manifest
Package id, slug, version, install target, capability type, compatibility metadata, and public package metadata.
Docs
API reference
Secure contractOlyWork APIs are entitlement-first and source-safe.
The public API contract returns install payloads, generated config, verification metadata, and safe errors. It must not return private repository URLs, storage keys, creator secrets, or hidden prompts.
Core endpoints
POST
/api/v1/syncValidates access token, buyer entitlement, package status, version, target compatibility, and returns safe install payload plus adapter config.
POST
/api/v1/integrations/configGenerates client-specific connector config for CLI, MCP, Claude Desktop, Cursor, Windsurf, Codex, OpenClaw, workflow, and agent targets.
POST
/api/v1/runtime/runPrepared protected runtime bridge surface. Validates entitlement, client allowance, signed runtime request, usage metering, and safe output filtering.
GET
/api/v1/access/statusChecks entitlement and token status for a buyer/package pair without exposing private package metadata.
GET
/api/healthOperational health surface for app, database, storage, rate limit, billing, runtime, and install health checks.
Sync request
Field
Meaning
target
Requested install adapter, such as cursor, claude-desktop, mcp, workflow
version
Optional package version; latest is used when omitted
verifyOnly
Ask the API to validate entitlement and manifest without returning payload writes
client
Name, version, platform, OS, arch, and device id for install telemetry
installed
Local CLI inventory used to calculate update or reinstall behavior
json
{
"token": "oly_sk_...",
"target": "cursor",
"version": "1.0.0",
"verifyOnly": false,
"client": {
"name": "oly-cli",
"version": "1.0.0",
"platform": "local",
"os": "darwin",
"arch": "arm64",
"deviceId": "hashed-device-id"
}
}The CLI sends client metadata so installs can be audited and compatibility warnings can be generated.
Sync response
integrity
Manifest checksum, payload checksum, artifact checksum, signature metadata, signing algorithm, and verification hints.
adapter
Generated config and manual fallback instructions for the requested client target.
Structured errors
Code
Meaning
Remediation
invalid_token
Token is malformed or does not exist
Copy a fresh command from Library
expired_token
Token lifetime ended
Rotate access in Library
revoked_token
Access was revoked
Ask the buyer/admin to restore access
missing_entitlement
Buyer does not have access
Get free or paid access first
artifact_missing
Package artifact is unavailable
Creator/admin must republish artifact
incompatible_target
Requested client/OS/target is not supported
Use an allowed target
json
{
"error": "Access token expired",
"code": "expired_token",
"message": "This install token is expired.",
"remediation": "Open Library and rotate access.",
"docsUrl": "/docs/troubleshooting"
}Errors should be specific, safe, and actionable. Never include private object keys or source URLs.
API privacy boundary
Never return
Private repo URLs, GitHub installation tokens, storage object keys, encryption keys, creator secrets, hidden prompts, or private runtime logs.
Return instead
Manifest, safe payload, generated config, checksums, warnings, required user secret names, docs links, and safe audit ids.
Audit every attempt
Log success/failure, token hash, buyer, product, version, target, client, platform, user agent, IP metadata, and reason code.
Production rule
A sync response should be safe to show in a bug report. If it contains anything a creator would not want copied into a public ticket, the API contract is wrong.