Reference

Use the REST API for the route inventory and the published OpenAPI JSON for the same routes in machine-readable form. A running managed-services build serves the interactive API documentation at /api/docs and the same raw description at /api/openapi.json.

The OpenAPI document is an inventory of the routes, not yet a full contract. For each route it declares the path and query parameters, the tenancy headers, the accepted security schemes, the required permission and the throttle. It declares no request bodies and no response schemas, on any route, so a client generated from it knows where to send a call but not what to put in it. For the body of a route, the reference is its page in these docs where one describes it, and otherwise the engine’s own validation code.

The inbound webhook routes under /webhooks/ appear with security: [] because they carry no authentication header, but none of them is open. Each authenticates in its own way: Telegram with the X-Telegram-Bot-Api-Secret-Token header, Slack, Twilio and HubSpot with the provider’s request signature, email and event sources with a secret in the path. See Webhooks and Channels.

Environment variables · REST API · OpenAPI JSON · OpenAI-compatible API · Changelog · Roles · Licence

Integration routes

Polyant is a client of external MCP servers; it does not expose a generic /mcp server endpoint. The public MCP route is the OAuth return point, /mcp/oauth/callback (route reference).

External A2A clients discover an agent with GET at /a2a/{slug}/.well-known/agent-card.json and run turns with POST at /a2a/{slug}/jsonrpc (route reference). The internal agent channel is only for communication between agents in the same deployment; external callers use A2A.