Sign-in and account

Get account

GET /v1/account · getAccount

Existing account and current workspace memberships. Accepts app sess_ sessions, oa_sk_ sign-in keys, and account-bound oak_ API keys. Credential prefixes alone do not prove authorization.

Sign-in: a bearer credential in the Authorization header.

appBearer: A live app sess_ session or oa_sk_ sign-in key. Account-bound oak_ keys are accepted only where the operation declares them and their scopes permit it. API cookies are ignored.

Response

200 — The authenticated account.

Type: AppAccountView

Errors

Example

curl 'https://api.openagents.com/v1/account' \
  -H "Authorization: Bearer $OPENAGENTS_TOKEN"

In the Rust SDK

• Client::account
• Client::authenticate

The caller's access history

GET /v1/account/access · get-v1-account-access

Actor, action, workspace, session digest, and detail for the caller's own events. Secrets are redacted by construction — they are never in the store to begin with.

Sign-in: a bearer credential in the Authorization header.

bearer: An issued key: oak_<id>.<secret>. Omitted entirely for anonymous access to shared doors, which a require_workspace_membership deployment refuses outright.

Response

200 — The operation completed.

Type: object

Errors

Example

curl 'https://api.openagents.com/v1/account/access' \
  -H "Authorization: Bearer $OPENAGENTS_TOKEN"

Start app login

POST /v1/device/code · startAppLogin

Start signing an app in. Show the person the returned code and address, then poll for the session.

Sign-in: none needed.

Request body

Content type: application/json

Type: AppDeviceRequest

Response

200 — The app's result. Tokens and codes are returned only here; do not cache.

Type: AppDeviceGrant

Errors

Example

curl -X POST 'https://api.openagents.com/v1/device/code' \
  -H 'Content-Type: application/json' \
  -d '{
  "computer": "string"
}'

In the Rust SDK

• Client::start_login

Sign out app

POST /v1/device/sign-out · signOutApp

Revoke this app session. Already expired/revoked sessions are signed out. A sign-in key is a session too; revoking it here is not a local forget operation.

Sign-in: a bearer credential in the Authorization header.

appBearer: A live app sess_ session or oa_sk_ sign-in key. Account-bound oak_ keys are accepted only where the operation declares them and their scopes permit it. API cookies are ignored.

Response

200 — The app's result. Tokens and codes are returned only here; do not cache.

Type: AppSignedOut

Errors

Example

curl -X POST 'https://api.openagents.com/v1/device/sign-out' \
  -H "Authorization: Bearer $OPENAGENTS_TOKEN"

In the Rust SDK

• Client::sign_out

Poll app login

POST /v1/device/token · pollAppLogin

Poll for the session of a sign-in you started. Wait the returned interval between polls.

Sign-in: none needed.

Request body

Content type: application/json

Type: AppDevicePoll

Response

200 — The app's result. Tokens and codes are returned only here; do not cache.

Type: AppSession

Errors

Example

curl -X POST 'https://api.openagents.com/v1/device/token' \
  -H 'Content-Type: application/json' \
  -d '{
  "device_code": "string"
}'

In the Rust SDK

• Client::poll_login