{"openapi":"3.1.0","info":{"title":"ISX Merchant Onboarding — HTTP surface","version":"1.0.0","description":"Developer reference for the non-MCP HTTP endpoints: OAuth 2.1 (served by @cloudflare/workers-oauth-provider) and document upload/download. Onboarding itself is driven over MCP at POST /mcp; use describe_context for the tool/fact catalogue."},"servers":[{"url":"https://mcp.mykyc.io"}],"paths":{"/mcp":{"post":{"summary":"MCP JSON-RPC endpoint (Streamable HTTP). Requires a Bearer token.","security":[{"oauth2":[]}],"responses":{"200":{"description":"JSON-RPC response"},"401":{"description":"Missing/invalid token"}}}},"/authorize":{"get":{"summary":"OAuth 2.1 authorization endpoint (code + PKCE)","responses":{"302":{"description":"Redirect back to client"}}}},"/token":{"post":{"summary":"OAuth 2.1 token endpoint","responses":{"200":{"description":"Token response"}}}},"/register":{"post":{"summary":"OAuth dynamic client registration","responses":{"201":{"description":"Client registered"}}}},"/upload/{document_id}":{"put":{"summary":"Upload a document (WORM). Authorized by a signed upload token, not OAuth.","parameters":[{"name":"document_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"token","in":"query","required":true,"schema":{"type":"string"},"description":"Signed upload token from request_document_upload_urls"}],"responses":{"200":{"description":"Uploaded (returns sha256)"},"401":{"description":"Invalid/expired token"},"409":{"description":"Already uploaded (WORM)"},"413":{"description":"Too large"},"415":{"description":"Content-Type mismatch/disallowed"}}}},"/download/{document_id}":{"get":{"summary":"Read back an uploaded document. Authorized by a signed download token from get_document_download_url.","parameters":[{"name":"document_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Document bytes"},"401":{"description":"Invalid/expired token"},"409":{"description":"Not yet uploaded"}}}},"/.well-known/mcp.json":{"get":{"summary":"MCP server manifest","responses":{"200":{"description":"Manifest"}}}},"/.well-known/isx-ai.json":{"get":{"summary":"AI capability manifest","responses":{"200":{"description":"Manifest"}}}}},"components":{"securitySchemes":{"oauth2":{"type":"oauth2","flows":{"authorizationCode":{"authorizationUrl":"https://mcp.mykyc.io/authorize","tokenUrl":"https://mcp.mykyc.io/token","scopes":{}}}}}}}