Authenticate with Google OAuth 2.0 PKCE / OIDC ID token (`/api/v1/auth/google/*`) or email/password, mint single-use enrollment tokens (`et_...`), exchange them via `mizpah connect` for machine credentials (`mc_...`), and view or enter running agent sessions across machines without manual port forwarding or VPN setup.
01 · LIVE FLEET PRESENCE & ENROLLMENT
Pass `Authorization: Bearer <session_token>` to `GET /connect` or `GET /api/v1/machines` to inspect your live account entitlement, minted enrollment tokens, and real-time machine inventory.
mizpah connect (POST /api/v1/machines/pair/start -> /connect?pair=CODE | POST /api/v1/enrollment-tokens)Run `mizpah connect` to receive a short `user_code` (`XXXX-XXXX`) and approve it on `/connect` (`POST /api/v1/machines/pair/approve`), or mint a single-use token (`et_<token>`) on an account with `connectivity_entitled: true`.
mizpah connect --token et_<enrollment_token> --name gpu-workstation (POST /api/v1/machines/pair/poll | /api/v1/machines/enroll)Polls `POST /api/v1/machines/pair/poll` once approved (or exchanges `et_...` at `POST /api/v1/machines/enroll`) to issue a persistent machine credential (`mc_...`) and register the host in the fleet broker.
POST /api/v1/machines/heartbeat (Authorization: Bearer mc_<credential>)Updates `presence_status` (`online` within 60s TTL, `stale` after expiry) and publishes `configured_agents`, `running_sessions`, and `active_projects`.
POST /api/v1/machines/broker/requests {"action":"open_session_entry",...}Relays `launch_session`, `query_session_status`, and bidirectional `pty_in` / `pty_out` frames across machines on the same entitled account.
| Machine | Platform | Presence | Configured Agents | Running Sessions | Active Projects |
|---|---|---|---|---|---|
| gpu-workstationmach_ref_gpu01 | linux / x86_64 |
online | claude (cli, ide) · codex (cli) | sess_m1_initial [claude · running] | Mizpah Core Engine (green · wo_fleet_sync) |
| field-laptopmach_ref_field02 | linux / aarch64 |
online | antigravity (cli, desktop) · grok (cli) | brokered entry -> sess_m1_brokered_42 | Mobile Hub (red · wo_ui_pass) |
02 · HTTP API SURFACE
Every endpoint is served directly by `mizpah-web` with deterministic entitlement enforcement.
Sign in with Google via OAuth 2.0 PKCE (`POST /api/v1/auth/google/start` and `POST /api/v1/auth/google/callback`) or direct OIDC ID token exchange (`POST /api/v1/auth/google/token`) to provision or link your Mizpah.ai account.
Register (`POST /api/v1/accounts/signup`), sign in (`POST /api/v1/accounts/signin`), inspect profile (`GET /api/v1/accounts/me`), initiate checkout (`POST /api/v1/billing/checkout`), and apply signed webhooks (`POST /api/v1/billing/webhook`).
Start RFC 8628-style device pairing (`POST /api/v1/machines/pair/start`), approve or deny a `user_code` (`POST /api/v1/machines/pair/approve` · `/deny`), poll for `mc_...` credentials (`POST /api/v1/machines/pair/poll`), or mint/exchange single-use tokens (`POST /api/v1/enrollment-tokens` · `POST /api/v1/machines/enroll`).
Publish heartbeats (`POST /api/v1/machines/heartbeat`), discover fleet inventory (`GET /api/v1/machines`), dispatch broker requests (`POST /api/v1/machines/broker/requests`), poll/respond, and exchange relay frames (`/frames`).