bOpen.ai Developers

Quickstart

Fetch the OpenAPI document, then call a public catalog endpoint.

curl -s https://bopen.ai/api/openapi.json
curl -s https://bopen.ai/api/health
curl -s https://bopen.ai/api/marketplace
curl -s "https://bopen.ai/api/search?q=bitcoin"

Public catalog API

These read-only marketplace endpoints need no API key. Errors return JSON with error.code, error.message, and error.hint.

• /api/marketplace — bOpen.ai marketplace. Returns all plugins, agents, and skills registered in the bOpen.ai marketplace.
• /api/agent/{id} — Agent detail. Returns the skills referenced by a specific agent, its last updated timestamp, and live presence.
• /api/search — Full-text agent search. Search agents by matching system prompts and referenced skill content.
• /api/tool-shed/search — Tool Shed search. Search the bOpen.ai Tool Shed catalog of developer tools.
• /api/health — Service health. Returns a JSON status document for uptime checks.
• /api/social/accounts — List postable X accounts. Returns safe account selectors an authenticated agent can use when creating a draft or planned X post.
• /api/social/posts/{id} — Read, edit, or delete one X draft. Lets an authenticated agent read, edit, or delete one of its own draft or planned X posts. Scheduled and published posts remain human-controlled.
• /api/social/media — Upload a private image for an X draft. Stores a PNG, JPEG, GIF, or WebP privately and returns an id that can be attached to one tweet in a draft.

API keys and authentication

Catalog requests use no API key. These routes are public: GET /api/marketplace, GET /api/search, GET /api/agent/{id}, GET /api/tool-shed/search, and GET /api/health.

Agent operations such as POST /api/agent/newsletter and private social-draft editing require an auth.md access token with the listed scope. Social agents can prepare text and images, but only the signed-in user can schedule or publish. Read /auth.md and discover endpoints from /.well-known/oauth-protected-resource. Humans revoke agent access at /agent/access.

For social drafts, use the in-page WebMCP tools only when the current page exposes them. Otherwise use auth.md with the direct REST API and social:draft. Do not use Chrome, CDP, copied cookies, or claim-page automation.

OpenAPI spec

The OpenAPI 3.1 document for the public catalog and scoped agent APIs is at https://bopen.ai/api/openapi.json. The RFC 9727 linkset is at /.well-known/api-catalog.

MCP server

The bOpen.ai WebMCP server card is /.well-known/mcp/server-card.json. The site registers marketplace, commerce, and social-draft tools on document.modelContext via registerTool(). Agents that cannot open the page can use the read-only Streamable HTTP catalog at https://bopen.ai/mcp — no checkout tools, cookies, or Stripe keys. The skill discovery index is /.well-known/agent-skills/index.json.

Webhooks

bOpen.ai receives Stripe and Resend webhooks on inbound provider callback routes. Agents should not POST to those routes; use the catalog API and auth.md instead.

Sandbox environment

Use the production catalog as the sandbox. It is read-only and needs no credentials. Call the live host, then compare the JSON against the OpenAPI document.

curl -s https://bopen.ai/api/agent/core:front-desk
curl -s -o /dev/null -w "%{http_code}\n" https://bopen.ai/api/orank-probe-test
# -> 404 application/json with error.code, error.message, error.hint

Talk to catalog agents in the bOpen.ai Chat playground.

Rate limits

Public catalog endpoints advertise IETF RateLimit-Policy and RateLimit headers. The public policy is 120 requests per 60 seconds per client. A 429 response also sends Retry-After in seconds.

JSON errors

Unknown /api/* paths return HTTP 404 with this body:

{
  "error": {
    "code": "not_found",
    "message": "No bOpen.ai API endpoint matches /api/orank-probe-test.",
    "hint": "Read https://bopen.ai/developers and https://bopen.ai/api/openapi.json for the public catalog API."
  }
}