# ONETOO API & agent-discovery documentation

ONETOO's public surface is read-first: an MCP server with read tools and one
enquiry tool, the content endpoints below, and no authenticated API (none is
live yet).

## MCP server (live)

`https://www.onetoo.com.au/mcp` speaks the Model Context Protocol over Streamable HTTP:
one JSON-RPC 2.0 message per POST, one JSON object back. No sign-in, no
session. Protocol 2026-07-28 (stateless: `server/discover`,
`tools/list`, `tools/call`, with the version in `_meta` and the
`MCP-Protocol-Version`, `Mcp-Method` and `Mcp-Name` headers), and
2025-11-25, 2025-06-18, 2025-03-26 for clients that open with `initialize`
(`initialize`, `tools/list`, `tools/call`, `ping`).

| Tool | Returns |
|---|---|
| `list_services` | The practices, what each covers, the priced services, the engagement models |
| `get_pricing` | The starting price of every service, or of one by `service_id` |
| `list_case_studies` | The published case studies, optionally by `sector` |
| `get_case_study` | One case study by `slug`, with the page as Markdown |
| `get_skill` | One agent skill by `name`, as Markdown |
| `submit_enquiry` | Sends an enquiry for the person: ONETOO emails them a link, and nothing arrives until they press Send |

Every tool has an input schema, an output schema and annotations (`readOnlyHint`
on the five read tools); results carry `structuredContent` and the same JSON as
text. The data is generated by the website's build from the same files as the
pages. `submit_enquiry` needs `person_confirmed: true` and an
`idempotency_key` (a retry with the same key sends nothing twice); it posts to
`POST https://www.onetoo.com.au/api/agent-enquiry`, described in `https://www.onetoo.com.au/openapi.json`.

```bash
curl -s https://www.onetoo.com.au/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/call' \
  -H 'Mcp-Name: get_pricing' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_pricing","arguments":{},"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}'
```

Server Card: `https://www.onetoo.com.au/mcp/server-card`. The contact page is
`https://www.onetoo.com.au/contact`.

## Content endpoints (live)

| Endpoint | What it serves |
|---|---|
| `https://www.onetoo.com.au/llms.txt` | Curated index of ONETOO's machine-readable content |
| `https://www.onetoo.com.au/.well-known/agent-skills/index.json` | Skill index with SHA-256 digests |
| `https://www.onetoo.com.au/.well-known/agent-skills/*.md` | Individual skills: services, pricing, fit-criteria, process, contact, content-library, industries |
| Any page with `Accept: text/markdown`, or its `.md` sibling (`https://www.onetoo.com.au/approach.md`, `https://www.onetoo.com.au/index.md`) | The page as Markdown, built with the site |

## Discovery metadata (live)

| Endpoint | Spec |
|---|---|
| `https://www.onetoo.com.au/robots.txt` | Content Signals (served by the site) |
| `https://www.onetoo.com.au/.well-known/api-catalog` | RFC 9727 |
| `https://www.onetoo.com.au/.well-known/openid-configuration` | OIDC Core |
| `https://www.onetoo.com.au/.well-known/oauth-authorization-server` | RFC 8414 |
| `https://www.onetoo.com.au/.well-known/oauth-protected-resource` | RFC 9728 |
| `https://www.onetoo.com.au/.well-known/mcp/server-card.json`, `https://www.onetoo.com.au/mcp/server-card` | MCP Server Card |
| `https://www.onetoo.com.au/.well-known/ucp` | UCP |
| `https://www.onetoo.com.au/.well-known/acp.json` | Agentic Commerce Protocol |
| `https://www.onetoo.com.au/.well-known/x402` | x402 |
| `https://www.onetoo.com.au/openapi.json` | OpenAPI 3.1 + MPP |
| `https://www.onetoo.com.au/auth.md` | auth.md agent registration recipe |

## Status of authenticated / paid surfaces

OAuth token issuance, agent registration, and x402 settlement are **scaffolded,
not live**. The OAuth endpoints return structured `not_implemented` errors
(HTTP 501); the paid routes answer 402 with an empty `accepts` list, so
agents can distinguish "not wired up yet" from "wrong URL". Do not attempt
production auth or payment flows against them. The MCP server needs neither.

## Health

`GET https://www.onetoo.com.au/api/health` returns `{"status":"ok"}` when the Worker is serving.

## Contact

Questions, integrations, or partnership requests: hello@onetoo.com.au