# INSIDE Gateway business API

> Application REST, Business MCP and A2A tasks for confidential custom installations, with explicit site grants and current data permissions.

Source capabilities only; no inventory or grant. Matching native bundles and loaded-site readiness need separate verification.

Use an expiring least-privilege installation credential. Every call rechecks current installation, credential, organization, website and data policy. Customer agents, general reports and agent reasoning remain unavailable.

## Machine-readable entry points

- [Application OpenAPI](https://api.inside.chat/api/v1/openapi.json): Current installation REST paths, parameters, scopes and data flags.

- [OAuth authorization server metadata](https://api.inside.chat/.well-known/oauth-authorization-server): Confidential client exchange and revocation; supported scopes.

- [MCP protected resource metadata](https://api.inside.chat/.well-known/oauth-protected-resource/mcp): Exact MCP audience and authorization server.

- [REST protected resource metadata](https://api.inside.chat/.well-known/oauth-protected-resource): Exact REST audience and supported scopes.

- [A2A agent card](https://api.inside.chat/.well-known/agent-card.json): Structured scoped report, evidence, configuration and offline language tasks.

- [A2A protected resource metadata](https://api.inside.chat/.well-known/oauth-protected-resource/a2a): Exact business task audience.

- [Full business API guidance](https://api.inside.chat/llms-full.txt): Transport, supported operations, reporting, resources, prompts and write recovery.