{"openapi":"3.1.1","info":{"title":"EQUIRE Agent API","version":"1.0.0","summary":"OAuth-protected MCP access to governed commercial real estate deal intelligence.","description":"EQUIRE exposes an OAuth-protected Model Context Protocol connector for approved organizations. It provides permission-aware access to source-grounded deal, document, valuation, diligence, listing, and firm-memory workflows. Material investment decisions remain human-reviewed and are never auto-approved through this API.","contact":{"name":"EQUIRE product support","url":"https://www.equire.ai/contact","email":"admin@agenticassets.ai"}},"servers":[{"url":"https://www.equire.ai","description":"EQUIRE production API"}],"tags":[{"name":"MCP connector","description":"Streamable HTTP Model Context Protocol operations for approved EQUIRE users."},{"name":"OAuth discovery","description":"Machine-readable OAuth metadata for discovering and authorizing the MCP connector."}],"paths":{"/mcp":{"get":{"tags":["MCP connector"],"operationId":"openMcpEventStream","summary":"Open an authorized, request-scoped MCP server-sent event stream.","description":"Requires an OAuth bearer token and an Accept header for text/event-stream. EQUIRE currently uses stateless Streamable HTTP transport: it does not issue MCP session identifiers or offer event replay.","servers":[{"url":"https://www.equire.ai","description":"EQUIRE MCP connector resource"}],"security":[{"equireOAuth":[]}],"parameters":[{"name":"Accept","in":"header","required":true,"description":"Must include text/event-stream.","schema":{"type":"string","example":"text/event-stream"}}],"responses":{"200":{"description":"A server-sent event stream for the authorized stateless MCP transport request.","headers":{"RateLimit-Policy":{"description":"Published request-policy windows. EQUIRE applies both user and organization limits to authenticated MCP traffic.","schema":{"type":"string"}},"Retry-After":{"description":"Seconds to wait before retrying a rate-limited request. Sent with HTTP 429.","schema":{"type":"integer","minimum":1}}},"content":{"text/event-stream":{"schema":{"type":"string"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"406":{"description":"The request does not accept text/event-stream.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"$ref":"#/components/responses/RateLimited"},"503":{"$ref":"#/components/responses/RateLimitUnavailable"}}},"post":{"tags":["MCP connector"],"operationId":"sendMcpJsonRpcRequest","summary":"Send a JSON-RPC request to the EQUIRE MCP connector.","description":"Requires an OAuth bearer token issued for the EQUIRE MCP resource, an Accept header listing both application/json and text/event-stream, and Content-Type: application/json. The connector exposes source-grounded tools according to the granted scopes and organization access.","servers":[{"url":"https://www.equire.ai","description":"EQUIRE MCP connector resource"}],"security":[{"equireOAuth":[]}],"parameters":[{"name":"Accept","in":"header","required":true,"description":"Must include both application/json and text/event-stream.","schema":{"type":"string","example":"application/json, text/event-stream"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JsonRpcRequest"}}}},"responses":{"200":{"description":"A JSON-RPC response from the authorized EQUIRE MCP server.","headers":{"RateLimit-Policy":{"description":"Published request-policy windows. EQUIRE applies both user and organization limits to authenticated MCP traffic.","schema":{"type":"string"}},"Retry-After":{"description":"Seconds to wait before retrying a rate-limited request. Sent with HTTP 429.","schema":{"type":"integer","minimum":1}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JsonRpcResponse"}}}},"400":{"$ref":"#/components/responses/InvalidRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"406":{"description":"The request does not accept both application/json and text/event-stream.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"415":{"description":"The request Content-Type is not application/json.