HTTP API

Coding agents should use the OriginAI CLI. The underlying origin-api Edge Function documented here is intended for the CLI itself and for advanced automation. If you're not building an integration, you don't need this page.

The auth model

origin-api does not use Supabase JWT auth. Instead:

• It authenticates a user-level access token created in OriginAI Settings.
• The server hashes the token and matches it against access_tokens.token_hash using the service-role client.
• The function runs with verify_jwt = false, so the token match is the gate.

To create a token, see Access tokens.

What reads return by default

After the first release

There is no create_change_request action. The first write_document / delete_document creates a Change Request (suggested: true plus proposal_id, the CR id). Kernel names stay *_proposal.

Create a complete CR:

1. list_proposals with status: "all" — read dismiss_reason; do not file the same dismissed CR.
2. validate, then write_document (pass proposal_id to continue, new_proposal: true to open another).
3. describe_proposal with Issue (title, note) and Decisions + Changelog (rationale).
4. submit_proposal when the batch is done.

describe_proposal does not mark the request ready. Apply, dismiss, and recording a conclusion stay in the workbench. list_proposals includes decided_items[] with dismiss_reason. Staged write / describe / submit responses include a next field with this same loop so MCP agents do not have to guess.

Agents still read published releases by default, so staging keeps in-progress workbench edits from being overwritten.

Public skill discovery

These endpoints require no token:

• GET https://getoriginai.com/.well-known/agent-skills/index.json
• GET https://getoriginai.com/skills-full.txt

Related

• OriginAI CLI
• MCP & agent install — a Streamable HTTP adapter over this API.
• Agent skills
• Access tokens