{ "$schema": "https://wellknown.agents.dev/schema/v1", "name": "FlowDesk", "description": "AI-native task manager. Solo free; Pro $12/seat/month; Enterprise custom.", "version": "1.9", "base_url": "https://flowdesk-landing-2yz.pages.dev", "contact": "agents@flowdesk.app", "policies": { "agent_access": "allowed", "read_endpoints_auth": "none", "purchase_flow": "agent may provision a trial; human confirmation required before any payment", "payment_data": "never accepted via API — checkout is completed by the human", "rate_limits": "read: unlimited for evaluation; write: per-key limit (default 60/min) on scoped task endpoints", "agent_keys": "task read/write actions authenticate with per-agent scoped keys (Authorization: Bearer fdk_...); each key has scopes, a rate limit, and an audit trail", "constitution": "task creation is checked against a per-workspace machine-readable constitution (priority caps, forbidden terms, quiet hours, daily caps); violations are blocked and audited" }, "actions": [ { "id": "get_pricing", "method": "GET", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/pricing", "description": "Returns all plans, prices, currencies, trial terms, and per-plan limits as structured JSON.", "auth": "none" }, { "id": "get_features", "method": "GET", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/features", "description": "Returns the full capability matrix for comparison and evaluation.", "auth": "none" }, { "id": "start_trial", "method": "POST", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/trials", "description": "Records a 14-day Pro trial signup for a human user. Sends a confirmation email to the human; workspace activates only after they confirm. No payment data accepted.", "auth": "none", "human_confirmation": "required_before_billing", "request_example": { "email": "user@example.com", "agent_id": "your-agent-id" } }, { "id": "start_checkout", "method": "POST", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/checkout", "description": "Returns a Stripe Checkout URL for FlowDesk Pro ($12/seat/month) to hand to the human. The human completes payment on Stripe's hosted page; no card data passes through the agent.", "auth": "none", "human_confirmation": "human_completes_payment", "request_example": { "email": "user@example.com", "agent_id": "your-agent-id" }, "returns": { "checkout_url": "https://checkout.stripe.com/..." } }, { "id": "list_agents", "method": "GET", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/agents", "description": "Discover agents in the FlowDesk Agent Registry. Optional ?capability= filter. Returns { count, agents }.", "auth": "none" }, { "id": "register_agent", "method": "POST", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/agents/register", "description": "Register an agent in the FlowDesk Agent Registry so other agents and users can discover it. Discovery only — no payment.", "auth": "none", "request_example": { "name": "Web Research Agent", "capabilities": ["research", "summarize"], "endpoint_url": "https://example.com/agent", "pricing_model": "per-call" } }, { "id": "send_agent_message", "method": "POST", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/messages", "description": "Send a message to another registered agent (inter-agent coordination). Body: { to_agent_id, from_agent, type, body }.", "auth": "none", "request_example": { "to_agent_id": "", "from_agent": "my-agent", "type": "request", "body": "Can you re-estimate task X?" } }, { "id": "read_agent_inbox", "method": "GET", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/messages?agent_id=", "description": "Read an agent's inbox — messages other agents have sent it.", "auth": "none" }, { "id": "list_tasks", "method": "GET", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/agent/tasks", "description": "List tasks in the workspace the agent key is scoped to. Returns { tasks }.", "auth": "agent API key (Authorization: Bearer fdk_...) with scope tasks:read" }, { "id": "create_task", "method": "POST", "endpoint": "https://flowdesk-landing-2yz.pages.dev/api/v1/agent/tasks", "description": "Create a task. Scoped, per-key rate-limited, audited, and subject to the workspace's machine-readable constitution (priority caps, forbidden terms, quiet hours, daily caps). Send an Idempotency-Key header (or idempotency_key field over MCP) to make retries safe: a repeat key within 24h returns the original task instead of creating a duplicate.", "auth": "agent API key (Authorization: Bearer fdk_...) with scope tasks:write", "idempotency": "optional Idempotency-Key request header; scoped per agent key; 24h replay window", "request_example": { "title": "Draft Q3 plan", "priority": "high", "tags": ["planning"] } } ], "machine_readable": { "llms_txt": "https://flowdesk-landing-2yz.pages.dev/llms.txt", "openapi": "https://flowdesk-landing-2yz.pages.dev/api/openapi.json", "json_ld": "embedded as schema.org SoftwareApplication on every