Developer API
Developer API readiness
Limowo publishes REST, OpenAPI, and remote MCP discovery routes for technical integrators while keeping delegated writes, payments, orders, and account actions behind explicit release gates.
Last updated: 29 July 2026
View agent docs
Current
REST, OpenAPI, and MCP discovery
MCP
Public read-only live
Writes
Feature-gated, scoped, and reviewed
Current public developer surfaces
Developers can inspect the current public surfaces at /agents, /llms.txt, /mcp-server.json, /mcp, /.well-known/limowo-agent.json, /.well-known/limowo-mcp.json, /api/agent/v1/openapi.json, and /api/agent/v1/commands.
Current REST and OpenAPI contract
The public contract is centered on the agent command API. Public discovery and read commands can be documented through OpenAPI, while draft preparation and state-changing behavior stay behind authentication, grants, feature flags, approvals, idempotency, and audit requirements.
Public remote MCP is live
The Streamable HTTP endpoint at /mcp exposes six public read-only marketplace tools without credentials. Scoped delegated tools use Limowo bearer tokens when enabled. Automatic OAuth onboarding, directory publication, payments, orders, and any local stdio bridge remain gated.
Excluded developer capabilities
No arbitrary shell, SQL, GraphQL, filesystem, or unrestricted HTTP access is exposed. Developer integrations must not enable autonomous publishing, offers, orders, payments, account administration, dispute handling, or private data access outside documented authorization scopes.
Release-gate evidence
Before Limowo promotes broader developer API access, it should complete Keycloak/OpenFGA authorization, durable command state, idempotency, approval records, rate limits, audit logs, compatibility policy, abuse monitoring, conformance tests, and production acceptance records.
Support expectations
Developer support requests should include endpoint path, command name, request ID, response code, idempotency key where relevant, locale, client metadata, and a minimal reproduction without API keys, session tokens, passwords, or payment secrets.
