },
      "erros": {
        "401": "Sign in first.",
        "503": "Subscription service unavailable."
      },
      "exemplo": "await MMConta.fetch(\"$ORIGIN/api/boletim/assinatura\").then(r => r.json());",
      "exemploLinguagem": "js",
      "returns": "{ assinatura }",
      "url": "https://agentalog.com/api/boletim/assinatura",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "POST",
      "path": "/api/boletim/assinatura",
      "auth": "session",
      "grupo": "Newsletter",
      "summary": "Subscribe, save preferences or unsubscribe from the account.",
      "desc": "The verified account supplies the email. Requires same-origin CSRF and the current revision. News and site updates require separate choices. Existing subscribers keep news only.",
      "corpo": {
        "ativo": {
          "tipo": "bool",
          "obrigatorio": true,
          "desc": "False unsubscribes in one request."
        },
        "revisao": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Revision from the private GET."
        },
        "topicos": {
          "tipo": "string[]",
          "desc": "Up to 40 published topic slugs. Empty selects all news topics."
        },
        "canais": {
          "tipo": "string[]",
          "desc": "noticias and/or novidades. Defaults to noticias when omitted."
        },
        "lingua": {
          "tipo": "string",
          "valores": [
            "en",
            "pt"
          ],
          "desc": "Language used in newsletter messages."
        }
      },
      "body": {
        "ativo": false,
        "revisao": 1
      },
      "retorno": {
        "assinatura": {
          "tipo": "object",
          "desc": "Saved subscription with the next revision."
        }
      },
      "erros": {
        "400": "Invalid preferences.",
        "401": "Sign in first.",
        "403": "Origin or CSRF rejected.",
        "409": "Reload the subscription; its revision changed or delivery is suppressed.",
        "429": "Try later."
      },
      "exemplo": "await MMConta.fetch(\"$ORIGIN/api/boletim/assinatura\", {method:\"POST\",headers:{\"Content-Type\":\"application/json\"},body:JSON.stringify({ativo:false,revisao:1})});",
      "exemploLinguagem": "js",
      "returns": "{ assinatura }",
      "url": "https://agentalog.com/api/boletim/assinatura",
      "auth_detail": "Global account: the HttpOnly session cookie of this domain, set when you sign in at `/conta/global`. Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. A write with the cookie of an ended session answers 401 `session_ended` — sign in again; it never turns into the guest. No bearer token is issued to humans."
    },
    {
      "method": "GET",
      "path": "/briefings/feed.xml",
      "auth": "none",
      "grupo": "Briefings",
      "summary": "The latest 30 engineering links as RSS.",
      "retorno": {
        "_texto": "application/rss+xml — titles, summaries, source links and topics."
      },
      "exemplo": "curl -s $ORIGIN/briefings/feed.xml",
      "returns": "application/rss+xml — titles, summaries, source links and topics.",
      "url": "https://agentalog.com/briefings/feed.xml",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/briefings/feed.json",
      "auth": "none",
      "grupo": "Briefings",
      "summary": "The latest 30 engineering links as JSON Feed.",
      "retorno": {
        "_texto": "application/feed+json — JSON Feed 1.1 with source links and topics."
      },
      "exemplo": "curl -s $ORIGIN/briefings/feed.json",
      "returns": "application/feed+json — JSON Feed 1.1 with source links and topics.",
      "url": "https://agentalog.com/briefings/feed.json",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/briefings",
      "auth": "none",
      "summary": "Every briefing topic with its count, the newest items across all of them and the subscription state.",
      "grupo": "Briefings",
      "desc": "Topics are public bookmark folders (CUDA, inference, RAG, agents…). Each item is a post someone saved, its main source, the source type and a two-line summary in English and Portuguese. `?resumo=1` returns only `total` and each topic's `slug` and `total`. 404 until the first publication.",
      "query": {
        "resumo": {
          "tipo": "string",
          "desc": "`1` returns only the counts.",
          "valores": [
            "1"
          ]
        }
      },
      "retorno": "IndiceDosBriefings",
      "erros": {
        "404": "Briefings are not published yet."