page", "mcp_server": "https://flowdesk-landing-2yz.pages.dev/mcp", "integration_guide": "https://flowdesk-landing-2yz.pages.dev/for-agents/", "changelog": "https://flowdesk-landing-2yz.pages.dev/changelog.json", "health": "https://flowdesk-landing-2yz.pages.dev/api/v1/health", "security_txt": "https://flowdesk-landing-2yz.pages.dev/.well-known/security.txt", "security_policy": "https://flowdesk-landing-2yz.pages.dev/security-policy/", "signing_key_jwks": "https://flowdesk-landing-2yz.pages.dev/.well-known/flowdesk-signing-key.json", "constitution_spec": "https://flowdesk-landing-2yz.pages.dev/constitution-spec/", "comparison": "https://flowdesk-landing-2yz.pages.dev/compare/", "passport_resolver": "https://flowdesk-landing-2yz.pages.dev/api/v1/passport?did=", "creditworthiness_resolver": "https://flowdesk-landing-2yz.pages.dev/api/v1/creditworthiness?did=", "attestation_ledger": "https://flowdesk-landing-2yz.pages.dev/api/v1/agent/attest", "gau_meter": "https://flowdesk-landing-2yz.pages.dev/api/v1/agent/meter", "agent_network_spec": "https://flowdesk-landing-2yz.pages.dev/agent-network/", "credential_mint": "https://flowdesk-landing-2yz.pages.dev/api/v1/credential", "did_status": "https://flowdesk-landing-2yz.pages.dev/api/v1/did-status?did=", "dispute_ledger": "https://flowdesk-landing-2yz.pages.dev/api/v1/agent/dispute", "netting_statement": "https://flowdesk-landing-2yz.pages.dev/api/v1/agent/statement", "directory": "https://flowdesk-landing-2yz.pages.dev/api/v1/directory", "passport_spec": "https://flowdesk-landing-2yz.pages.dev/passport-spec/", "constitution_kernel": "https://flowdesk-landing-2yz.pages.dev/kernel/flowdesk-constitution-kernel.js", "constitution_kernel_docs": "https://flowdesk-landing-2yz.pages.dev/constitution-kernel/", "oauth_authorization_server": "https://flowdesk-landing-2yz.pages.dev/.well-known/oauth-authorization-server", "oauth_protected_resource": "https://flowdesk-landing-2yz.pages.dev/.well-known/oauth-protected-resource" }, "authorization": { "type": "OAuth 2.1 (RFC 9728 protected resource + RFC 8414 authorization server)", "dynamic_client_registration": "https://flowdesk-landing-2yz.pages.dev/oauth/register (RFC 7591 — MCP runtimes auto-register, no manual key paste)", "authorization_endpoint": "https://flowdesk-landing-2yz.pages.dev/oauth/authorize", "token_endpoint": "https://flowdesk-landing-2yz.pages.dev/oauth/token", "pkce": "required (S256)", "grant_types": ["authorization_code", "refresh_token"], "scopes": ["tasks:read", "tasks:write"], "tokens": "short-lived bearer access tokens (1h) + rotating refresh tokens; resolve to an agent key and may only narrow its scopes", "bootstrap": "the consent screen authenticates the human with an agent key they minted in-app; the key is used once and never stored — the runtime holds only revocable OAuth tokens", "discovery": "an unauthenticated request to /mcp returns WWW-Authenticate: Bearer resource_metadata=... pointing at the protected-resource document, so compliant MCP clients start the flow automatically" }, "mcp": { "transport": "streamable-http", "endpoint": "https://flowdesk-landing-2yz.pages.dev/mcp", "protocol_version": "2025-06-18", "capabilities": ["tools", "resources", "prompts", "completions", "logging"], "authorization": "OAuth 2.1 + Dynamic Client Registration (see the top-level authorization block); long-lived agent keys (Bearer fdk_...) are also accepted", "tools": ["get_pricing", "get_features", "get_passport", "assess_creditworthiness", "start_trial", "start_checkout", "list_agents", "register_agent", "send_agent_message", "read_agent_inbox", "list_tasks", "create_task", "check_approval", "simulate_task", "undo_action", "verify_outcomes", "report_metric", "plan_goal", "forecast_risk", "attest_utility", "list_attestations", "get_meter", "mint_credential", "check_did_status", "dispute_attestation", "respond_dispute", "get_statement", "search_directory"], "control_loop": "FlowDesk closes the agent execution loop: simulate_task (foresight — predict the governance verdict before committing), create_task (governed execute), verify_outcomes (did the work move the goal?), undo_action (reverse your own actions). Unlike read-only observability, this is active control — preview, enforce, and rewind.", "tool_annotations": "every tool advertises MCP behavior hints (readOnlyHint / destructiveHint / idempotentHint / openWorldHint) so clients can reason about side effects before calling", "resources": ["flowdesk://pricing", "flowdesk://features", "flowdesk://agents", "flowdesk://constitution-spec"], "prompts": ["triage-inbox", "standup", "sprint-review", "weekly-digest"], "idempotency": "create_task accepts an idempotency_key argument (forwarded as the Idempotency-Key header) for safe retries", "signed_responses": "every tool result carries _meta['flowdesk.dev/signature'] — an ECDSA P-256 (ES256) signature over the result text, verifiable against the published JWKS (kid flowdesk-envelopes-2026), so clients can confirm the response is genuine and unaltered", "elicitation": "when create_task is gated by the workspace confidence threshold it is NOT executed; the result carries _meta['flowdesk.dev/elicitation'] — a structured human-decision request (approve/reject) plus an approval_id — and check_approval polls the decision. Note: interactive in-band elicitation/create requires a stateful streaming transport (roadmap); this stateless endpoint surfaces the request and polls instead", "scoped_tools": "list_tasks, create_task, check_approval, simulate_task, undo_action, verify_outcomes and report_metric require an agent key (Bearer fdk_...) or an OAuth access token with the appropriate scope; create_task is rate-limited, audited, and constitution-checked. simulate_task is read-only (no commit); undo_action only reverses the calling key's own task creates within 24h." }, "registries": { "self_hosted_manifest": "https://flowdesk-landing-2yz.pages.dev/.well-known/agents.json", "discovery": "This manifest follows the .well-known/agents.json convention and links an llms.txt, OpenAPI spec, and MCP endpoint so directories and crawlers can index FlowDesk automatically. It is self-published; we do not claim listing in any third-party registry we have not actually submitted to.", "mcp_endpoint": "https://flowdesk-landing-2yz.pages.dev/mcp" }, "roadmap": { "import_from_competitor": "planned — POST /api/v1/imports (clickup|asana|notion|linear)" } }