Reference · v1
Reference 2026-11-10.1 · Reviewed
Find what an operation does, what it returns and what access it needs. The 12 REST operations and their MCP equivalents expose the same core capabilities; they are not separate provider integrations.
Use the search at the top to find a name, path, tool or field.
Find the company workspaces available to the consenting identity and obtain the workspace IDs needed by every company-scoped operation.
Read saved state orchesphere.read
Current active company assignments; verified global authority may see all company workspaces.
Read saved provider connections, expected and observed identities, current service rights and recorded verification evidence for one company.
Read saved state orchesphere.read
Provider read permission in the selected workspace/environment. Configured is not proof of live access; managed_admin entries are read-only external projections.
Find the company work areas visible to the caller, including the current portal role and whether the caller may create tasks there.
Read saved state orchesphere.read
Current company membership and a parent portal assignment, or company-owner authority.
Read saved requested work visible through the caller's company, portal and task assignments, together with current editing capabilities.
Read saved state orchesphere.read
Current company/portal access and a task assignment/role. This lists saved requested work, not provider execution.
Read the latest saved identity-verification jobs the caller may inspect, including recorded attempts, results, errors and optional product capabilities.
Read saved state orchesphere.read
Provider read permission plus requester identity or jobs_read_all. Latest 100 matching saved jobs, newest first.
Inspect one saved identity-verification job and distinguish a queued or running request from a completed identity result, failure or cancellation.
Read saved state orchesphere.read
Provider read permission plus requester identity or jobs_read_all. Missing and inaccessible jobs both return 404.
Save a new requested-work task in an existing company portal and return its identifier, initial todo state and current caller capabilities.
Changes saved state orchesphere.read orchesphere.jobs
Portal admin/operator. Explicit assigneeEmail additionally requires the designated access administrator and an eligible active portal member. Saves requested work; no external execution.
Replace the supplied title, description or work-tracking status on an accessible saved task, while retaining all omitted fields.
Changes saved state orchesphere.read orchesphere.jobs
Task admin/contributor/reviewer. Reviewer can update status only. Reassignment is not exposed. Parent portal and company rights still apply.
Queue a durable, read-only provider identity check for a saved connection, or return the existing submission for the same requester and idempotency key.
Changes saved state orchesphere.read orchesphere.jobs
Provider verify permission, implemented identity adapter and current entitlement/quota. Requires Idempotency-Key; replay with the same workspace/requester/key and connection returns the existing job, possibly already terminal. A different connection conflicts.
Mark a permitted saved verification job cancelled when it is queued, awaiting retry, running or blocked; already-terminal jobs remain unchanged.
Changes saved state orchesphere.read orchesphere.jobs
Company owner, or non-viewer requester with provider read, or provider jobs_cancel_all. Applies to queued/retry_wait/running/blocked states; terminal jobs remain unchanged.
Create or update the saved expected identity and authentication settings for one provider and environment in a company, using approved credential references only.
Changes saved state orchesphere.read orchesphere.manage
Provider configure permission; browser_session also requires company owner. Allowed mode depends on catalog provider. Production entitlements/limits apply. Uses a credential reference only; changing settings invalidates previous evidence.
Replace one existing company member's exact OrcheSphere service-rights rule for a provider and environment, including an explicit empty rule that denies access.
Changes saved state orchesphere.read orchesphere.manage
Designated global access administrator only, for an existing active/invited company member. Exact production/sandbox grant overrides the * default; empty actions deny access. Does not assign company membership.
Revoke platform authority — Revoke an existing platform authority assignment through the restricted internal MCP flow.
7 documented endpoint URLs cover resource discovery, authorization, token exchange/refresh, revocation and MCP transport.
| Endpoint | Purpose |
|---|---|
| GET https://api.orchesphere.ai/.well-known/oauth-protected-resource | Discover the exact REST resource, its authorization server and supported resource scopes. |
| GET https://orchesphere.ai/.well-known/oauth-protected-resource | Discover the exact MCP resource, authorization server and resource scopes. |
| GET https://orchesphere.ai/.well-known/oauth-authorization-server | Find the issuer, OAuth endpoints and supported authorization behavior. |
| GET https://orchesphere.ai/oauth/authorize | Let a signed-in user review and approve an application’s resource and scopes using Authorization Code with S256 PKCE. |
| POST https://orchesphere.ai/oauth/token | Exchange a one-use authorization code for an access token, or rotate tokens for an existing offline authorization. |
| POST https://orchesphere.ai/oauth/revoke | Disconnect the grant associated with an application’s access or refresh token. |
| POST https://orchesphere.ai/mcp | Initialize an MCP connection, discover permitted tools and call them with explicit company context. |