How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Agntcy

AGNTCY Identity Service API

Manages identity and access control in the AGNTCY ecosystem: register agents, MCP servers and tools as apps (including directly from an OASF record), issue and verify W3C Verifiable Credential badges, manage policies and rules, register approval devices, and run the OIDC authorize/token and external-authorization flows. OpenAPI 3.0.3, 36 operations, with bearer-JWT and x-id-api-key security schemes.

Documentation Provider Profile APIs.io OpenAPI GitHub

This API exposes 36 operations across 25 paths, organized into 6 resource areas, and defines 53 schemas. It is described by OpenAPI 3.0.3, at version v1alpha1.

Requests are made against a single base URL, http://localhost:4000.

36 operations 25 paths 53 schemas 4 DELETE14 GET3 PATCH15 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.3
API Version
v1alpha1
Server
http://localhost:4000
Authentication
HTTP Bearer, API Key
Contact
Agntcy Team
Resource Areas
6

Authentication & Security 2

AGNTCY Identity Service API declares 2 security schemes for authenticating requests. It accepts HTTP bearer tokens (JWT) (AccessToken). An API key is passed in the header as x-id-api-key (ApiKey). By default, every request must be authenticated.

  • AccessToken — An IAM JWT token issued to a user during an OIDC flow.
  • ApiKey — An IAM Api key.

Paths & Operations 36

Across 25 paths, the API surfaces 36 operations — 4 DELETE, 14 GET, 3 PATCH, 15 POST. They span 6 resource areas: AppService, BadgeService, AuthService, DeviceService, PolicyService, SettingsService. Each is listed below with its method, path, parameters, and response codes.

AppService 10

AppService manages apps.

GET
/v1alpha1/apps
List Apps.
AppService_ListApps 6 params → 200default
POST
/v1alpha1/apps
Create a new App.
AppService_CreateApp body → 200default
GET
/v1alpha1/apps/all/count
Get apps count per type.
AppService_GetAppsCount → 200default
POST
/v1alpha1/apps/oasf
AppService_CreateOasfApp body → 200default
GET
/v1alpha1/apps/{appId}
Get App by id
AppService_GetApp 1 param → 200default
DELETE
/v1alpha1/apps/{appId}
Delete an existing App.
AppService_DeleteApp 1 param → 200default
PATCH
/v1alpha1/apps/{appId}
Update an App.
AppService_UpdateApp 1 param body → 200default
GET
/v1alpha1/apps/{appId}/api-key/refresh
Refresh the api-key for an App.
AppService_RefreshAppApiKey 1 param → 200default
GET
/v1alpha1/apps/{appId}/badge
Get the current badge issued for the App.
AppService_GetBadge 1 param → 200default
GET
/v1alpha1/tasks
Get the list of tasks of all apps
AppService_GetTasks 1 param → 200default
BadgeService 2

BadgeService manages badges.

POST
/v1alpha1/apps/{appId}/badges
Create a new Badge.
BadgeService_IssueBadge 1 param body → 200default
POST
/v1alpha1/badges/verify
Verify a badge.
BadgeService_VerifyBadge body → 200default
AuthService 5

AuthService manages auth.

GET
/v1alpha1/auth/app_info
App info endpoint
AuthService_AppInfo → 200default
POST
/v1alpha1/auth/approve_token
Handle manual approval of external authorization requets
AuthService_ApproveToken body → 200default
POST
/v1alpha1/auth/authorize
Authorize a request from an Agent or MCP Server
AuthService_Authorize body → 200default
POST
/v1alpha1/auth/ext_authz
Handle external authorization requests
AuthService_ExtAuthz body → 200default
POST
/v1alpha1/auth/token
Request token for an Agent or MCP Server
AuthService_Token body → 200default
DeviceService 5

DeviceService manages device.

GET
/v1alpha1/device
List all registered devices
DeviceService_ListDevices 3 params → 200default
POST
/v1alpha1/device
Add new device for approval flow
DeviceService_AddDevice body → 200default
POST
/v1alpha1/device/{deviceId}
Add new device for approval flow
DeviceService_RegisterDevice 1 param body → 200default
DELETE
/v1alpha1/device/{deviceId}
Delete a registered Device.
DeviceService_DeleteDevice 1 param → 200default
POST
/v1alpha1/device/{deviceId}/test
Send a test notification to a registered device to see if it's well configured.
DeviceService_TestDevice 1 param → 200default
PolicyService 11

PolicyService manages policy.