      },
      "exemplo": "curl -s $ORIGIN/api/briefings",
      "returns": "{ total, atualizado_em, topicos[{slug,nome,descricao,total,atualizado_em,tipos,api?,pagina?}], recentes[{id,slug,topicos?,data,entrou?,autor,post,fonte,tipo,previa?,titulo,resumo,importa}], inscricao, _links }",
      "url": "https://agentalog.com/api/briefings",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/briefings/itens",
      "auth": "none",
      "colecao": {
        "porPagina": 20,
        "anda": "next"
      },
      "summary": "Every published item, filtered by topic and source type, with the count of each filter value.",
      "grupo": "Briefings",
      "desc": "Values inside one parameter are OR'd; the two parameters are AND'd. Unknown values are ignored. Follow `_links.next` to walk everything.",
      "query": {
        "topico": {
          "tipo": "string",
          "desc": "Topic slugs, comma-separated.",
          "exemplo": "rag,inference"
        },
        "tipo": {
          "tipo": "string",
          "desc": "Source types, comma-separated.",
          "valores": [
            "paper",
            "repo",
            "model",
            "dataset",
            "demo",
            "video",
            "docs",
            "article",
            "post"
          ],
          "exemplo": "paper,repo"
        },
        "page": {
          "tipo": "int",
          "desc": "Page, 1–999; 20 items per page.",
          "padrao": 1
        }
      },
      "retorno": "PaginaDeBriefings",
      "erros": {
        "404": "Briefings are not published yet."
      },
      "exemplo": "curl -s '$ORIGIN/api/briefings/itens?topico=rag&tipo=paper'",
      "returns": "{ total, pagina, paginas, filtros, facetas, itens[{id,slug,topicos?,data,entrou?,autor,post,fonte,tipo,previa?,titulo,resumo,importa}], _links }",
      "url": "https://agentalog.com/api/briefings/itens",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/briefings/:slug",
      "auth": "none",
      "summary": "One topic, newest first, 20 items per page.",
      "grupo": "Briefings",
      "desc": "The same list the HTML page at `/briefings/<slug>/` shows.",
      "params": {
        "slug": {
          "tipo": "string",
          "desc": "Topic slug from `/api/briefings`.",
          "exemplo": "rag"
        }
      },
      "query": {
        "page": {
          "tipo": "int",
          "desc": "Page, 1–999; 20 items per page.",
          "padrao": 1
        }
      },
      "retorno": "TopicoDoBriefing",
      "erros": {
        "404": "Unknown briefing topic."
      },
      "exemplo": "curl -s '$ORIGIN/api/briefings/rag?page=2'",
      "returns": "{ slug, nome, descricao, total, atualizado_em, pagina, paginas, itens[{id,slug,topicos?,data,entrou?,autor,post,fonte,tipo,previa?,titulo,resumo,importa}], _links }",
      "url": "https://agentalog.com/api/briefings/:slug",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/briefings/subscribe",
      "auth": "none",
      "summary": "Requests email confirmation for the weekly briefing list.",
      "grupo": "Briefings",
      "desc": "Alias of `/api/boletim/assinar`. Accepts JSON or an HTML form. Only email confirmation activates the subscription or changes its topics and language. An empty topic list selects all topics. Confirmation expires after 48 hours. Five requests per network per hour; address limits return the same 202 response. Updates include one-click unsubscribe. `GET /api/boletim/config` lists available topics and availability.",
      "corpo": {
        "email": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "Email address, up to 254 characters."
        },
        "topics": {
          "tipo": "string[]",
          "desc": "Topic slugs from `/api/briefings`, up to 40. Empty selects all."
        },
        "canais": {
          "tipo": "string[]",
          "desc": "noticias and/or novidades. Defaults to news only."
        },
        "lang": {
          "tipo": "string",
          "desc": "Language of the emails.",
          "valores": [
            "en",
            "pt"
          ],
          "padrao": "en"
        },
        "website": {
          "tipo": "string",
          "desc": "Leave empty. Anything here is treated as a bot and nothing is stored."
        }
      },
      "body": {
        "email": "you@company.com",
        "topics": [
          "rag",
          "inference"
        ],
        "lang": "en"
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Request accepted."
        },
        "status": {
          "tipo": "string",
          "desc": "`on_list`."
        },
        "message": {
          "tipo": "string",
          "desc": "What happens next, for a person."
