{ "data": { "agentNamePolicy": { "allowedPattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$", "automaticSuffixing": false, "canonicalization": "nfkc_trim_lowercase", "collisionCode": "agent_name_unavailable", "maximumLength": 64, "minimumLength": 3, "unicodeInputRule": "normalized_result_must_be_ascii", "uniquenessScope": "global_active_connector_identity" }, "audience": [ "localendpoints_desktop", "remoteendpoints_desktop", "company_master_operator", "human_company_member", "connector_implementer", "security_reviewer" ], "authorizationUi": { "automaticNavigationAllowed": false, "companySelection": { "body": [ "schemaVersion", "companyRef" ], "route": "/api/matm/human/connector-pairings/{publicRequestRef}/company-selection", "sessionRotates": true }, "explicitUserActivationRequired": true, "forbiddenDomAndConfig": [ "requestId", "companyId", "authorityId", "workspaceId", "projectId", "agentId", "pairingRequestProof", "state", "authorizationCode", "callbackUrl" ], "successStatus": "approved_awaiting_connector_claim", "urlContainsOnly": [ "publicRequestRef" ], "visibleRequestMetadata": [ "clientDisplayName", "agentDisplayName", "scopeImpactLabels", "scopeDigest", "status", "expiresAt" ], "wakeUpUrl": "registered redirect URI byte-for-byte with no additions", "workspaceSelection": { "existing": [ "mode", "workspaceRef" ], "new": [ "mode", "workspaceLabel", "projectLabel" ] } }, "browserCors": { "allowedHeaders": [ "Authorization", "Content-Type", "Idempotency-Key", "X-CSRF-Token" ], "allowedMethods": [ "GET", "POST", "OPTIONS" ], "maxAgeSeconds": 600, "preflightRequiresWorkspaceKey": false, "status": "live" }, "connectorApiRoutes": { "coordinatorStatus": "/api/matm/agent-messages", "currentMessage": "/api/matm/current-message", "notificationAck": "/api/matm/notifications/ack", "projectRooms": "/api/matm/meeting-rooms", "publicSafeSubmit": "/api/matm/memory-events/submit", "registration": "/api/matm/agents/register", "runtimeLease": "/api/matm/connector-runtime-lease", "search": "/api/matm/search", "self": "/api/matm/me", "workspace": "/api/matm/workspace" }, "contractRevision": "1.0", "coordinationOperations": { "coordinatorStatus": { "authentication": "Bearer active connector credential with coordination:coordinator:status:write and an active self-held runtime lease", "durableReadback": "The status is persisted as coordinator current-message notifications and is read back through the coordinator's authenticated inbox, not through a synthetic connector GET alias.", "idempotencyHeaderRequired": true, "method": "POST", "mutation": true, "receiptAction": "coordinator_status", "requiredFields": [ "schemaVersion", "system", "work", "revision", "blockers", "apiChanges" ], "responseSchema": "ConnectorCoordinatorStatusResult", "route": "/api/matm/agent-messages", "scope": "A server-derived, public-safe status summary from the exact connector profile to the configured coordinator identity; arbitrary recipients and raw payloads are forbidden.", "successStatus": 202 }, "currentMessageReadback": { "authentication": "Bearer active connector credential with coordination:self:current-message:read and an active self-held runtime lease", "method": "GET", "mutation": false, "queryParametersAllowed": false, "receiptAction": "current_message_read", "responseSchema": "ConnectorCurrentMessageResult", "route": "/api/matm/current-message", "scope": "Server-bound exact workspace and canonical connector agent inbox only.", "successStatus": 200 }, "notificationAcknowledgement": { "authentication": "Bearer active connector credential with coordination:self:notification:ack and an active self-held runtime lease", "idempotencyHeaderRequired": true, "method": "POST", "mutation": true, "receiptAction": "notification_ack", "requiredFields": [ "schemaVersion", "notificationId", "status", "handled=true" ], "responseSchema": "ConnectorNotificationAckResult", "route": "/api/matm/notifications/ack", "scope": "Only a notification addressed to the exact canonical connector agent may be acknowledged.", "successStatus": 200 }, "projectRoomsReadback": { "authentication": "Bearer active connector credential with coordination:project:rooms:read and an active self-held runtime lease", "method": "GET", "mutation": false, "queryParametersAllowed": false, "receiptAction": "project_rooms_read", "responseSchema": "ConnectorProjectRoomsResult", "route": "/api/matm/meeting-rooms", "scope": "Server-bound exact project rooms only; company, workspace, other-project, and custom room scopes are excluded.", "successStatus": 200 }, "runtimeLease": { "actions": [ "acquire", "heartbeat", "release" ], "authentication": "Bearer active connector credential with connector:self:runtime-lease", "failClosed": "A second live proof for the same canonical connector identity receives 409 runtime_identity_in_use. Heartbeat or release by a non-holder receives 409 runtime_lease_not_held.", "idempotencyHeaderRequired": true, "method": "POST", "receiptAction": "runtime_lease", "requiredFields": [ "schemaVersion", "action", "runtimeInstanceProof" ], "responseSchema": "ConnectorRuntimeLeaseResult", "route": "/api/matm/connector-runtime-lease", "runtimeInstanceProof": "Body-only 256-bit base64url value held by one local process and never persisted in plaintext by the service.", "successStatus": 200, "ttlSeconds": 120 } }, "credentialListReadback": { "authentication": "Bearer active exact connector credential or company-master credential for the pairing company; foreign pairing or company scope is concealed as 404.", "forbiddenFields": [ "connectorCredentialSecret", "secretHash", "secretVerifier", "credentialHash", "credentialVerifier" ], "itemFields": [ "credentialId", "status", "isCurrent", "approvedScopes", "scopeDigest", "createdAt", "activatedAt", "revokedAt", "lastUsedAt" ], "limit": 100, "method": "GET", "ordering": "newest_created_first", "rateLimitPolicy": "status", "receipt": { "action": "list_credentials", "idempotentReplay": false, "privatePayloadExposed": false, "rawCredentialExposed": false, "status": "verified" }, "requiredResponseFields": [ "pairingId", "approvedScopes", "scopeDigest", "currentCredentialId", "items", "count", "totalCount", "hasMore", "limit", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "route": "/api/matm/connector-pairings/{pairingId}/credentials" }, "directAccountSetup": { "automaticRetryAfterUnknownOutcomeAllowed": false, "connectorRule": "Connectors use mode=new pairing; the provisional workspace and grant become durable only after activation.", "idempotencySupported": false, "pairingV1UsesIt": false, "route": "/api/matm/agent-setup/free-account" }, "discoveryRoute": "/.well-known/memoryendpoints-connector", "endpoints": { "activation": "/api/matm/connector-pairings/{pairingId}/activate", "activeNameLeasePreflight": "/api/matm/connector-agent-leases/{agentId}", "authorization": "/connect/authorize/{publicRequestRef}", "authorizationCodeClaim": "/api/matm/connector-pairings/authorization-code-claims", "cancellation": "/api/matm/connector-pairings/{pairingId}/cancel", "credentialList": "/api/matm/connector-pairings/{pairingId}/credentials", "disconnect": "/api/matm/connector-pairings/{pairingId}/disconnect", "masterApproval": "/api/matm/connector-pairings/{publicRequestRef}/master-approve", "pairingRequest": "/api/matm/connector-pairings/requests", "profileHandoff": "/api/matm/connector-bootstrap/profiles/{profileId}", "revocation": "/api/matm/connector-pairings/{pairingId}/revoke", "rotation": "/api/matm/connector-pairings/{pairingId}/rotations", "rotationActivation": "/api/matm/connector-pairings/{pairingId}/rotations/{rotationId}/activate", "runtimeLease": "/api/matm/connector-runtime-lease", "status": "/api/matm/connector-pairings/{pairingId}", "token": "/api/matm/connector-pairings/token", "windowsBootstrap": "/api/matm/connector-bootstrap/windows.py" }, "errorContract": { "envelope": { "error": { "code": "", "detail": "", "safeNoOp": true, "title": "Connector pairing rejected", "valuesRedacted": true }, "ok": false, "rawCredentialExposed": false, "rawPayloadExposed": false, "safeNoOp": true, "valuesRedacted": true }, "forbiddenErrorData": [ "raw credential", "authorization code", "PKCE verifier", "state", "private payload", "tenant metadata", "credential verifier or hash" ], "httpBehavior": { "401": "Invalid proof/state/ref binding, credential, or code; fixed non-reflective response and no mutation.", "403": "Authenticated principal lacks the required exact scope or company-master/human authority; do not retry unchanged.", "404": "Resource is absent or deliberately concealed across an authorization boundary; do not infer existence.", "409": "Idempotency conflict, agent-name collision, or one-use replay; do not retry with changed input under the same key.", "410": "A validly bound request, selector ref, code, or pending grant expired, was canceled, redeemed, revoked, or disconnected; restart pairing when appropriate.", "422": "The exact JSON schema, canonical identity, closed scope set, public-safe payload, or version negotiation failed without mutation.", "429": "Rate limited; honor Retry-After and repeat only the exact request.", "service_error": "No mutation should be inferred; honor Retry-After when present and make an exact retry.", "timeout": "Outcome is unknown; repeat the exact request with the same Idempotency-Key and canonical body." }, "stableCodes": [ "invalid_token", "pkce_verification_failed", "authorization_code_invalid", "authorization_claim_invalid", "pending_credential_not_active", "company_master_required", "insufficient_scope", "connector_scope_forbidden", "runtime_identity_in_use", "runtime_lease_not_held", "pairing_not_found", "pairing_request_not_found", "workspace_not_found", "rotation_not_found", "idempotency_conflict", "authorization_code_already_exchanged", "agent_name_unavailable", "pairing_request_unavailable", "pairing_unavailable", "pairing_not_pending_activation", "rotation_unavailable", "rotation_pending", "grant_not_active", "pairing_verification_failed", "pairing_request_expired", "authorization_code_expired", "authorization_code_redeemed", "pending_grant_expired", "pairing_canceled", "pairing_revoked", "pairing_disconnected", "request_body_too_large", "json_content_type_required", "idempotency_key_required", "idempotency_key_invalid", "schema_version_unsupported", "connector_client_unsupported", "redirect_uri_not_allowed", "state_invalid", "pkce_method_unsupported", "pkce_challenge_invalid", "connector_agent_identity_invalid", "approved_agent_mismatch", "workspace_selection_invalid", "workspace_ref_invalid", "workspace_ref_expired", "company_ref_invalid", "company_ref_expired", "connector_scopes_invalid", "connector_public_safe_payload_required", "idempotency_key_not_allowed", "invalid_request", "rate_limited", "credential_system_not_configured", "connector_service_unavailable", "human_session_required", "human_owner_required", "recovery_session_restricted", "trusted_origin_required", "csrf_required", "csrf_invalid", "human_reauthentication_required", "recent_reauthentication_required", "selected_company_required", "human_company_not_found" ] }, "generatedAt": "2026-07-29T06:22:47.923236Z", "humanApprovalEndpoint": "/api/matm/human/connector-pairings/{publicRequestRef}/approve", "humanCancellationEndpoint": "/api/matm/human/connector-pairings/{publicRequestRef}/cancel", "humanCompanySelectionEndpoint": "/api/matm/human/connector-pairings/{publicRequestRef}/company-selection", "issuer": "https://memoryendpoints.com", "lifecycle": { "automaticExpiry": true, "cancellation": "Pending connector may cancel before activation; provisional resources never become durable.", "disconnect": "The connector immediately revokes its own active credential.", "lostClaimResponse": "Repeat the exact claim body and key before exchange; the same body-only authorization code is deterministically rederived.", "lostExchangeResponse": "Repeat the exact exchange body and key before activation; the same pending connector secret is deterministically rederived without persisting it.", "lostPairingRequestResponse": "Repeat the exact request and Idempotency-Key; the server