External API Endpoint Reference

Generated from PUBLIC_HARNESS_ENDPOINTS. Do not edit this file directly. Run npm run docs:generate.

These are the stable, customer-facing authorization, Harness MCP, artifact app, and Developer Access endpoints. Internal application routes are intentionally excluded.

Method	Path	Authentication	Scope	Stability	Purpose
GET	/api/docs	public	-	stable	List or search the public documentation catalog with docs contract and build metadata.
GET	/api/docs/index.json	public	-	stable	Read the public-only documentation content bundle used by static renderers and agents.
GET	/api/docs/{id}	public	-	stable	Read one public documentation entry as structured JSON.
GET	/api/docs/{id}.md	public	-	stable	Read one public documentation entry as Markdown.
POST	/api/docs/feedback	public	-	stable	Record a text-free helpful, not-helpful, or outdated signal for a current public document and optional heading.
POST	/api/docs/selection	public	-	stable	Record a privacy-bounded public document selected from search using only the document id and allowlisted product terms.
GET	/docs/openapi.json	public	-	stable	Read the generated OpenAPI 3.1 description of supported public endpoints.
GET	/.well-known/oauth-protected-resource/mcp/build	public	-	stable	OAuth protected-resource metadata for Topline Build MCP clients.
GET	/.well-known/oauth-protected-resource/mcp/workspace	public	-	stable	OAuth protected-resource metadata for Topline Workspace MCP clients.
GET	/.well-known/oauth-protected-resource/mcp/harness	public	-	stable	OAuth protected-resource metadata for Harness MCP clients.
GET	/.well-known/oauth-protected-resource	public	-	stable	Compatibility alias for Harness OAuth protected-resource metadata.
GET	/.well-known/oauth-authorization-server	public	-	stable	OAuth authorization-server metadata and supported scopes.
GET	/.well-known/openid-configuration	public	-	stable	Compatibility alias for Harness OAuth authorization-server metadata.
POST	/oauth/register	public	-	stable	Register a public OAuth client and approved redirect URIs.
GET	/oauth/authorize	browser_session	-	stable	Authorize an MCP client with PKCE and explicit scopes.
POST	/oauth/token	public	-	stable	Exchange an authorization code or refresh token for an access token.
POST	/oauth/revoke	public	-	stable	Revoke the OAuth access or refresh token supplied in the request body.
GET	/mcp/build	public	-	stable	Return the Topline Build MCP identity and artifact tool inventory.
POST	/mcp/build	connector_or_oauth_bearer	-	stable	Invoke the Topline Build MCP streamable HTTP endpoint.
GET	/mcp/workspace	public	-	stable	Return the Topline Workspace MCP identity and workspace tool inventory.
POST	/mcp/workspace	connector_or_oauth_bearer	-	stable	Invoke the Topline Workspace MCP streamable HTTP endpoint.
GET	/mcp/harness	public	-	stable	Return Harness MCP server identity and the unfiltered tool-name inventory.
POST	/mcp/harness	connector_or_oauth_bearer	-	stable	Invoke the streamable HTTP Harness MCP JSON-RPC endpoint.
POST	/api/harness/artifact-apps	connector_or_oauth_bearer	harness:artifact:write	stable	Create or update a private artifact-app draft.
POST	/api/harness/artifact-apps/{artifactId}/deploy-bundle	connector_or_oauth_bearer	harness:artifact:deploy	stable	Upload and deploy a validated artifact-app tar.gz bundle.
GET	/api/harness/artifact-apps/{artifactId}/deployments	connector_or_oauth_bearer	harness:artifact:read	stable	List recent draft deployment state and readiness.
GET	/api/harness/artifact-apps/{artifactId}/logs	connector_or_oauth_bearer	harness:artifact:read	stable	Read bounded and redacted artifact deployment logs.
GET	/api/harness-connectors	browser_session	-	stable	Read Developer Access configuration and the current operator's connector tokens.
POST	/api/harness-connectors/products/{product}/verifications	browser_session	-	stable	Create a short-lived, product-bound MCP connection verification challenge.
GET	/api/harness-connectors/products/{product}/verifications/{verificationId}	browser_session	-	stable	Read the owner-scoped result of an MCP connection verification challenge.
POST	/api/harness-connectors/oauth-authorizations/{authorizationId}/revoke	browser_session	-	stable	Revoke one active OAuth authorization owned by the current operator.
POST	/api/harness-connectors/bedrock-token	browser_session	-	stable	Generate a one-hour Bedrock key from the customer-account runtime role.
POST	/api/harness-connectors/tokens	browser_session	-	stable	Create a manual fallback connector token.
POST	/api/harness-connectors/tokens/{tokenId}/revoke	browser_session	-	stable	Revoke one connector token owned by the current operator.