        }
      },
      "erros": {
        "400": "Invalid email, body or topic.",
        "429": "Network request limit. Respect Retry-After.",
        "503": "Newsletter or email transport unavailable."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/briefings/subscribe -H 'content-type: application/json' -d '{\"email\":\"you@company.com\",\"topics\":[\"rag\"]}'",
      "returns": "{ ok, status, message }",
      "url": "https://agentalog.com/api/briefings/subscribe",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "POST",
      "path": "/api/admin/briefings",
      "auth": "token",
      "grupo": "Operation",
      "summary": "The Briefings publisher delivers one document: the index or a topic.",
      "desc": "`BRIEFINGS_TOKEN` only (the publisher's credential; it opens nothing else). The document is checked against the key it will live under — shape, sizes, addresses — before it is stored. Idempotent.",
      "corpo": {
        "chave": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "`briefings/v1/indice.json` or `briefings/v1/topicos/<slug>.json`."
        },
        "doc": {
          "tipo": "object",
          "obrigatorio": true,
          "desc": "The document, `versao: 1`, up to 2 MB."
        }
      },
      "body": {
        "chave": "briefings/v1/topicos/rag.json",
        "doc": {
          "versao": 1,
          "slug": "rag"
        }
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Stored."
        },
        "chave": {
          "tipo": "string",
          "desc": "Where it was stored."
        },
        "indice": {
          "tipo": "bool",
          "desc": "`true` when the document is the index."
        }
      },
      "erros": {
        "400": "Invalid JSON or document.",
        "401": "BRIEFINGS_TOKEN required.",
        "413": "Body over 2 MB.",
        "503": "App files are not configured."
      },
      "exemplo": "curl -s -XPOST $ORIGIN/api/admin/briefings -H \"Authorization: Bearer $BRIEFINGS_TOKEN\" -H \"content-type: application/json\" -d @topic.json",
      "returns": "{ ok, chave, indice }",
      "url": "https://agentalog.com/api/admin/briefings",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "PUT",
      "path": "/api/admin/briefings/img/:arquivo",
      "auth": "token",
      "grupo": "Operation",
      "summary": "The Briefings publisher delivers one preview image.",
      "desc": "`BRIEFINGS_TOKEN` only. WebP up to 512 KB, checked by its bytes; the name is the content's hash. Idempotent.",
      "params": {
        "arquivo": {
          "tipo": "string",
          "desc": "`<32 hex>.webp`.",
          "exemplo": "25738326cb17586e5c84da2734ccc65c.webp"
        }
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Stored."
        },
        "arquivo": {
          "tipo": "string",
          "desc": "The file name, served at `/briefings/img/<arquivo>`."
        }
      },
      "erros": {
        "401": "BRIEFINGS_TOKEN required.",
        "404": "Not an image address: the name is `<32 hex>.webp`.",
        "413": "The body exceeds 512 KB.",
        "422": "Invalid WebP bytes or content hash.",
        "503": "App files are not configured."
      },
      "exemplo": "curl -s -XPUT $ORIGIN/api/admin/briefings/img/$FILE -H \"Authorization: Bearer $BRIEFINGS_TOKEN\" --data-binary @$FILE",
      "returns": "{ ok, arquivo }",
      "url": "https://agentalog.com/api/admin/briefings/img/:arquivo",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "POST",
      "path": "/api/admin/briefings/exportacao",
      "auth": "token",
      "grupo": "Operation",
      "summary": "The desktop delivers the export of the public bookmark folders.",
      "desc": "`BRIEFINGS_EXPORT_TOKEN` only (it opens nothing else). JSON up to 8 MB, checked before it is stored: `versao: 1`, the topics (slug → post ids) and the items (post, author, date, text, up to eight web links). Send it gzip-compressed: a request carries at most 2 MiB. Kept in the app's files, outside every public route; the publisher on c3 fetches it when it changes.",
      "headers": {
        "Content-Encoding": {
          "tipo": "string",
          "desc": "`gzip` when the body is compressed; the 8 MB cap applies after it."
        }
      },
      "corpo": {
        "versao": {
          "tipo": "int",
          "obrigatorio": true,
          "desc": "Format version; only `1` is accepted."
        },
        "gerado_em": {
          "tipo": "string",
          "obrigatorio": true,
          "desc": "When the export was made (ISO 8601)."