returns the same public ref and one-time request proof only within its recovery window.", "rawCredentialRecovery": false, "revocation": "Company master immediately revokes the pairing and is audited by masterKeyId.", "rotation": "Two phase: prepare/reveal successor once, store it, then activate; predecessor remains active until atomic successor activation.", "secureStoreFailureBeforeActivation": "Use the pending connector credential to cancel immediately when available; otherwise abandon it and automatic expiry prevents activation." }, "masterApprovalEndpoint": "/api/matm/connector-pairings/{publicRequestRef}/master-approve", "memoryOperations": { "publicSafeSubmit": { "actorBinding": "server-derived exact connector agent", "additionalProperties": false, "authentication": "Bearer active connector credential with memory:public-safe:submit", "expiration": "The connector credential must remain active and unrevoked.", "forbiddenFields": [ "actorAgentId", "workspaceId", "privatePayload", "rawPayload", "content" ], "idempotencyHeaderRequired": true, "invalidCode": "connector_public_safe_payload_required", "method": "POST", "rateLimitPolicy": "publicSafeSubmit", "receiptAction": "public_safe_memory_submit", "requiredFields": [ "schemaVersion", "payloadClass=public_safe", "title", "summary", "tags" ], "responseSchema": "ConnectorPublicSafeMemoryResult", "retryAndReplay": "Exact key/body retry returns one stored result; changed reuse is 409 idempotency_conflict and cannot create another memory item.", "route": "/api/matm/memory-events/submit", "safeNoOp": true, "successStatus": 201 }, "registration": { "additionalProperties": false, "authentication": "Bearer active connector credential with agent:self:register", "behavior": "Idempotently confirm only the profile-bound canonical connector agent identity; cannot select or create any other actor.", "body": { "schemaVersion": "memoryendpoints.connector_pairing.v1" }, "expiration": "The connector credential must remain active and unrevoked; expired, revoked, or disconnected credentials return a fixed redacted 401/410 without mutation.", "idempotencyHeaderRequired": true, "method": "POST", "rateLimitPolicy": "selfRegistration", "receiptAction": "confirm_agent_registration", "responseSchema": "ConnectorAgentRegistrationResult", "retryAndReplay": "Exact key/body retry returns the same already_registered confirmation; changed reuse is 409 idempotency_conflict.", "route": "/api/matm/agents/register", "safeNoOp": true, "successStatus": 200 }, "search": { "additionalProperties": false, "authentication": "Bearer active connector credential with memory:search:read", "expiration": "The connector credential must remain active and unrevoked.", "idempotencyHeaderAllowed": false, "idempotencyHeaderError": "idempotency_key_not_allowed", "limit": { "maximum": 50, "minimum": 1 }, "method": "POST", "rateLimitPolicy": "search", "receiptAction": "memory_search", "requiredFields": [ "schemaVersion", "query", "limit" ], "responseSchema": "ConnectorSearchResult", "retryAndReplay": "Read-only exact retries are safe; no server-side idempotency result is reserved or persisted.", "route": "/api/matm/search", "safeNoOp": true, "scope": "read-only within the exact approved workspace and agent boundary", "successStatus": 200 } }, "operations": { "activation": { "authentication": "Bearer pending connector credential returned by token exchange", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "activation", "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "The same activation retry returns the active result; an expired or canceled pending grant cannot activate.", "requiredFields": [ "schemaVersion" ], "responseSchema": "ConnectorPairingMutationResult", "route": "/api/matm/connector-pairings/{pairingId}/activate", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "authorizationCodeClaim": { "authentication": "Body-only pairingRequestProof plus exact client, redirect URI, and desktop state binding; no browser session or URL credential", "expirationSeconds": 60, "idempotency": { "changedRequestOrKey": "Any changed body or different key after issuance returns 409 idempotency_conflict and cannot reveal or mint another code.", "exactRetry": "The exact original key and body deterministically rederive the same unexpired body-only code before exchange.", "firstApprovedClaim": "Atomically binds request digest, idempotency-key digest, and one authorization-code verifier.", "pending": "202 authorization_pending with Retry-After; the idempotency key is not reserved or persisted while approval is pending.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "pendingResponseSchema": "ConnectorAuthorizationCodeClaimPending", "pendingStatus": 202, "rateLimitPolicy": "authorizationCodeClaim", "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "Valid-proof expired, canceled, or redeemed requests return typed 410. Invalid binding always collapses to 401 authorization_claim_invalid.", "requiredFields": [ "schemaVersion", "clientId", "redirectUri", "pairingRequestProof", "state" ], "responseSchema": "ConnectorAuthorizationCodeClaimResult", "route": "/api/matm/connector-pairings/authorization-code-claims", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "cancellation": { "authentication": "Bearer unactivated pending connector credential", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "activation", "reasonPolicy": { "controlCharactersAllowed": false, "maximumLength": 255, "minimumLength": 1 }, "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "Cancellation is idempotent and permanently prevents activation; no provisional workspace or agent becomes durable.", "requiredFields": [ "schemaVersion", "reason" ], "responseSchema": "ConnectorPairingMutationResult", "route": "/api/matm/connector-pairings/{pairingId}/cancel", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "disconnect": { "authentication": "Bearer active connector credential for the exact pairing", "expirationSeconds": null, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "credentialLifecycle", "reasonPolicy": { "controlCharactersAllowed": false, "maximumLength": 