MudraID — a trust layer for AI agents

This reference covers the public contracts: the endpoints the Python SDK, the platform middleware and the enforcement adapters depend on, and the ones you may call directly. They don’t change without a deprecation window. The endpoint pages under “Public Contracts” are generated from openapi.yaml.

What’s in the public contract

Endpoint	Used by
`POST /oauth2/token`	SDK / any OAuth client — exchange machine-client credentials for an access token
`POST /oauth2/revoke`	OAuth clients — RFC 7009 revocation (refresh tokens)
`GET /.well-known/oauth-authorization-server`	OAuth clients — RFC 8414 discovery: issuer, token endpoint, supported methods
`GET /.well-known/jwks.json`	Middleware / resource servers — public keys for verifying access tokens
`GET /api/v1/platforms/{platform_id}/scopes.yaml`	Platform operators — download the route → scope file
`POST /api/v1/adapter/enforcement/decide`	Enforcement adapters — a live, deny-closed decision for one protected action

The access-token claim shape and the mudraid_scopes.yaml schema are part of the contract too. Agent identities, OAuth clients, client keys and resource grants are managed in the MudraID portal (and its management API). Those endpoints are not part of this reference.

Retired endpoints

Native agent credentials (an api_key_id + secret pair) are retired. POST /api/v1/auth/token, POST /api/v1/auth/agents/me/platforms, POST /api/v1/agents/register and the agent rotate-secret routes return 410 Gone with code: agent_native_credentials_retired. See Versioning and deprecation.

Server

Production: https://api.mudraid.ai

Use the issuer and token endpoint your environment’s authorization-server metadata advertises rather than hardcoding them.