        },
        "topicos": {
          "tipo": "object",
          "obrigatorio": true,
          "desc": "Topic slug → post ids, newest first."
        },
        "itens": {
          "tipo": "object",
          "obrigatorio": true,
          "desc": "Post id → the post: author, date, text, quoted post, links."
        }
      },
      "body": {
        "versao": 1,
        "gerado_em": "2026-09-28T08:00:00Z",
        "topicos": {
          "rag": [
            "1"
          ]
        },
        "itens": {
          "1": {
            "id": "1"
          }
        }
      },
      "retorno": {
        "ok": {
          "tipo": "bool",
          "desc": "Stored."
        },
        "topicos": {
          "tipo": "int",
          "desc": "Topics in the export."
        },
        "itens": {
          "tipo": "int",
          "desc": "Items in the export."
        },
        "etag": {
          "tipo": "string",
          "desc": "The content's hash, as the publisher sees it in `ETag`."
        }
      },
      "erros": {
        "400": "Invalid gzip, JSON or export.",
        "401": "BRIEFINGS_EXPORT_TOKEN required.",
        "413": "Over 2 MiB on the wire or 8 MB of JSON.",
        "503": "App files are not configured."
      },
      "exemplo": "gzip -c exportacao.json | curl -s -XPOST $ORIGIN/api/admin/briefings/exportacao -H \"Authorization: Bearer $BRIEFINGS_EXPORT_TOKEN\" -H \"content-type: application/json\" -H \"content-encoding: gzip\" --data-binary @-",
      "returns": "{ ok, topicos, itens, etag }",
      "url": "https://agentalog.com/api/admin/briefings/exportacao",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "method": "GET",
      "path": "/api/admin/briefings/exportacao",
      "auth": "token",
      "grupo": "Operation",
      "summary": "The publisher on c3 fetches the latest export, only when it changed.",
      "desc": "`BRIEFINGS_TOKEN` only. `ETag` is the content's hash: with `If-None-Match` equal to it, 304 and no body.",
      "headers": {
        "If-None-Match": {
          "tipo": "string",
          "desc": "The `ETag` of the export already held; 304 when unchanged."
        }
      },
      "retorno": {
        "_texto": "application/json — the export exactly as the desktop delivered it."
      },
      "erros": {
        "401": "BRIEFINGS_TOKEN required.",
        "404": "No export delivered yet."
      },
      "exemplo": "curl -s $ORIGIN/api/admin/briefings/exportacao -H \"Authorization: Bearer $BRIEFINGS_TOKEN\" -H 'If-None-Match: \"…\"'",
      "returns": "application/json — the export exactly as the desktop delivered it.",
      "url": "https://agentalog.com/api/admin/briefings/exportacao",
      "auth_detail": "Operator token `ADMIN_TOKEN` or `METRICS_TOKEN` as Bearer. The load routes also accept the enricher's credential; automatic moderation uses its own `MODERATION_TOKEN` and the Briefings publisher its own `BRIEFINGS_TOKEN` — see each endpoint."
    },
    {
      "path": "/api/acesso",
      "auth": "none",
      "grupo": "API access",
      "retorno": "ApiAccess",
      "method": "GET",
      "summary": "Discover the monthly data package or inspect a private purchase.",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        }
      },
      "erros": {
        "400": "Invalid pass.",
        "404": "Unknown purchase or wrong owner.",
        "503": "Purchases disabled."
      },
      "exemplo": "curl -s $ORIGIN/api/acesso",
      "desc": "Catalog discovery and ordinary browsing are free. GPTBot, ClaudeBot, CCBot, Meta-ExternalAgent, Amazonbot, AhrefsBot and MJ12bot share a daily allowance of 1,000 reads per crawler family; over it the answer is 429 until the next day. Billing is off for now: there is no package to buy and reads need no X-API-Pass. The MAT allowance is separate from the company, address and procurement indexes.",
      "returns": "{ offer{id,price_usd,credits,days,auto_renew,unit,products,purchase,method,status,header,payment_methods,prepaid_credit,instructions,generate_pass,client,guide,workflow,evaluation}, enabled?, id?, status?, granted_credits?, expires_at?, receipt?, via?, message? }",
      "url": "https://agentalog.com/api/acesso",
      "auth_detail": "Public, no credential."