255, "minimumLength": 1 }, "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "Disconnect immediately revokes the caller; an exact retry is an idempotent safe no-op.", "requiredFields": [ "schemaVersion", "reason" ], "responseSchema": "ConnectorPairingMutationResult", "route": "/api/matm/connector-pairings/{pairingId}/disconnect", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "humanApproval": { "authentication": "authenticated username/password human account session, selected company membership, recent password reauthentication, same-origin and Fetch-Metadata checks, and X-CSRF-Token", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "authorize", "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "An exact approval retry returns the same approved-awaiting-claim state and parameter-free wakeUpUrl. Approval never creates or reveals an authorization code.", "requiredFields": [ "schemaVersion", "canonicalAgentApproved=true", "approvedScopes", "workspaceSelection" ], "responseSchema": "ConnectorApprovalResult", "route": "/api/matm/human/connector-pairings/{publicRequestRef}/approve", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200, "workspaceSelection": { "existing": [ "mode=existing", "workspaceRef" ], "new": [ "mode=new", "workspaceLabel", "projectLabel" ] } }, "humanCancellation": { "authentication": "authenticated selected human account session, recent password reauthentication, same-origin Fetch Metadata, X-CSRF-Token, and Idempotency-Key", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "authorize", "reasonPolicy": { "controlCharactersAllowed": false, "maximumLength": 255, "minimumLength": 1 }, "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "Exact retry returns the same canceled request and receipt; changed reuse is a conflict-safe no-op.", "requiredFields": [ "schemaVersion", "reason" ], "responseSchema": "ConnectorPairingRequestMutationResult", "route": "/api/matm/human/connector-pairings/{publicRequestRef}/cancel", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "masterApproval": { "authentication": "Bearer company-master credential loaded from the separately protected v1 credential file and used only for this bootstrap approval", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "masterAuthorityRetainedAsRuntimeCredential": false, "method": "POST", "projectSelection": "projectSelector must resolve to exactly one active project inside the exact workspace; zero or multiple matches fail closed", "rateLimitPolicy": "authorize", "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "An exact retry returns the same redacted approval state. The route never returns an authorization code, connector credential, tenant identifier, or master credential.", "requiredFields": [ "schemaVersion", "profileId", "canonicalAgentApproved=true", "approvedScopes", "workspaceId", "projectSelector" ], "responseSchema": "ConnectorMasterApprovalResult", "route": "/api/matm/connector-pairings/{publicRequestRef}/master-approve", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "pairingRequest": { "authentication": "public fixed-profile request; subsequent exact approval requires either protected company-master bootstrap authority or the optional authenticated human workflow", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "pairingRequest", "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "Only an exact idempotent retry is accepted during the request lifetime.", "requiredFields": [ "schemaVersion", "clientId", "redirectUri", "state", "codeChallenge", "codeChallengeMethod", "requestedAgentId", "requestedScopes" ], "responseSchema": "ConnectorPairingRequestResult", "route": "/api/matm/connector-pairings/requests", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 201 }, "revocation": { "authentication": "Bearer company master credential authorized for the pairing company; audited as a machine actor by masterKeyId", "expirationSeconds": null, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "credentialLifecycle", "reasonPolicy": { "controlCharactersAllowed": false, "maximumLength": 255, "minimumLength": 1 }, "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "Revoking an already revoked grant is an idempotent safe no-op with the original redacted receipt.", "requiredFields": [ "schemaVersion", "reason" ], "responseSchema": "ConnectorPairingMutationResult", "route": "/api/matm/connector-pairings/{pairingId}/revoke", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "rotation": { "authentication": "Bearer active connector credential for the exact pairing", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "credentialLifecycle", "reasonPolicy": { "controlCharactersAllowed": false, "maximumLength": 255, "minimumLength": 1 }, "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "An exact retry may recover the same pending successor while it remains unactivated; the predecessor stays active until successor activation.", "requiredFields": [ "schemaVersion", "reason" ], "responseSchema": "ConnectorRotationPrepareResult", "route": "/api/matm/connector-pairings/{pairingId}/rotations", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 201 }, "rotationActivation": { "authentication": "Bearer pending successor connector credential", "expirationSeconds": 600, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "credentialLifecycle", "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "Exact retry returns the active successor; activation atomically activates the successor and revokes the predecessor.", "requiredFields": [ "schemaVersion" ], "responseSchema": "ConnectorRotationActivationResult", "route": "/api/matm/connector-pairings/{pairingId}/rotations/{rotationId}/activate", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 200 }, "tokenExchange": { "authentication": "Body-only one-use authorization code plus RFC 7636 PKCE S256 verifier bound to the original client, redirect URI, and exact scope digest", "expirationSeconds": 60, "idempotency": { "changedRequest": "Same key with a