{"openapi":"3.1.0","info":{"title":"Note API","version":"1.0.0","description":"Ways to connect:\n\n- **SSH key signature**: Prove you hold an SSH key by signing a challenge with ssh-keygen.\n- **Access request**: Request access to a user's workspace by username; they approve with one click and a passkey.\n- **Join on the website (email code)**: Join the workspace on the website with an email address and the code we send.\n- **MCP with OAuth (dynamic client registration)**: Register an OAuth client on the fly (RFC 7591), then connect to your user's workspace with the authorization code flow.\n- **Agent key: sign every request**: Skip access tokens: sign each request with your registered key using HTTP Message Signatures (RFC 9421).\n- **OAuth client credentials**: Register your own OAuth client with no user involved and use the client_credentials grant.\n- **Agent account with an API key**: Create your own agent account and get an API key immediately.\n- **Sign in on the website (passkey)**: Join or sign in on the website with a passkey.\n- **Token exchange (acting on behalf of your user)**: Combine your own agent identity with an access token your user delegated to you (RFC 8693).\n- **Agent key: sign a challenge**: Register a public key, from a local file, a KMS, an HSM or a wallet, and sign a challenge to get an access token.\n- **Sign-In With Ethereum**: Sign an EIP-4361 message with your Ethereum key.\n- **Device code**: No browser on your side? Show your user a short code to approve (RFC 8628).\n- **MCP without OAuth (approval link)**: Connect to the open MCP endpoint; when you ask for the pinned note, Note sends your user an approval link (URL-mode elicitation).\n- **Workload identity (cloud identity token)**: Running on GitHub Actions, Google Cloud, Azure, AWS or SPIFFE? Exchange your platform's signed identity token for an access token. No key to register.\n- **Client certificate (mTLS)**: Use a self-signed TLS client certificate (RFC 8705).\n- **Agent key: signed JWT assertion**: Present a JWT signed by your registered key at the token endpoint (RFC 7523).\n- **Backchannel approval (OpenID CIBA)**: Ask Note to request approval from a user by username; they approve on their account page.\n- **Web Bot Auth**: Agents whose operator signs requests and publishes a key directory are recognised automatically.\n- **MCP with OAuth (client ID metadata document)**: Connect an MCP client to your user's workspace. The client identifies itself with an HTTPS client ID metadata document.\n- **HTTP Basic**: Send an API key or OAuth client ID and client secret with HTTP Basic.\n- **API key from your user**: Your user creates an API key in their workspace settings and gives it to you.\n- **OAuth with a client your user gives you**: If your user gave you a Note client ID (and client secret), use it with the authorization code flow.\n\nFull guide: https://radiant-gallery.note.page/developers"},"servers":[{"url":"https://api.radiant-gallery.note.page"}],"security":[{"bearer":[]},{"apiKey":[]},{"basic":[]},{"oauth2":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Access token or API key"},"apiKey":{"type":"apiKey","in":"header","name":"X-API-Key"},"basic":{"type":"http","scheme":"basic"},"oauth2":{"type":"oauth2","flows":{"authorizationCode":{"authorizationUrl":"https://api.radiant-gallery.note.page/oauth/authorize","tokenUrl":"https://api.radiant-gallery.note.page/oauth/token","scopes":{"notes:read":"Read notes","feedback:write":"Send feedback"}},"clientCredentials":{"tokenUrl":"https://api.radiant-gallery.note.page/oauth/token","scopes":{"notes:read":"Read notes"}}}}}},"paths":{"/v1/notes":{"get":{"summary":"List the workspace's notes","responses":{"200":{"description":"Notes","content":{"application/json":{"schema":{"type":"object","properties":{"notes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"body":{"type":"string"},"pinned":{"type":"boolean"},"updated_at":{"type":"string"}}}}}}}}},"401":{"description":"Not signed in"}}}},"/v1/notes/pinned":{"get":{"summary":"Read the pinned note","responses":{"200":{"description":"The pinned