atmon docs

REFERENCE/API/CATALOG.MD

CatalogService

Read what exists: the apps atmon can reach, the tools each one brings, and one tool's full definition. Most callers reach this through search rather than by browsing, and use it to draw their own connect screen.

Every call is a POST to https://api.atmon.ai/automaton.v1.CatalogService/<Call> with a JSON body, and authenticates with Authorization: Bearer <your project key>. Field names in JSON are lowerCamelCase, so the field written tool_slug below is toolSlug on the wire. How to call the API has the whole convention.

Calls

CallRequestResponseSummary
ListToolkitsListToolkitsRequestListToolkitsResponseLists the toolkits the caller can see: the shared catalog, plus the caller's own private toolkits when a project is named.
GetToolkitGetToolkitRequestGetToolkitResponseReads one toolkit by slug.
ListToolsListToolsRequestListToolsResponseLists tools, optionally narrowed to one toolkit or one kind.
GetToolGetToolRequestGetToolResponseReads one tool's full definition by its catalog-wide slug: description, both JSON Schemas, required scopes, and access class.
GetToolkitConnectSpecGetToolkitConnectSpecRequestGetToolkitConnectSpecResponseReads what a connect form for one toolkit needs: the templated base URL, the account variables the address is built from, and the schemes a connection can be made under.

ListToolkits

Lists the toolkits the caller can see: the shared catalog, plus the caller's own private toolkits when a project is named.

Request ListToolkitsRequest, response ListToolkitsResponse.

POST /automaton.v1.CatalogService/ListToolkits HTTP/1.1
Host: api.atmon.ai
Authorization: Bearer amk_your_project_key
Content-Type: application/json

{
  "projectId": "..."
}

The response:

{
  "toolkits": [{
    "slug": "...",
    "name": "...",
    "description": "...",
    "version": "...",
    "authSchemes": ["..."],
    "ownerProjectId": "...",
    "category": "...",
    "connectable": true,
    "connectability": "TOOLKIT_CONNECTABILITY_READY"
  }]
}

GetToolkit

Reads one toolkit by slug. A project-owned entry wins over a shared entry with the same slug.

Request GetToolkitRequest, response GetToolkitResponse.

POST /automaton.v1.CatalogService/GetToolkit HTTP/1.1
Host: api.atmon.ai
Authorization: Bearer amk_your_project_key
Content-Type: application/json

{
  "slug": "...",
  "projectId": "..."
}

The response:

{
  "toolkit": {
    "slug": "...",
    "name": "...",
    "description": "...",
    "version": "...",
    "authSchemes": ["..."],
    "ownerProjectId": "...",
    "category": "...",
    "connectable": true,
    "connectability": "TOOLKIT_CONNECTABILITY_READY"
  }
}

ListTools

Lists tools, optionally narrowed to one toolkit or one kind. An agent should resolve an intent through the router rather than enumerate this.

Request ListToolsRequest, response ListToolsResponse.

POST /automaton.v1.CatalogService/ListTools HTTP/1.1
Host: api.atmon.ai
Authorization: Bearer amk_your_project_key
Content-Type: application/json

{
  "toolkitSlug": "...",
  "kind": "TOOL_KIND_ACTION",
  "projectId": "..."
}

The response:

{
  "tools": [{
    "slug": "...",
    "toolkitSlug": "...",
    "kind": "TOOL_KIND_ACTION",
    "description": "...",
    "inputSchemaJson": "{}",
    "outputSchemaJson": "{}",
    "requiredScopes": ["..."],
    "ownerProjectId": "...",
    "accessClass": "..."
  }]
}

GetTool

Reads one tool's full definition by its catalog-wide slug: description, both JSON Schemas, required scopes, and access class. This is what the MCP describe_tool meta-tool answers with.

Request GetToolRequest, response GetToolResponse.

POST /automaton.v1.CatalogService/GetTool HTTP/1.1
Host: api.atmon.ai
Authorization: Bearer amk_your_project_key
Content-Type: application/json

{
  "slug": "...",
  "projectId": "..."
}

The response:

{
  "tool": {
    "slug": "...",
    "toolkitSlug": "...",
    "kind": "TOOL_KIND_ACTION",
    "description": "...",
    "inputSchemaJson": "{}",
    "outputSchemaJson": "{}",
    "requiredScopes": ["..."],
    "ownerProjectId": "...",
    "accessClass": "..."
  }
}

GetToolkitConnectSpec

Reads what a connect form for one toolkit needs: the templated base URL, the account variables the address is built from, and the schemes a connection can be made under. It carries no credential and no endpoint a credential is presented to.

Request GetToolkitConnectSpecRequest, response GetToolkitConnectSpecResponse.

POST /automaton.v1.CatalogService/GetToolkitConnectSpec HTTP/1.1
Host: api.atmon.ai
Authorization: Bearer amk_your_project_key
Content-Type: application/json

{
  "slug": "...",
  "projectId": "..."
}

The response:

{
  "spec": {
    "toolkitSlug": "...",
    "baseUrlTemplate": "...",
    "accountVariables": [{ ... }],
    "authSchemes": [{ ... }]
  }
}

Messages

AccountVariableSpec

AccountVariableSpec is one entry of a toolkit's account_variables: a fact about the customer's own deployment that the connection captures and the base URL renders. Description is the sentence the connecting person is asked for it with, and Example is a well-formed answer.