GET
/v1alpha1/policies
List Policies.
PolicyService_ListPolicies 5 params → 200default
POST
/v1alpha1/policies
Create a new Policy.
PolicyService_CreatePolicy body → 200default
GET
/v1alpha1/policies/all/count
Get policies total count.
PolicyService_GetPoliciesCount → 200default
GET
/v1alpha1/policies/{policyId}
Get Policy by id
PolicyService_GetPolicy 1 param → 200default
DELETE
/v1alpha1/policies/{policyId}
Delete an existing Policy.
PolicyService_DeletePolicy 1 param → 200default
PATCH
/v1alpha1/policies/{policyId}
Update a Policy.
PolicyService_UpdatePolicy 1 param body → 200default
GET
/v1alpha1/policies/{policyId}/rules
List Rules.
PolicyService_ListRules 4 params → 200default
POST
/v1alpha1/policies/{policyId}/rules
Create a new Rule.
PolicyService_CreateRule 1 param body → 200default
GET
/v1alpha1/policies/{policyId}/rules/{ruleId}
Get Rule by id
PolicyService_GetRule 2 params → 200default
DELETE
/v1alpha1/policies/{policyId}/rules/{ruleId}
Delete an existing Rule.
PolicyService_DeleteRule 2 params → 200default
PATCH
/v1alpha1/policies/{policyId}/rules/{ruleId}
Update a Rule.
PolicyService_UpdateRule 2 params body → 200default
SettingsService 3

SettingsService manages settings.

GET
/v1alpha1/settings
Get Settings
SettingsService_GetSettings → 200default
POST
/v1alpha1/settings/api-key
Set up API Key
SettingsService_SetApiKey → 200default
POST
/v1alpha1/settings/issuer
Set up Issuer
SettingsService_SetIssuer body → 200default

Schemas 53

The contract defines 53 schemas that model the data the API accepts and returns. The most detailed are IssuerSettings (10 properties), VerifiableCredential (10 properties), Rule (8 properties), App (8 properties). Each schema is shown below with its type and property counts.

ApiKey
object
An Identity API Key.
1 property
App
object
Identity Service App.
8 properties 2 required
AppInfoResponse
object
1 property
AppTypeCountEntry
object
2 properties
ApproveTokenRequest
object
4 properties
AuthorizeRequest
object
3 properties
AuthorizeResponse
object
1 property
Badge
object
2 properties
BadgeClaims
object
BadgeClaims represents the content of a Badge VC defined [here] [here]: https://spec.identity.agntcy.org/docs/vc/intro/
2 properties
CreateOasfAppRequest
object
1 property
CreateOasfAppResponse
object
2 properties
CreatePolicyRequest
object
3 properties
CreateRuleRequest
object
6 properties
CredentialSchema
object
CredentialSchema represents the credentialSchema property of a Verifiable Credential. more information can be found [here] [here]: https://www.w3.org/TR/vc-dat…
2 properties
CredentialStatus
object
CredentialStatus represents the credentialStatus property of a Verifiable Credential. more information can be found [here] [here]: https://www.w3.org/TR/vc-dat…
4 properties
Device
object
Devices used for user approval
5 properties
DuoIdpSettings
object
Duo IdP Settings
3 properties
EntraIdpSettings
object
Entra ID (Azure AD) IdP Settings
3 properties
ErrorInfo
object
2 properties
ExtAuthzRequest
object
2 properties
GetAppsCountResponse
object
2 properties
GetPoliciesCountResponse
object
1 property
GetTasksResponse
object
1 property
GetTasksResponse_TaskList
object
1 property
GoogleProtobufAny
object
Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
1 property
IssueA2ABadgeRequest
object
2 properties
IssueBadgeRequest
object
4 properties
IssueMcpBadgeRequest
object
3 properties
IssueOASFBadgeRequest
object
1 property
IssuerSettings
object
Issuer Settings
10 properties 1 required
KeycloakIdpSettings
object
Keycloak IdP Settings
4 properties
ListAppsResponse
object
2 properties
ListDevicesResponse
object
2 properties
ListPoliciesResponse
object
2 properties
ListRulesResponse
object
2 properties
OktaIdpSettings
object
Okta IdP Settings
3 properties
OryIdpSettings
object
Ory IdP Settings
2 properties
PagedResponse
object
Pagination response
4 properties
PingIdpSettings
object
Ping IdP Settings
4 properties
Policy
object
Identity Service Policy.
6 properties 3 required
Proof
object
A data integrity proof provides information about the proof mechanism, parameters required to verify that proof, and the proof value itself.
3 properties
Rule
object
Identity Service Policy Rule
8 properties 4 required
SetIssuerRequest
object
1 property 1 required
Settings
object
Identity Settings
2 properties
Status
object
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](h…
3 properties
Task
object
Identity Service Policy Task
5 properties
TokenRequest
object
1 property
TokenResponse
object
1 property
UpdatePolicyRequest
object
4 properties
UpdateRuleRequest
object
7 properties
VerifiableCredential
object
DataModel represents the W3C Verifiable Credential Data Model defined [here] [here]: https://www.w3.org/TR/vc-data-model/
10 properties
VerificationResult
object
The result returned from the verification process defined [here] [here]: https://www.w3.org/TR/vc-data-model-2.0/verification
7 properties
VerifyBadgeRequest
object
1 property

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

agntcy-identity-service-openapi.yaml Raw ↑
#Identity#Verifiable Credentials#Authorization#AI Agents
← Back to A APIs
API Details
ID
agntcy:agntcy-identity-service-api
Server
http://localhost:4000
Docs
https://identity-docs.outshift.com/openapi/service/v1alpha1
Provider
Agntcy
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=agntcy-agntcy-identity-service-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/agntcy-agntcy-identity-service-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of AGNTCY Identity Service API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.