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"$ref":"#/components/responses/RateLimited"},"503":{"$ref":"#/components/responses/RateLimitUnavailable"}}},"delete":{"tags":["MCP connector"],"operationId":"closeMcpSession","summary":"End an authorized stateless MCP transport request.","description":"Requires an OAuth bearer token. EQUIRE currently uses stateless Streamable HTTP transport, so it does not accept or expose an MCP session identifier.","servers":[{"url":"https://www.equire.ai","description":"EQUIRE MCP connector resource"}],"security":[{"equireOAuth":[]}],"responses":{"200":{"description":"The MCP transport processed the stateless termination request."},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/RateLimited"},"503":{"$ref":"#/components/responses/RateLimitUnavailable"}}}},"/.well-known/oauth-protected-resource":{"get":{"tags":["OAuth discovery"],"operationId":"getProtectedResourceMetadata","summary":"Discover the EQUIRE MCP OAuth protected resource.","responses":{"200":{"description":"RFC 9728 protected-resource metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProtectedResourceMetadata"}}}}}}},"/.well-known/oauth-authorization-server":{"get":{"tags":["OAuth discovery"],"operationId":"getAuthorizationServerMetadata","summary":"Discover EQUIRE OAuth authorization-server endpoints and supported scopes.","responses":{"200":{"description":"RFC 8414 authorization-server metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizationServerMetadata"}}}}}}},"/.well-known/oauth-protected-resource/mcp":{"get":{"tags":["OAuth discovery"],"operationId":"getMcpProtectedResourceMetadata","summary":"Discover protected-resource metadata at the MCP resource path.","responses":{"200":{"description":"RFC 9728 protected-resource metadata for the EQUIRE MCP connector.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProtectedResourceMetadata"}}}}}}},"/.well-known/mcp/server-card.json":{"get":{"tags":["OAuth discovery"],"operationId":"getMcpServerCard","summary":"Discover EQUIRE MCP connector identity, transport, authentication, and tools.","responses":{"200":{"description":"Public discovery metadata. The referenced MCP endpoint remains OAuth-protected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpServerCard"}}}}}}},"/oauth/authorize":{"get":{"tags":["OAuth discovery"],"operationId":"authorizeMcpClient","summary":"Start the EQUIRE OAuth authorization-code flow with PKCE S256.","description":"Requires an authenticated EQUIRE user in an approved organization. Redirects to login when no session exists, or to the registered client redirect URI after successful authorization.","parameters":[{"name":"response_type","in":"query","required":true,"schema":{"type":"string","const":"code"}},{"name":"client_id","in":"query","required":true,"schema":{"type":"string"}},{"name":"redirect_uri","in":"query","required":true,"schema":{"type":"string","format":"uri"}},{"name":"scope","in":"query","schema":{"type":"string"}},{"name":"state","in":"query","schema":{"type":"string"}},{"name":"resource","in":"query","schema":{"type":"string","format":"uri"}},{"name":"code_challenge","in":"query","required":true,"schema":{"type":"string"}},{"name":"code_challenge_method","in":"query","required":true,"schema":{"type":"string","const":"S256"}}],"responses":{"307":{"description":"Redirect to EQUIRE login or the registered client redirect URI."},"400":{"$ref":"#/components/responses/InvalidRequest"},"403":{"description":"The signed-in EQUIRE user is not approved for connector access."},"404":{"description":"The MCP connector is disabled."}}}},"/oauth/token":{"post":{"tags":["OAuth discovery"],"operationId":"exchangeMcpOAuthToken","summary":"Exchange an authorization code or rotate a refresh token.","requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"$ref":"#/components/schemas/OAuthTokenRequest"}},"application/json":{"schema":{"$ref":"#/components/schemas/OAuthTokenRequest"}}}},"responses":{"200":{"description":"Bearer access token and a rotated refresh token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthTokenResponse"}}}},"400":{"$ref":"#/components/responses/InvalidRequest"},"404":{"description":"The MCP connector is disabled."