Identity is not authority
OAuth identifies a CROWN Auth subject. Kernel resolves an active Actor and evaluates permissions for every Account or Engagement.
Developer center · v1 preview
Build on meaning,
not database shape.
The Agency Operations API exposes a deliberately small read-only contract for client relationships, authorized work, and current responsibility. It keeps Kernel permissions and domain rules at the boundary.
One canonical contract
OpenAPI describes the sanctioned wire surface. Internal routes, provider payloads, and prototype tools are deliberately excluded.
Hierarchy stays visible
Client Accounts contain Engagements; Engagements contain Projects; Projects contain Tasks. APIs do not flatten those distinctions for convenience.
Ten-minute path
Make one useful request.
- Register an OAuth client with CROWN Auth.
- Have its client ID approved for Kernel API access.
- Complete authorization code with PKCE for a user.
- Call
GET /api/v1/me. - Discover clients and ask Kernel for effective permissions.