note","content":{"application/json":{"schema":{"type":"object","properties":{"note":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"body":{"type":"string"},"pinned":{"type":"boolean"},"updated_at":{"type":"string"}}}}}}}}}}},"/v1/notes/{id}":{"get":{"summary":"Read one note","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The note"}}}},"/v1/me":{"get":{"summary":"Describe the signed-in account","responses":{"200":{"description":"Account"}}}},"/v1/feedback":{"post":{"summary":"Tell us how connecting went","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"methods_seen":{"type":"array","items":{"type":"string"}},"method_chosen":{"type":"string"},"why":{"type":"string"},"difficulty":{"type":"integer","minimum":1,"maximum":5},"would_prefer":{"type":"string"},"comments":{"type":"string"}}}}}},"responses":{"200":{"description":"Thanks"}}}},"/v1/agents":{"post":{"summary":"Create an agent account and API key","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"}}}}}},"responses":{"201":{"description":"API key"}}}},"/v1/agents/keys":{"post":{"summary":"Register an agent public key","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"public_key":{"description":"JWK or JWKS, PEM, base64 DER SPKI, OpenSSH line, or a raw Ed25519 / secp256k1 key (base64, hex or base58)"},"jwks_uri":{"type":"string","format":"uri","description":"Instead of public_key: your JWKS URL, for keys that rotate (KMS)"},"kid":{"type":"string"},"name":{"type":"string"}}}}}},"responses":{"201":{"description":"agent_id"}}}},"/v1/auth/challenge":{"post":{"summary":"Get a challenge to sign","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"agent_id":{"type":"string"}}}}}},"responses":{"200":{"description":"Challenge"}}}},"/v1/auth/verify":{"post":{"summary":"Exchange a signed challenge for an access token","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"challenge_id":{"type":"string"},"signature":{"type":"string","description":"base64url, base64, hex or base58; ECDSA as r||s or DER"},"kid":{"type":"string"},"alg":{"type":"string","enum":["EdDSA","ES256","ES384","ES512","ES256K","RS256","RS384","RS512","PS256","PS384","PS512"]}}}}}},"responses":{"200":{"description":"Access token"}}}},"/oauth/token":{"post":{"summary":"Token endpoint: OAuth grants, signed JWT assertions, and cloud workload identity tokens","security":[],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"grant_type":{"type":"string","enum":["authorization_code","urn:ietf:params:oauth:grant-type:device_code","urn:openid:params:grant-type:ciba","refresh_token","client_credentials","urn:ietf:params:oauth:grant-type:jwt-bearer","urn:ietf:params:oauth:grant-type:token-exchange"]},"assertion":{"type":"string"},"subject_token":{"type":"string"},"subject_token_type":{"type":"string"},"client_assertion_type":{"type":"string"},"client_assertion":{"type":"string"}},"required":["grant_type"]}}}},"responses":{"200":{"description":"Access token"}}}},"/v1/auth/ssh/challenge":{"post":{"summary":"Get an SSH signing challenge","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"public_key":{"type":"string"}}}}}},"responses":{"200":{"description":"Challenge"}}}},"/v1/auth/ssh/verify":{"post":{"summary":"Exchange an ssh-keygen -Y signature for an access token","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"challenge_id":{"type":"string"},"signature":{"type":"string"}}}}}},"responses":{"200":{"description":"Access token"}}}},"/v1/auth/siwe/nonce":{"get":{"summary":"Get a SIWE nonce","security":[],"responses":{"200":{"description":"Nonce"}}}},"/v1/auth/siwe/verify":{"post":{"summary":"Verify a SIWE message","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"signature":{"type":"string"}}}}}},"responses":{"200":{"description":"Access token"}}}},"/v1/access-requests":{"post":{"summary":"Ask a user for access to their workspace","security":[],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username"],"properties":{"username":{"type":"string"},"agent_name":{"type":"string"},"reason":{"type":"string"}}}}}},"responses":{"202":{"description":"Pending request"}}}},"/v1/access-requests/{id}":{"get":{"summary":"Poll an access request","security":[],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Status"}}}}}}