},"429":{"$ref":"#/components/responses/OAuthRateLimited"},"503":{"$ref":"#/components/responses/OAuthRateLimitUnavailable"}}}},"/oauth/register":{"post":{"tags":["OAuth discovery"],"operationId":"registerMcpOAuthClient","summary":"Register a public OAuth PKCE client for the EQUIRE MCP connector.","description":"Accepts only public PKCE clients with allowlisted redirect URIs. Registered scopes default to deals:read when omitted.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthClientRegistrationRequest"}}}},"responses":{"201":{"description":"Registered OAuth client metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthClientRegistrationResponse"}}}},"400":{"$ref":"#/components/responses/InvalidRequest"},"404":{"description":"The MCP connector is disabled."},"429":{"$ref":"#/components/responses/OAuthRateLimited"},"503":{"$ref":"#/components/responses/OAuthRateLimitUnavailable"}}}}},"components":{"securitySchemes":{"equireOAuth":{"type":"oauth2","description":"OAuth 2.0 authorization-code flow with PKCE. Dynamic client registration is available at /oauth/register.","flows":{"authorizationCode":{"authorizationUrl":"https://www.equire.ai/oauth/authorize","tokenUrl":"https://www.equire.ai/oauth/token","scopes":{"deals:read":"Read accessible deal summaries, briefings, and review context.","documents:search":"Search bounded source-document excerpts.","valuation:read":"Read valuation snapshots and run read-only scenarios.","diligence:read":"Read diligence items and phase-gate context.","prospects:read":"Read accessible prospecting records.","firm_memory:read":"Read institutional investment-memory context.","listings:read":"Read the indexed listing inventory.","deal_notes:write":"Create governed deal notes.","diligence:write":"Create or update governed diligence items.","listings:write":"Stage listings in a prospecting decision queue.","actions:stage":"Stage, but never directly apply, reviewed changes."}}}}},"schemas":{"JsonRpcRequest":{"type":"object","required":["jsonrpc","method"],"properties":{"jsonrpc":{"type":"string","const":"2.0","description":"JSON-RPC protocol version."},"id":{"oneOf":[{"type":"string"},{"type":"integer"},{"type":"null"}],"description":"Client request identifier."},"method":{"type":"string","minLength":1,"description":"MCP method name."},"params":{"type":"object","additionalProperties":true,"description":"Method-specific MCP parameters."}},"additionalProperties":false},"JsonRpcResponse":{"type":"object","required":["jsonrpc","id"],"properties":{"jsonrpc":{"type":"string","const":"2.0"},"id":{"oneOf":[{"type":"string"},{"type":"integer"},{"type":"null"}]},"result":{"description":"Successful method result."},"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"integer"},"message":{"type":"string"},"data":{"description":"Method-specific safe error data."}},"additionalProperties":true}},"additionalProperties":false},"ProtectedResourceMetadata":{"type":"object","required":["resource","authorization_servers","scopes_supported"],"properties":{"resource":{"type":"string","format":"uri"},"authorization_servers":{"type":"array","items":{"type":"string","format":"uri"}},"scopes_supported":{"type":"array","items":{"type":"string"}},"resource_name":{"type":"string"}},"additionalProperties":false},"AuthorizationServerMetadata":{"type":"object","required":["issuer","authorization_endpoint","token_endpoint","scopes_supported"],"properties":{"issuer":{"type":"string","format":"uri"},"authorization_endpoint":{"type":"string","format":"uri"},"token_endpoint":{"type":"string","format":"uri"},"registration_endpoint":{"type":"string","format":"uri"},"scopes_supported":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"McpServerCard":{"type":"object","required":["name","description","version","serverUrl","transport","authentication","tools"],"properties":{"name":{"type":"string"},"description":{"type":"string"},"version":{"type":"string"},"serverUrl":{"type":"string","format":"uri"},"transport":{"type":"string","const":"streamable-http"},"authentication":{"type":"object","required":["type","authorizationCodePkce"],"properties":{"type":{"type":"string","const":"oauth2"},"authorizationCodePkce":{"type":"string","const":"S256"}}},"tools":{"type":"array","items":{"type":"object","required":["name","description","requiredScopes","requiredScopeMode","category"],"properties":{"name":{"type":"string"},"description":{"type":"string"},"requiredScopes":{"type":"array","items":{"type":"string"}},"requiredScopeMode":{"type":"string","enum":["all","any"]},"category":{"type":"string"}}}}}},"OAuthTokenRequest":{"type":"object","required":["grant_type","client_id"],"properties":{"grant_type":{"type":"string","enum":["authorization_code","refresh_token"]},"client_id":{"type":"string"},"code":{"type":"string","description":"Required for authorization_code."