FieldType#Notes
namestring1
descriptionstring2
examplestring3empty when the toolkit declared none
decides_originbool4Whether this value decides the address the deployment dials: the registrable domain, the host, or the port. False means it fills a label under a host the toolkit itself wrote down. InitiateConnection requires the approver role when a toolkit declares one, so a form that asks for it can say so before anyone fills it in.

GetToolRequest

FieldType#Notes
slugstring1
project_idstring2Set to a project id to also see that project's private tools. Empty resolves against the shared catalog only.

GetToolResponse

FieldType#Notes
toolTool1

GetToolkitConnectSpecRequest

FieldType#Notes
slugstring1
project_idstring2Set to a project id to also resolve that project's private toolkits. Empty resolves against the shared catalog only.

GetToolkitConnectSpecResponse

FieldType#Notes
specToolkitConnectSpec1

GetToolkitRequest

FieldType#Notes
slugstring1
project_idstring2Set to a project id to also see that project's private toolkits. Empty resolves against the shared catalog only.

GetToolkitResponse

FieldType#Notes
toolkitToolkit1

ListToolkitsRequest

FieldType#Notes
project_idstring1Set to a project id to list the shared catalog plus that project's private toolkits. Empty lists the shared catalog only.

ListToolkitsResponse

FieldType#Notes
toolkitsrepeated Toolkit1

ListToolsRequest

FieldType#Notes
toolkit_slugstring1empty lists across all toolkits
kindToolKind2unspecified lists both kinds
project_idstring3Set to a project id to list shared tools plus that project's private tools. Empty lists shared tools only.

ListToolsResponse

FieldType#Notes
toolsrepeated Tool1

Tool

FieldType#Notes
slugstring1"github.create_issue"
toolkit_slugstring2
kindToolKind3
descriptionstring4LLM-facing, tuned for routing and selection
input_schema_jsonstring5JSON Schema for arguments
output_schema_jsonstring6JSON Schema for results
required_scopesrepeated string7
owner_project_idstring8empty means the shared catalog
access_classstring9Blast radius: read | write | destructive, from the toolkit definition. Execution's mutation gate keys off it, so a caller can tell before it calls which tools hold until the agent passes confirm.

Toolkit

FieldType#Notes
slugstring1"github", "slack"
namestring2
descriptionstring3
versionstring4version of the toolkit definition, not the app
auth_schemesrepeated string5"oauth2", "api_key", "none"
owner_project_idstring6empty means the shared catalog
categorystring7Browsing taxonomy slug, one of twelve closed-set categories: "communication", "work-tracking", "developer-infrastructure", and so on. Every toolkit carries exactly one; the catalog loader refuses a definition that names none or names one outside the set.
connectablebool8Whether an account can be created for this toolkit on this deployment at all. A client reads this rather than deriving it from connectability, so a value it does not recognize leaves the app offered rather than silently disabled.
connectabilityToolkitConnectability9Why connectable reads the way it does.

ToolkitAuthSchemeSpec

ToolkitAuthSchemeSpec is one scheme a connection to the toolkit can be made under, with the fields that scheme's form needs. The type-specific fields are empty for the types they do not apply to.

FieldType#Notes
typestring1oauth2 | api_key | basic | none
default_scopesrepeated string2oauth2: what the consent request asks for
key_placementstring3api_key: header | query
key_namestring4api_key: the header or query-parameter name

ToolkitConnectSpec

ToolkitConnectSpec is what a connect form for one toolkit is built from: where its calls go, the per-customer values the address is built from, and the schemes a connection can be made under.

The scheme list is narrower than Toolkit.auth_schemes, which reports every scheme the toolkit declares. A client_credentials scheme is absent here because no connected account is made under it: the project holds that credential and InitiateConnection refuses the scheme by name.

FieldType#Notes
toolkit_slugstring1
base_url_templatestring2The declared base_url with its {{account.<name>}} placeholders still in it, so a form can render the host it is building as the values are typed.
account_variablesrepeated AccountVariableSpec3in declaration order
auth_schemesrepeated ToolkitAuthSchemeSpec4in declaration order

Enums

ToolKind

Value#Meaning
TOOL_KIND_UNSPECIFIED0
TOOL_KIND_ACTION1agent-initiated call into the external app
TOOL_KIND_TRIGGER2app-initiated event delivered to the agent
TOOL_KIND_CODE3agent-initiated call into code this platform runs: a sandboxed module, or a job program a project promoted from one of its own finished jobs (a project skill).

ToolkitConnectability

ToolkitConnectability says what stands between a toolkit and a connected account on this deployment. It is deployment state, not catalog data: the same toolkit definition answers differently on a node whose operator has registered its OAuth app and on a node that has not.

Value#Meaning
TOOLKIT_CONNECTABILITY_UNSPECIFIED0
TOOLKIT_CONNECTABILITY_READY1Every scheme the toolkit declares can be connected here.
TOOLKIT_CONNECTABILITY_NEEDS_OAUTH_REGISTRATION2The toolkit declares only schemes that need an OAuth client id and secret registered on this deployment, and it holds none. Nothing can connect.
TOOLKIT_CONNECTABILITY_OAUTH_PENDING3The toolkit also declares a scheme that needs no operator registration (api_key, basic), so it connects today under that one, while its oauth2 path waits on a registration.