different canonical request returns 409 idempotency_conflict and performs no mutation.", "exactRetry": "Same key and canonical request returns the original status and response.", "lostResponse": "Retry the identical request with the identical key; never start a replacement pairing because a response was lost.", "requiredHeader": "Idempotency-Key" }, "method": "POST", "rateLimitPolicy": "tokenExchange", "receipt": { "fields": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "privatePayloadExposed": false, "rawCredentialExposed": false, "required": true }, "replay": "A different key or request after exchange returns authorization_code_already_exchanged; after activation it returns authorization_code_redeemed. The exact pending exchange retry is recoverable.", "requiredFields": [ "schemaVersion", "grantType=authorization_code", "clientId", "redirectUri", "code", "codeVerifier" ], "responseSchema": "ConnectorTokenExchangeResult", "route": "/api/matm/connector-pairings/token", "safeNoOp": "Failure and completed-state retries do not create another workspace, agent, grant, or credential.", "successStatus": 201 } }, "optionalHumanPairingFlow": "The browser approval route remains an explicitly selected interactive alternative. It is not required by protected master-file bootstrap and does not alter the connector credential or scope contract.", "pairingFlow": [ "Fetch same-origin public discovery without following redirects.", "Generate 256-bit state and an RFC 7636 PKCE verifier/challenge on the desktop.", "Create an idempotent pairing request and retain its one-time proof and state only in the receiving bootstrap process.", "Load the separately protected company-master v1 credential file, verify its authenticated company readback, and approve the exact profile, nine scopes, file-bound workspace, and canonical project selector.", "Clear bootstrap authority from the process immediately after the approval response; never store it in the connector Credential Manager target or reuse it as runtime authority.", "Claim a short-lived one-use authorization code through the JSON POST claim route using proof, state, client, redirect URI, and the original Idempotency-Key.", "Exchange the code directly with PKCE and an Idempotency-Key.", "Store the one-time pending connector credential in the operating-system credential vault; persist only non-secret recovery metadata.", "Activate the pending grant with an exact-retry Idempotency-Key.", "Read pairing status, /api/matm/me entitlement flags, and the canonical workspace; confirm the already-registered agent through the distinct idempotent POST mutation.", "Acquire the runtime lease before inbox, room, acknowledgement, or coordinator-status operations and release it after protected work." ], "profiles": [ { "canonicalAgentDisplayName": "LocalEndpoint Agent", "canonicalAgentId": "localendpoint-agent", "clientDisplayName": "LocalEndpoints Connect", "clientId": "localendpoints-connect", "credentialManagerTarget": "MemoryEndpoints/connector/localendpoint-agent", "handoffPath": "/api/matm/connector-bootstrap/profiles/localendpoints", "profileId": "localendpoints", "registeredRedirectUris": [ "localendpoints-connect://memoryendpoints/callback" ], "requestedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67" }, { "canonicalAgentDisplayName": "RemoteEndpoints Agent", "canonicalAgentId": "remoteendpoints-agent", "clientDisplayName": "RemoteEndpoints Connect", "clientId": "remoteendpoints-connect", "credentialManagerTarget": "MemoryEndpoints/connector/remoteendpoints-agent", "handoffPath": "/api/matm/connector-bootstrap/profiles/remoteendpoints", "profileId": "remoteendpoints", "registeredRedirectUris": [ "remoteendpoints-connect://memoryendpoints/callback" ], "requestedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "scopeDigest": "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" } ], "publicRequestReference": { "authorizing": false, "base64urlCharacters": 43, "expiresInSeconds": 600, "forbiddenResolvedFields": [ "companyId", "workspaceId", "projectId", "agentId", "requestId", "credentialId" ], "name": "publicRequestRef", "pattern": "pairref_[A-Za-z0-9_-]{43}", "prefix": "pairref_", "public": true, "resolvesOnly": [ "clientDisplayName", "agentDisplayName", "scopeImpactLabels", "status", "expiresAt" ], "secret": false, "tenantNeutral": true }, "purpose": "Pair one registered LocalEndpoints or RemoteEndpoints desktop profile to one exact MemoryEndpoints project with fresh narrow authority on the receiving computer.", "rateLimits": { "activation": { "limit": 20, "partition": "pending_grant", "windowSeconds": 600 }, "authorizationCodeClaim": { "limit": 10, "partition": "source_ip_and_client", "windowSeconds": 600 }, "authorize": { "limit": 10, "partition": "source_ip_and_client", "windowSeconds": 600 }, "coordinationRead": { "limit": 120, "partition": "connector_credential", "windowSeconds": 60 }, "coordinationWrite": { "limit": 30, "partition": "connector_credential", "windowSeconds": 60 }, "credentialLifecycle": { "limit": 10, "partition": "connector_credential", "windowSeconds": 3600 }, "discovery": { "limit": 60, "partition": "source_ip", "windowSeconds": 60 }, "pairingRequest": { "limit": 10, "partition": "source_ip_and_client", "windowSeconds": 600 }, "publicSafeSubmit": { "limit": 60, "partition": "connector_credential", "windowSeconds": 60 }, "runtimeLease": { "limit": 60, "partition": "connector_credential", "windowSeconds": 60 }, "search": { "limit": 120, "partition": "connector_credential", "windowSeconds": 60 }, "selfRegistration": { "limit": 5, "partition": "connector_credential", "windowSeconds": 600 }, "status": { "limit": 60, "partition": "connector_credential", "windowSeconds": 60 }, "tokenExchange": { "limit": 10, "partition": "source_ip_and_client", "windowSeconds": 600 } }, "references": { "companionDocs": "https://multiagentmemory.com", "openApi": "/api/matm/openapi.json", "routeInventory": "/api/matm/route-inventory", "sourceRepository": "https://github.com/MichaelKappel/Multi-Agent-Memory" }, "requestedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "routeAuthorityMatrix": { "allowed": [ { "method": "GET", "route": "/api/matm/me", "scope": "connector:self:readback" }, { "method": "GET", "route": "/api/matm/workspace", "scope": "connector:self:readback" }, { "method": "GET", "route": "/api/matm/connector-pairings/{pairingId}", "scope": "connector:self:readback" }, { "method": "GET", "route": "/api/matm/connector-pairings/{pairingId}/credentials", "scope": "connector:self:readback" }, { "method": "POST", "route": "/api/matm/agents/register", "scope": "agent:self:register" }, { "method": "POST", "route": "/api/matm/connector-runtime-lease", "scope": "connector:self:runtime-lease" }, { "method": "GET", "route": "/api/matm/current-message", "runtimeLeaseRequired": true, "scope": "coordination:self:current-message:read" }, { "method": "GET", "route": "/api/matm/meeting-rooms", "runtimeLeaseRequired": true, "scope": "coordination:project:rooms:read" }, { "method": "POST", "route": "/api/matm/notifications/ack", "runtimeLeaseRequired": true, "scope": "coordination:self:notification:ack" }, { "method": "POST", "route": "/api/matm/agent-messages", "runtimeLeaseRequired": true, "scope": "coordination:coordinator:status:write" }, { "method": "POST", "route": "/api/matm/memory-events/submit", "scope": "memory:public-safe:submit" }, { "method": "POST", "route": "/api/matm/search", "scope": "memory:search:read" }, { "method": "POST", "route": "/api/matm/connector-pairings/{pairingId}/activate", "scope": "intrinsic_connector_lifecycle" }, { "method": "POST", "route": "/api/matm/connector-pairings/{pairingId}/rotations", "scope": "intrinsic_connector_lifecycle" }, { "method": "POST", "route": "/api/matm/connector-pairings/{pairingId}/rotations/{rotationId}/activate", "scope": "intrinsic_connector_lifecycle" }, { "method": "POST", "route": "/api/matm/connector-pairings/{pairingId}/disconnect", "scope": "intrinsic_connector_lifecycle" }, { "method": "POST", "route": "/api/matm/connector-pairings/{pairingId}/cancel", "scope": "intrinsic_connector_lifecycle" } ], "default": "deny with 403 connector_scope_forbidden before body parsing or storage dispatch", "explicitlyDeniedCapabilities": [ "human APIs", "company/access management", "invites", "other-agent roster or inbox", "unbound meeting transcripts or message creation", "audit or history", "export or company lifecycle", "knowledge administration", "external-link mutation", "review queue", "sync", "every unlisted route" ] }, "schemaVersion": "memoryendpoints.connector_pairing.v1", "scopeDigestCanonicalization": { "algorithm": "sha256-v1", "encoding": "compact sorted-key UTF-8 JSON", "format": "sha256-v1:<64 lowercase hex>", "orderedInputFields": [ "schemaVersion", "profileId", "clientId", "agentId", "scopes" ] }, "scopeDigests": [ { "agentId": "localendpoint-agent", "clientId": "localendpoints-connect", "profileId": "localendpoints", "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67" }, { "agentId": "remoteendpoints-agent", "clientId": "remoteendpoints-connect", "profileId": "remoteendpoints", "scopeDigest": "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" } ], "scopeImpacts": [ { "impact": "Verify this exact connector, workspace, and agent binding.", "scope": "connector:self:readback" }, { "impact": "Acquire and renew only this connector identity's short-lived process lease.", "scope": "connector:self:runtime-lease" }, { "impact": "Confirm the exact registered connector agent after activation.", "scope": "agent:self:register" }, { "impact": "Read only current messages visible to this exact connector agent.", "scope": "coordination:self:current-message:read" }, { "impact": "Acknowledge only a notification visible to this exact connector agent after handling it.", "scope": "coordination:self:notification:ack" }, { "impact": "Read only the connector's bound project coordination room metadata.", "scope": "coordination:project:rooms:read" }, { "impact": "Send one public-safe status summary to the registered MemoryEndpoints coordinator identity.", "scope": "coordination:coordinator:status:write" }, { "impact": "Submit public-safe memory as this exact connector agent.", "scope": "memory:public-safe:submit" }, { "impact": "Search memory readable by this exact connector grant.", "scope": "memory:search:read" } ], "security": { "authorizationCallbackParametersAllowed": false, "authorizationCodeDelivery": "body_only_claim", "authorizationCodeOneUse": true, "authorizationCodeTtlSeconds": 60, "autoWakeAllowed": false, "automatedMasterApprovalUsesWakeUp": false, "credentialRecoveryMetadata": [ "issuer", "schemaVersion", "profileId", "pairingId", "agentId", "credentialId", "scopeDigest" ], "credentialStorage": "operating_system_credential_vault", "desktopStateEntropyBits": 256, "forbiddenPersistence": [ "pairingRequestProof", "state", "authorizationCode", "codeVerifier", "requestBody", "secretBearingIdempotentResponse" ], "forbiddenUrlData": [ "workspace_key", "company_master", "connector_credential", "durable_bearer", "private_payload", "workspace_id", "agent_id" ], "humanWakeUpRequiresExplicitAction": true, "pendingGrantTtlSeconds": 600, "persistedSecretMaterial": "constant-time verifiers and bounded derivation inputs only", "pkceMethods": [ "S256" ], "pkceVerifierLength": { "maximum": 128, "minimum": 43 }, "requestTtlSeconds": 600, "stateReturnedInUrl": false, "stateVerifiedOnlyInClaimResponse": true }, "selectorReferences": { "companyRef": { "expiredCode": "company_ref_expired", "invalidCode": "company_ref_invalid", "pattern": "companyref_[A-Za-z0-9_-]{43}", "requestBound": true, "sessionBound": true }, "projectRef": { "expiredCode": "project_ref_expired", "invalidCode": "project_ref_invalid", "opaque": true, "requestBound": true, "sessionBound": true, "workspaceBound": true }, "workspaceRef": { "expiredCode": "workspace_ref_expired", "invalidCode": "workspace_ref_invalid", "opaque": true, "requestBound": true, "sessionBound": true } }, "serviceRoot": { "exact": "https://memoryendpoints.com", "fragmentAllowed": false, "nonDefaultPortAllowed": false, "queryAllowed": false, "trailingSlashInputCanonicalized": true, "userinfoAllowed": false }, "site": "MemoryEndpoints", "status": "public_safe_contract", "statusReadback": { "authentication": "Bearer active connector credential for the exact pairing", "connectedRule": "Show Connected only when every positive verification field is true, grantRevoked is false, both exact identifiers match the approved recovery metadata, and authenticated /api/matm/me plus /api/matm/workspace readback also succeed.", "method": "GET", "rateLimitPolicy": "status", "receipt": { "action": "verify", "idempotentReplay": false, "privatePayloadExposed": false, "rawCredentialExposed": false, "status": "verified" }, "requiredResponseFields": { "agent": [ "agentId", "readable" ], "grant": [ "credentialType", "scopeType", "scopeId", "workspaceId", "agentId", "approvedScopes", "scopeDigest", "active", "revoked", "canInvite", "canRevoke" ], "pairing": [ "pairingId", "credentialId", "status", "workspaceId", "agentId", "workspace", "agent", "grant", "approvedScopes", "scopeDigest" ], "topLevel": [ "ok", "schemaVersion", "pairing", "approvedScopes", "scopeDigest", "verification", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "verification": [ "canonicalWorkspaceReadable", "canonicalWorkspaceIdMatches", "exactAgentReadable", "exactAgentIdMatches", "credentialScopedToConnectorAndAgent", "grantActive", "grantRevoked", "rawCredentialExposed", "privatePayloadExposed", "valuesRedacted" ], "workspace": [ "workspaceId", "readable" ] }, "route": "/api/matm/connector-pairings/{pairingId}" }, "strictResponseProjections": { "oneTimeSecretWrapper": { "fields": [ "credentialDeliveredToAuthorizedRecipient", "rawCredentialPersisted", "showCredentialOnce" ], "rawCredentialExposedFieldPresent": false }, "pairing": { "additionalProperties": false, "fields": [ "pairingId", "status", "workspaceId", "agentId", "credentialId", "approvedScopes", "scopeDigest", "grant" ], "grantFields": [ "credentialType", "scopeType", "scopeId", "workspaceId", "agentId", "approvedScopes", "scopeDigest", "active", "revoked", "canInvite", "canRevoke" ], "optionalFields": [ "activationExpiresInSeconds", "workspace", "agent" ] }, "pairingRequest": { "additionalProperties": false, "cancellationAdditionalFields": [], "creationAdditionalFields": [ "expiresInSeconds" ], "fields": [ "publicRequestRef", "status", "clientDisplayName", "agentDisplayName", "requestedScopes", "approvedScopes", "scopeDigest", "scopeImpacts", "expiresAt", "claimExpiresAt" ] }, "rotation": { "additionalProperties": false, "fields": [ "rotationId", "status", "credentialId", "approvedScopes", "scopeDigest" ], "optionalFields": [ "activationExpiresInSeconds" ] } }, "syntheticExamples": { "approval": { "request": { "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "canonicalAgentApproved": true, "schemaVersion": "memoryendpoints.connector_pairing.v1", "workspaceSelection": { "mode": "existing", "workspaceRef": "" } }, "response": { "approval": { "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "status": "approved_awaiting_connector_claim" }, "authorizationCodeExposed": false, "schemaVersion": "memoryendpoints.connector_pairing.v1", "stateExposed": false, "wakeUpUrl": "localendpoints-connect://memoryendpoints/callback" } }, "authorizationCodeClaim": { "request": { "clientId": "localendpoints-connect", "pairingRequestProof": "", "redirectUri": "localendpoints-connect://memoryendpoints/callback", "schemaVersion": "memoryendpoints.connector_pairing.v1", "state": "" }, "response": { "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "authorizationCode": "", "credentialDeliveredToAuthorizedRecipient": true, "expiresInSeconds": 60, "rawCredentialPersisted": false, "schemaVersion": "memoryendpoints.connector_pairing.v1", "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "showCredentialOnce": true, "stateVerified": true } }, "pairingRequest": { "request": { "clientId": "localendpoints-connect", "codeChallenge": "", "codeChallengeMethod": "S256", "redirectUri": "localendpoints-connect://memoryendpoints/callback", "requestedAgentId": "localendpoint-agent", "requestedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "schemaVersion": "memoryendpoints.connector_pairing.v1", "state": "" }, "response": { "authorizationUrl": "https://memoryendpoints.com/connect/authorize/pairref_<43_BASE64URL_CHARACTERS>", "credentialDeliveredToAuthorizedRecipient": true, "pairingRequest": { "agentDisplayName": "LocalEndpoint Agent", "approvedScopes": [], "claimExpiresAt": null, "clientDisplayName": "LocalEndpoints Connect", "expiresAt": "", "expiresInSeconds": 600, "publicRequestRef": "pairref_<43_BASE64URL_CHARACTERS>", "requestedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "scopeImpacts": [ { "impact": "Verify this exact connector, workspace, and agent binding.", "scope": "connector:self:readback" }, { "impact": "Acquire and renew only this connector identity's short-lived process lease.", "scope": "connector:self:runtime-lease" }, { "impact": "Confirm the exact registered connector agent after activation.", "scope": "agent:self:register" }, { "impact": "Read only current messages visible to this exact connector agent.", "scope": "coordination:self:current-message:read" }, { "impact": "Acknowledge only a notification visible to this exact connector agent after handling it.", "scope": "coordination:self:notification:ack" }, { "impact": "Read only the connector's bound project coordination room metadata.", "scope": "coordination:project:rooms:read" }, { "impact": "Send one public-safe status summary to the registered MemoryEndpoints coordinator identity.", "scope": "coordination:coordinator:status:write" }, { "impact": "Submit public-safe memory as this exact connector agent.", "scope": "memory:public-safe:submit" }, { "impact": "Search memory readable by this exact connector grant.", "scope": "memory:search:read" } ], "status": "pending_human_approval" }, "pairingRequestProof": "", "rawCredentialPersisted": false, "schemaVersion": "memoryendpoints.connector_pairing.v1", "showCredentialOnce": true } }, "tokenExchange": { "request": { "clientId": "localendpoints-connect", "code": "", "codeVerifier": "", "grantType": "authorization_code", "redirectUri": "localendpoints-connect://memoryendpoints/callback", "schemaVersion": "memoryendpoints.connector_pairing.v1" }, "response": { "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "connectorCredentialSecret": "", "credentialDeliveredToAuthorizedRecipient": true, "credentialDelivery": { "exactRetryUntilActivation": true, "rawCredentialPersisted": false, "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "showCredentialOnce": true }, "pairing": { "activationExpiresInSeconds": 600, "agentId": "localendpoint-agent", "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "credentialId": "connector_example", "grant": { "active": false, "agentId": "localendpoint-agent", "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "canInvite": false, "canRevoke": false, "credentialType": "connector_agent", "revoked": false, "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "scopeId": "localendpoint-agent", "scopeType": "agent", "workspaceId": "workspace_example" }, "pairingId": "pairing_example", "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "status": "pending_activation", "workspaceId": "workspace_example" }, "rawCredentialPersisted": false, "schemaVersion": "memoryendpoints.connector_pairing.v1", "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "showCredentialOnce": true } }, "verification": { "ok": true, "pairing": { "agent": { "agentId": "localendpoint-agent", "readable": true }, "agentId": "localendpoint-agent", "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "credentialId": "connector_example", "grant": { "active": true, "agentId": "localendpoint-agent", "approvedScopes": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "canInvite": false, "canRevoke": false, "credentialType": "connector_agent", "revoked": false, "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "scopeId": "localendpoint-agent", "scopeType": "agent", "workspaceId": "workspace_example" }, "pairingId": "pairing_example", "scopeDigest": "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "status": "active", "workspace": { "readable": true, "workspaceId": "workspace_example" }, "workspaceId": "workspace_example" }, "schemaVersion": "memoryendpoints.connector_pairing.v1", "verification": { "canonicalWorkspaceIdMatches": true, "canonicalWorkspaceReadable": true, "credentialScopedToConnectorAndAgent": true, "exactAgentIdMatches": true, "exactAgentReadable": true, "grantActive": true, "grantRevoked": false, "privatePayloadExposed": false, "rawCredentialExposed": false, "valuesRedacted": true } } }, "threatModel": { "browserExfiltration": "Approval uses no-referrer, strict CSP, COOP/CORP, restrictive Permissions-Policy, no opener, parameter-free wake-up, and no automatic navigation.", "claimTheft": "Claim requires the desktop-held request proof, state, client, redirect URI, exact scope digest, and idempotency binding; invalid bindings collapse to one fixed 401.", "codeInterception": "The body-only code is one-use, expires in 60 seconds, and requires the original PKCE S256 verifier.", "credentialEscalation": "Connector credentials remain connector_agent principals under the closed nine-scope, deny-by-default route matrix and never inherit company-master, workspace-administrator, ordinary-agent, or NPC-runtime authority.", "persistenceAndTelemetry": "Raw proof, state, code, verifier, connector secret, request body, and secret-bearing idempotent response are not persisted, audited, logged, or reflected.", "requestEnumeration": "Public refs are 256-bit random values and resolve only bounded allowlisted display metadata.", "urlLeakage": "Only a tenant-neutral, non-authorizing publicRequestRef appears in the approval URL. Codes, state, proofs, credentials, and private identifiers are body-only." }, "transport": { "authorizeDocumentHeaders": { "Content-Security-Policy": "default-src 'none' with nonce-bound local assets and form-action self", "Cross-Origin-Opener-Policy": "same-origin", "Cross-Origin-Resource-Policy": "same-origin", "Permissions-Policy": "all unneeded features disabled", "Referrer-Policy": "no-referrer" }, "cacheControlForSensitiveResponses": "private, no-store", "explicitJsonContentType": "application/json", "httpsIssuerRequired": true, "maximumDiscoveryResponseBytes": 16384, "maximumPairingJsonRequestBytes": 32768, "maximumPairingJsonResponseBytes": 65536, "noRedirectsForApiEndpoints": true, "referrerPolicy": "no-referrer", "sameOriginAdvertisedEndpoints": true, "sensitiveResponseHeaders": { "Cache-Control": "private, no-store", "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff" }, "supportedSchemaVersions": [ "memoryendpoints.connector_pairing.v1" ], "tlsValidation": "operating_system_default", "versionNegotiation": "Request schemaVersion must equal memoryendpoints.connector_pairing.v1; unsupported versions fail without mutation." }, "truthBoundary": { "authorizationCodeDelivery": "body_only_claim", "authorizationUrlData": [ "publicRequestRef" ], "connectorCredentialScope": "connector_and_exact_agent", "pendingCredentialUsableBeforeActivation": false, "privatePayloadInUrl": false, "publicRequestRefAuthorizes": false, "rawCredentialInUrl": false, "rawCredentialPersistedByServer": false, "tenantIdentifierInPublicDiscovery": false, "wakeUpUrlParameters": [], "workspaceKeysUsedByPairing": false }, "workspaceProvisioning": { "abandonedOrCanceled": "The provisional hierarchy and agent registration are discarded on cancellation or expiry.", "crashSafety": "Pairing-request, approved claim, token-exchange, and activation exact retries recover one outcome; neither a timeout nor a lost response can create a second workspace, agent, grant, or credential.", "existingWorkspace": "Human approval binds to an explicitly selected workspace in the selected company.", "newWorkspace": "Human approval reserves a provisional workspace/project identity; neither workspace nor agent is durable until pending grant activation." } }, "ok": true }