},"redirect_uri":{"type":"string","format":"uri","description":"Required for authorization_code."},"code_verifier":{"type":"string","description":"Required for authorization_code PKCE exchange."},"refresh_token":{"type":"string","description":"Required for refresh_token."},"resource":{"type":"string","format":"uri"}}},"OAuthTokenResponse":{"type":"object","required":["access_token","token_type","expires_in","refresh_token","scope"],"properties":{"access_token":{"type":"string"},"token_type":{"type":"string","const":"Bearer"},"expires_in":{"type":"integer","minimum":1},"refresh_token":{"type":"string"},"scope":{"type":"string"}}},"OAuthClientRegistrationRequest":{"type":"object","required":["redirect_uris"],"properties":{"client_name":{"type":"string"},"redirect_uris":{"type":"array","minItems":1,"items":{"type":"string","format":"uri"}},"grant_types":{"type":"array","items":{"type":"string"}},"response_types":{"type":"array","items":{"type":"string"}},"token_endpoint_auth_method":{"type":"string","const":"none"},"scope":{"type":"string"},"client_uri":{"type":"string","format":"uri"},"logo_uri":{"type":"string","format":"uri"},"contacts":{"type":"array","items":{"type":"string"}}}},"OAuthClientRegistrationResponse":{"type":"object","required":["client_id","client_id_issued_at","redirect_uris","grant_types","response_types","token_endpoint_auth_method","scope"],"properties":{"client_id":{"type":"string"},"client_id_issued_at":{"type":"integer"},"client_name":{"type":["string","null"]},"redirect_uris":{"type":"array","items":{"type":"string","format":"uri"}},"grant_types":{"type":"array","items":{"type":"string"}},"response_types":{"type":"array","items":{"type":"string"}},"token_endpoint_auth_method":{"type":"string","const":"none"},"scope":{"type":"string"}}},"ErrorResponse":{"type":"object","required":["error"],"properties":{"error":{"type":"string"},"error_description":{"type":"string"}},"additionalProperties":false}},"responses":{"InvalidRequest":{"description":"The request body is malformed or outside the MCP contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Unauthorized":{"description":"A valid OAuth bearer token is required.","headers":{"WWW-Authenticate":{"description":"Bearer challenge including the OAuth protected-resource metadata URL.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"RateLimited":{"description":"The authenticated user or organization exceeded an MCP request limit.","headers":{"RateLimit-Policy":{"description":"Published request-policy windows. EQUIRE applies both user and organization limits to authenticated MCP traffic.","schema":{"type":"string"}},"Retry-After":{"description":"Seconds to wait before retrying a rate-limited request. Sent with HTTP 429.","schema":{"type":"integer","minimum":1}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"RateLimitUnavailable":{"description":"The durable rate-limit service is unavailable; production requests fail closed.","headers":{"Retry-After":{"description":"Seconds to wait before retrying a rate-limited request. Sent with HTTP 429.","schema":{"type":"integer","minimum":1}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"OAuthRateLimited":{"description":"The OAuth endpoint request limit was exceeded.","headers":{"Retry-After":{"description":"Seconds to wait before retrying a rate-limited request. Sent with HTTP 429.","schema":{"type":"integer","minimum":1}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"OAuthRateLimitUnavailable":{"description":"The durable OAuth endpoint rate limiter is unavailable; production requests fail closed.","headers":{"Retry-After":{"description":"Seconds to wait before retrying a rate-limited request. Sent with HTTP 429.","schema":{"type":"integer","minimum":1}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}