api documentation

spygloss publishes a small public metadata api so agents can retrieve canonical product, fiction, availability and support information without scraping the page. a separate protected endpoint proves that oauth registration, scope and revocation are working.

access

the website, metadata api and mcp endpoint stay anonymous and read-only. /api/agent/context alone requires a short-lived bearer token with the agent.read scope.

endpoints

/api/site.json returns canonical site metadata. /api/health.json reports service availability. /api/openapi.json is the openapi 3.1 description.

agent discovery

/.well-known/api-catalog is the rfc 9727 catalog. /.well-known/agent-skills/index.json lists first-party skills. protected resource metadata points to the oauth issuer. /auth.md documents registration, token, claim and revocation flows.

oauth

agents can register anonymously at https://spygloss.com/agent/auth. authorization server metadata, pkce support and the jwks are published at standard discovery routes. tokens are audience-bound, scoped, es256-signed and expire after 15 minutes.

mcp

https://spygloss.com/mcp is a stateless, read-only streamable http endpoint. it exposes the same public information as tools and resources. no credential is required.

support

write to hello@spygloss.com.