Developer Documentation

1. Public operational API

The public catalog advertises only an unauthenticated process-liveness check. This endpoint returns no customer or supplier data and cannot send messages.

• GET /api/health — process liveness information
• /openapi.json — OpenAPI 3.1
• /.well-known/api-catalog — RFC 9727

2. Access model

Suppliping does not expose a public agent write API, self-service OAuth client registration, or agent bearer credential service. The public access form creates only an inquiry record for human follow-up; it does not create an account, grant approval, or issue credentials. Current hosted access uses an authorized human account configured separately by the operator and a secure browser session cookie.

For the machine-readable access description, see /auth.md.

3. Scope boundaries

Meta webhooks, the sending worker, and session-protected dashboard APIs are internal operational surfaces and are not advertised in the public API catalog. Public forms do not create accounts or credentials automatically, and passive discovery must not POST to them.

4. Support

Use the public contact channel for integration, access, or data-handling questions. Never submit passwords, Meta access tokens, or webhook secrets.