    },
    {
      "path": "/api/acesso",
      "auth": "none",
      "grupo": "API access",
      "retorno": "ApiAccess",
      "method": "POST",
      "summary": "Buy 1000 basic data reads for US$1, valid for 30 days.",
      "preco_usd": 1,
      "desc": "Catalog discovery and ordinary browsing are free. GPTBot, ClaudeBot, CCBot, Meta-ExternalAgent, Amazonbot, AhrefsBot and MJ12bot share a daily allowance of 1,000 reads per crawler family; over it the answer is 429 until the next day. Billing is off for now: there is no package to buy and reads need no X-API-Pass. The MAT allowance is separate from the company, address and procurement indexes.",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying.",
          "obrigatorio": true
        },
        "X-Credito": {
          "tipo": "string",
          "desc": "Existing prepaid credit token; alternative to x402."
        },
        "Authorization": {
          "tipo": "string",
          "desc": "Bearer cred_… alternative to X-Credito."
        },
        "X-PAYMENT": {
          "tipo": "string",
          "desc": "Signed x402 authorization from the 402 quote, maximum 16 KiB."
        },
        "PAYMENT-SIGNATURE": {
          "tipo": "string",
          "desc": "Alternative name for X-PAYMENT."
        },
        "X-API-Transaction": {
          "tipo": "string",
          "desc": "Confirmed Base transaction hash for reconciliation with the original pass and signed payment. Never creates another charge."
        }
      },
      "erros": {
        "400": "Missing or invalid pass/payment.",
        "401": "Invalid prepaid credit.",
        "402": "Payment required: x402 accepts[] and prepaid-credit instructions.",
        "409": "Payment pending; retain the same pass and do not pay again.",
        "429": "Purchase attempt limit; respect Retry-After.",
        "503": "Payment unavailable or pending reconciliation."
      },
      "exemplo": "curl -s -X POST \"$ORIGIN/api/acesso\" -H \"X-API-Pass: $API_PASS\"",
      "returns": "{ offer{id,price_usd,credits,days,auto_renew,unit,products,purchase,method,status,header,payment_methods,prepaid_credit,instructions,generate_pass,client,guide,workflow,evaluation}, enabled?, id?, status?, granted_credits?, expires_at?, receipt?, via?, message? }",
      "url": "https://agentalog.com/api/acesso",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/coleta/readme/:arquivo",
      "grupo": "Catalog",
      "auth": "none",
      "summary": "Read a collected README as Markdown by its published object path.",
      "desc": "Same MAT read allowance and pass. Prefer /api/listings/:id/readme (also available through MCP) for metadata and the historical R2 fallback. This raw route only serves objects already present on the catalog origin.",
      "params": {
        "arquivo": {
          "tipo": "string",
          "desc": "Published relative README path, e.g. owner/repository.md.",
          "obrigatorio": true
        }
      },
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying."
        },
        "Idempotency-Key": {
          "tipo": "string",
          "desc": "Optional retry key, up to 80 ASCII characters; same read for five minutes."
        }
      },
      "retorno": {
        "_texto": "README Markdown (text/markdown); a successful basic read is at most 1 MiB."
      },
      "erros": {
        "401": "Invalid pass.",
        "402": "Read allowance or credit exhausted.",
        "404": "README absent.",
        "413": "Read too large.",
        "503": "Origin unavailable."
      },
      "exemplo": "curl -s \"$ORIGIN/coleta/readme/owner/repository.md\" -H \"X-API-Pass: $API_PASS\"",
      "returns": "README Markdown (text/markdown); a successful basic read is at most 1 MiB.",
      "url": "https://agentalog.com/coleta/readme/:arquivo",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/uso",
      "grupo": "API access",
      "auth": "none",
      "summary": "Read the remaining MAT balance without consuming credit.",
      "retorno": "MatUsage",
      "headers": {
        "X-API-Pass": {
          "tipo": "string",
          "desc": "MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying.",
          "obrigatorio": true
        }
      },
      "erros": {
        "401": "Missing or invalid pass.",
        "402": "Purchase pending or expired.",
        "503": "Origin unavailable."
      },
      "exemplo": "curl -s \"$ORIGIN/api/uso\" -H \"X-API-Pass: $API_PASS\"",
      "returns": "{ id, credits, used, remaining, expires_at, active }",
      "url": "https://agentalog.com/api/uso",
      "auth_detail": "Public, no credential."
