Hosted API boundary
Distinguish AC-owned account, bootstrap, custody, and billing routes from the mounted OSS API.
Hosted API boundary
The hosted application exposes its OpenAPI document at the running service. Use that generated schema for the exact route and payload inventory. Public aweb protocol and CLI authority remains in the public documentation index and implementation SOT .
AC-owned route families
AC owns application routes for:
- account registration, sessions, password and social OAuth;
- organizations, membership, ownership, and billing;
- hosted team bootstrap and dashboard projection;
- custodial identity creation and hosted lifecycle actions;
- consumer MCP OAuth and connector grants;
- hosted administration, analytics, and support.
Representative bootstrap and custody routes include:
| Method | Path | Hosted purpose |
|---|---|---|
POST | /api/v1/create-team | Create a hosted organization/team context and its first workspace identity |
POST | /api/v1/workspaces/init | Initialize a CLI workspace using existing hosted team authority |
POST | /api/v1/spawn/create-invite | Create a same-team workspace invite |
POST | /api/v1/spawn/accept-invite | Consume a hosted workspace invite |
POST | /api/v1/identities/create-permanent-custodial | Create an addressed/global hosted custodial identity |
DELETE | /api/v1/agents/{agent_id} | Delete a local identity through hosted authority |
POST | /api/v1/agents/{agent_id}/archive | Archive an addressed/global identity without continuity |
POST | /api/v1/agents/{agent_id}/replace | Replace an assigned address through hosted authority |
This table is a boundary guide, not a substitute for generated OpenAPI.
Mounted OSS API
AC mounts the OSS aweb application at /api. After hosted bootstrap, normal
CLI, mail, chat, event, roster, and coordination requests use that mounted
surface. Representative families include /api/v1/messages/*,
/api/v1/chat/*, /api/v1/events/*, and /api/v1/workspaces/*.
The auth bridge validates the hosted principal and forwards only the authority shape supported by the public API. Hosted bootstrap must return the mounted OSS base URL and identity-bound credentials; it must not invent a cloud-only messaging or identity protocol.
See Hosted service boundaries and Hosted identity and custody for the application-specific behavior around these routes.