# OrcheSphere API > Public REST and MCP documentation. OAuth scopes remain bounded by the consenting user's current company, portal and service permissions. REST resource: https://api.orchesphere.ai OAuth issuer: https://orchesphere.ai MCP resource: https://orchesphere.ai/mcp ## Machine-readable contracts - [OpenAPI](https://api.orchesphere.ai/openapi.json) - [Reference](https://api.orchesphere.ai/reference.json) ## Documentation - [Build with OrcheSphere](https://api.orchesphere.ai/): Connect your applications to assigned companies, tasks, connections and verification jobs. - [Make your first request](https://api.orchesphere.ai/quickstart): Register an app, complete PKCE authorization and read your assigned companies. - [OAuth authentication](https://api.orchesphere.ai/authentication): Authorization code, PKCE, scopes, exact resource binding, refresh and revocation. - [Scopes and company permissions](https://api.orchesphere.ai/scopes): OAuth scopes set a ceiling; current identity and company, portal and service grants decide access. - [Verification jobs and safe retries](https://api.orchesphere.ai/guides/jobs): Queue an authorized identity check, follow its saved job and retry without duplicating the request. - [Errors, limits and recovery](https://api.orchesphere.ai/errors): Understand protocol errors, bounded lists and request sizes without hiding missing coverage. - [Client examples](https://api.orchesphere.ai/examples): Runnable PKCE and read-only client examples for JavaScript, Python and curl. - [API changelog](https://api.orchesphere.ai/changelog): Versioned changes to the OrcheSphere public developer contract. - [REST API reference](https://api.orchesphere.ai/reference/rest): Every supported REST operation, with schemas and current permission requirements. - [List assigned workspaces](https://api.orchesphere.ai/reference/rest/listWorkspaces): Current active company assignments; verified global authority may see all company workspaces. - [List connection evidence](https://api.orchesphere.ai/reference/rest/listConnections): Provider read permission in the selected workspace/environment. Configured is not proof of live access; managed_admin entries are read-only external projections. - [List assigned portals](https://api.orchesphere.ai/reference/rest/listPortals): Current company membership and a parent portal assignment, or company-owner authority. - [List accessible tasks](https://api.orchesphere.ai/reference/rest/listTasks): Current company/portal access and a task assignment/role. This lists saved requested work, not provider execution. - [List saved verification jobs](https://api.orchesphere.ai/reference/rest/listJobs): Provider read permission plus requester identity or jobs_read_all. Latest 100 matching saved jobs, newest first. - [Get a saved job](https://api.orchesphere.ai/reference/rest/getJob): Provider read permission plus requester identity or jobs_read_all. Missing and inaccessible jobs both return 404. - [Create a task](https://api.orchesphere.ai/reference/rest/createTask): Portal admin/operator. Explicit assigneeEmail additionally requires the designated access administrator and an eligible active portal member. Saves requested work; no external execution. - [Update a task](https://api.orchesphere.ai/reference/rest/updateTask): Task admin/contributor/reviewer. Reviewer can update status only. Reassignment is not exposed. Parent portal and company rights still apply. - [Queue an identity verification](https://api.orchesphere.ai/reference/rest/verifyConnection): Provider verify permission, implemented identity adapter and current entitlement/quota. Requires Idempotency-Key; replay with the same workspace/requester/key and connection returns the existing job, possibly already terminal. A different connection conflicts. - [Cancel a saved job](https://api.orchesphere.ai/reference/rest/cancelJob): Company owner, or non-viewer requester with provider read, or provider jobs_cancel_all. Applies to queued/retry_wait/running/blocked states; terminal jobs remain unchanged. - [Configure a connection](https://api.orchesphere.ai/reference/rest/configureConnection): Provider configure permission; browser_session also requires company owner. Allowed mode depends on catalog provider. Production entitlements/limits apply. Uses a credential reference only; changing settings invalidates previous evidence. - [Set exact service permissions](https://api.orchesphere.ai/reference/rest/setServicePermissions): Designated global access administrator only, for an existing active/invited company member. Exact production/sandbox grant overrides the * default; empty actions deny access. Does not assign company membership. - [MCP reference](https://api.orchesphere.ai/reference/mcp): The existing OrcheSphere MCP transport and all 13 tool schemas. - [list_workspaces](https://api.orchesphere.ai/reference/mcp/list_workspaces): List only companies assigned to this verified identity. - [list_connections](https://api.orchesphere.ai/reference/mcp/list_connections): Read permitted provider status and evidence. Registration is not proof of live access. - [list_portals](https://api.orchesphere.ai/reference/mcp/list_portals): List portals assigned to this identity within the selected company. - [list_tasks](https://api.orchesphere.ai/reference/mcp/list_tasks): List only tasks this identity can access in the selected company. - [create_task](https://api.orchesphere.ai/reference/mcp/create_task): Save a task in an assigned portal. This records requested work; it does not execute actions in external systems. - [update_task](https://api.orchesphere.ai/reference/mcp/update_task): Update an authorized task. Contributor, reviewer and portal-administrator permissions are enforced by the server. - [list_jobs](https://api.orchesphere.ai/reference/mcp/list_jobs): Read saved jobs submitted by this user; company administrators can read company jobs. - [get_job](https://api.orchesphere.ai/reference/mcp/get_job): Retrieve a saved job and its result by ID. - [verify_connection](https://api.orchesphere.ai/reference/mcp/verify_connection): Save a durable, read-only provider identity check and return its job ID. The AWS worker continues after this chat closes. Requires a service verification grant. - [cancel_job](https://api.orchesphere.ai/reference/mcp/cancel_job): Cancel a saved job. Requires requester rights or a company-job cancellation grant. - [configure_connection](https://api.orchesphere.ai/reference/mcp/configure_connection): Register or replace this company’s provider configuration. Use an AWS credential reference, never a secret. This does not establish live provider access. - [set_service_permissions](https://api.orchesphere.ai/reference/mcp/set_service_permissions): Assign exact service rights to a company member. Exact environment grants replace the all-environments default. An empty actions array denies access. Only the designated global administrator may change grants. - [set_platform_role](https://api.orchesphere.ai/reference/mcp/set_platform_role): Revoke an existing platform authority assignment using a platform-admin-controlled internal OAuth binding. Global authority cannot be created or transferred through the application. The last active platform administrator cannot be removed. ## Boundaries No provider business-record read/write API. Registered developer apps cannot request internal administration scope. Tokens must never appear in prompts, logs or public artifacts.