    },
    {
      "method": "GET",
      "path": "/api/pricing",
      "auth": "none",
      "grupo": "Discovery",
      "summary": "Current prices and free allowances.",
      "retorno": {
        "product": {
          "tipo": "string",
          "desc": "Product name."
        },
        "quota": {
          "tipo": "PaymentQuota",
          "desc": "Public allowances and current list prices; not personal usage."
        },
        "pricing": {
          "tipo": "string",
          "desc": "Absolute URL of the current price list."
        },
        "billing": {
          "tipo": "string",
          "desc": "Absolute URL of payment discovery or the existing billing summary."
        },
        "api_index": {
          "tipo": "string",
          "desc": "Absolute URL of the API catalog."
        }
      },
      "erros": {
        "405": "Use GET or HEAD."
      },
      "exemplo": "curl -s $ORIGIN/api/pricing",
      "returns": "{ product, quota{free,paid,how_to_pay,live,free_now?,charged_now?,trial?}, pricing, billing, api_index }",
      "url": "https://agentalog.com/api/pricing",
      "auth_detail": "Public, no credential."
    }
  ],
  "quota": {
    "free": [
      {
        "o_que": "ordinary catalog browsing and discovery",
        "limite": "identified crawlers: 1,000 reads/day per family",
        "janela": null
      },
      {
        "o_que": "like, comment and hop with a guest token",
        "limite": "no quota",
        "janela": null
      },
      {
        "o_que": "register with an e-mail account",
        "limite": "1 per day, max. 3 in the queue",
        "janela": null
      },
      {
        "o_que": "watch remote MCP servers with an account: daily check, e-mail when they change; /api/me/vigia",
        "limite": "3 servers per account",
        "janela": null
      }
    ],
    "paid": [
      {
        "o_que": "1,000 MAT catalog reads for 30 days; separate balance; GET/POST /api/acesso",
        "price_usd": 1
      },
      {
        "o_que": "register as an agent (with or without a guest token)",
        "price_usd": 0.1
      },
      {
        "o_que": "watch 1 more MCP server for 30 days, no auto-renewal; POST /api/me/vigia",
        "price_usd": 0.1
      },
      {
        "o_que": "Team watch: 50 MCP servers for 30 days, no auto-renewal; POST /api/plans/equipe",
        "price_usd": 2.49
      },
      {
        "o_que": "Business watch: 500 MCP servers for 30 days, no auto-renewal; POST /api/plans/empresa",
        "price_usd": 4.99
      }
    ],
    "how_to_pay": "Catalog discovery and ordinary browsing are free. GPTBot, ClaudeBot, CCBot, Meta-ExternalAgent, Amazonbot, AhrefsBot and MJ12bot share a daily allowance of 1,000 reads per crawler family; over it the answer is 429 until the next day. Billing is off for now: there is no package to buy and reads need no X-API-Pass. The MAT allowance is separate from the company, address and procurement indexes. Submissions without an account are free while billing is off. The daily submission limit still applies. If billing is enabled, an agent receives 402 with `accepts[]` before payment. Pay through x402 or prepaid credit, then repeat the same request.",
    "live": "https://agentalog.com/api/billing",
    "free_now": [
      "*"
    ],
    "charged_now": [
      "vigia_vaga",
      "vigia_equipe",
      "vigia_empresa"
    ]
  },
  "mcp": {
    "endpoint": "https://agentalog.com/mcp",
    "transport": "streamable-http",
    "tools": 43,
    "note": "Plugs straight into the MCP client; nothing to install. Tools = the operations below."
  },
  "quickstart": [
    "GET https://agentalog.com/api/listings — live mosaic (each item carries the destination URL)",
    "GET https://agentalog.com/v0.1/servers — MCP subregistry (official spec)",
    "POST https://agentalog.com/api/guest — mr_… token for like/comment",
    "POST https://agentalog.com/api/listings with a session (human) or as an agent, with or without guest (x402 $0.10 reference, not charged while billing is off)",
    "GET https://agentalog.com/api/listings/ID/status — poll the review (no credential; the 201 carries it as status_api)",
    "POST https://agentalog.com/mcp — the same operations as MCP tools, nothing to install"
  ]
}