{
  "appSlug": "fwozen",
  "apiUrl": "https://api.fwozen.com",
  "webUrl": "https://fwozen.com",
  "apiVersion": "1.0.0",
  "installUrlTemplate": "https://github.com/apps/fwozen/installations/new",
  "installUrlNote": "Call GET /v1/github/install-url with a session credential instead: it returns this URL carrying a signed `state` nonce, which is what lets GET /v1/installations/status resolve the installation back to your organisation. A GitHub organisation owner must complete the install; a non-owner files an approval request that can sit pending indefinitely.",
  "openapi": "https://api.fwozen.com/v1/openapi.json",
  "llmsTxt": "https://api.fwozen.com/llms.txt",
  "llmsFullTxt": "https://api.fwozen.com/llms-full.txt",
  "authMd": "https://api.fwozen.com/auth.md",
  "agentsPolicy": "https://fwozen.com/agents",
  "skillsIndex": "https://fwozen.com/.well-known/skills/index.json",
  "mcp": {
    "endpoint": "https://api.fwozen.com/mcp",
    "transport": "streamable-http",
    "protectedResourceMetadata": "https://api.fwozen.com/.well-known/oauth-protected-resource",
    "auth": "Bearer, and exactly the two credentials the REST API takes: a session JWT from the device flow above, or an `fwz_` key. A tool authorizes against the same permission and scope lists as the route it adapts, so a key that cannot call a route cannot call its tool either."
  },
  "auth": {
    "session": {
      "type": "device_authorization",
      "clientId": "fwozen-agent",
      "deviceAuthorizationEndpoint": "https://fwozen.com/api/auth/device/code",
      "tokenEndpoint": "https://fwozen.com/api/auth/device/token",
      "verificationUri": "https://fwozen.com/device",
      "grantType": "urn:ietf:params:oauth:grant-type:device_code",
      "tokenExchangeEndpoint": "https://fwozen.com/api/auth/token",
      "header": "Authorization: Bearer <jwt>",
      "note": "Public client — there is no client secret. Two tokens, not one: the device flow yields a SESSION token that belongs to this authorization server, and `tokenExchangeEndpoint` trades it for the short-lived JWT the API accepts. There is no refresh token; the session is revocable server-side and a device-minted one does not extend by use."
    },
    "apiKey": {
      "type": "bearer",
      "prefix": "fwz_",
      "header": "Authorization: Bearer fwz_…",
      "scopes": [
        "audit:read",
        "billing:read",
        "billing:write",
        "exception:read",
        "exception:write",
        "freeze:read",
        "freeze:write",
        "repo:read",
        "repo:write",
        "schedule:read",
        "schedule:write"
      ],
      "mintedBy": "POST /v1/api-keys (session credential only — a key cannot mint a key), or by a human at https://fwozen.com/app/settings/api-keys",
      "note": "Scopes are flat and cannot be widened after creation. The secret is shown once."
    }
  }
}