Skip to main content
GET
Get a service

Authorizations

DPoP
string
header
required

Per-request RFC 9449 DPoP proof signed with ES256. Protected requests use Authorization: DPoP your_access_token_here. Create a new proof for the exact method and normalized target URI, and include the server nonce when challenged.

Authorization
string
header
required

OAuth 2.0 with RFC 9700 security practices. Discover exact environment endpoints from /.well-known/openid-configuration and /.well-known/oauth-authorization-server, and discover the resource from /.well-known/oauth-protected-resource. Authorization-code clients use PKCE S256, the exact environment resource, nonce with openid, and DPoP binding. Confidential clients also require PAR and private_key_jwt. Access and refresh tokens are sender-constrained with DPoP. purchases:execute is unavailable and omitted from this scope registry.

Headers

X-Request-Id
string

Optional caller request identifier. Unsafe values are replaced with a generated UUID.

Pattern: ^[A-Za-z0-9._~-]{8,128}$

Path Parameters

id
string
required

Stable public marketplace service identifier.

Required string length: 1 - 255
Pattern: ^[A-Za-z0-9][A-Za-z0-9._-]*$

Response

The matching service.

A privacy-safe service marketplace entry.

available
boolean
required

Whether the service is currently routable.

capabilities
string[]
required

Capabilities exposed by this service.

Required array length: 1 - 100 elements

Stable public service capability.

Required string length: 1 - 255
Pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]*$
description
string
required

Service description.

Required string length: 1 - 2048
id
string
required

Stable public marketplace service identifier.

Required string length: 1 - 255
Pattern: ^[A-Za-z0-9][A-Za-z0-9._-]*$
name
string
required

Service display name.

Required string length: 1 - 256
price
object | null
required

Current service price when available.