Rensei docs
API ReferenceNotifications

Store a browser web-push subscription for the authenticated user.

Persists a W3C PushSubscription as a per-user web-push device token. Scoped to the authenticated user; a credential with no user identity is rejected.

POST
/api/notifications/web-push/subscribe

Authorization

headerAuthorizationBearer <rsk_live_*>

Rensei API key presented as Authorization: Bearer rsk_live_. Required API-key scopes are recorded per operation in x-rensei-required-scopes.

Request Body

application/json
  1. body
endpoint*string
Formaturi
expirationTime?number|null
keys*
deviceLabel?string
Length1 <= length <= 200

Response Body

Subscription stored.

application/json
  1. response
id*string
Example Request
curl -X POST 'https://app.rensei.ai/api/notifications/web-push/subscribe' \  -H 'Content-Type: application/json' \  -d '{  "endpoint": "http://example.com",  "keys": {    "p256dh": "string",    "auth": "string"  }}'
Example Response
{  "id": "string"}

Return the VAPID public key for browser web-push subscription.

Returns the server VAPID public key (null when web-push is not configured) so the client can call pushManager.subscribe without baking the key into the bundle.

BYOA MCP facade (JSON-RPC 2.0)

Stateless Streamable-HTTP JSON-RPC 2.0 facade for Bring-Your-Own-Agent (BYOA) hosts. Lets any MCP-capable host dispatch autonomous Rensei agents, poll for audit receipts, and list installed BYOA workflows. There is no server-held session; each request authenticates with an rsk API key, a requester-registration-bound OAuth agent token, a WorkOS user token, or a browser session. Supported methods: - `initialize` - protocol handshake; advertises the `tools` capability and `serverInfo` `{ name: "rensei-byoa-mcp", version: "0.1.0" }`. - `notifications/initialized` - client readiness signal; no response (202). - `tools/list` - lists the three BYOA tools. - `tools/call` - invokes a tool by name with arguments. Tools (each result is JSON-stringified into `result.content[0].text`): - `dispatch` `{ project, goal, workType? }` returns `{ instanceId, sessionId, receiptUrl, streamUrl }`. - `get_receipt` `{ instanceId }` returns `{ receipt }` (assembled v1 dispatch receipt). - `list_workflows` `{}` returns `{ workflows: [{ id, projectId, templateSlug, status, workType }] }`. The credential must carry `dispatch:invoke` (or `*` for an rsk key). REG-10 is request-global and conditional: a registration with a public key signs the exact entire raw JSON-RPC body, including a complete batch array. A strict registration without a public key returns 403. Unbound rsk keys, user tokens, browser sessions, and light registrations without a public key do not sign. Error model: transport/auth failures return literal HTTP statuses (401 missing/invalid credential or signature, 403 missing scope or strict registration misconfiguration, 429 rate limit with `Retry-After`, 503 auth backend stalled past its budget - safe to retry). Tool-level denials and validation errors are returned as a JSON-RPC error object inside an HTTP 200 body - they do NOT surface as HTTP 4xx. JSON-RPC error codes: - `-32700` Parse error - `-32600` Invalid request - `-32601` Method / tool not found - `-32602` Invalid params - `-32603` Internal error - `-32003` Rensei auth-denied (project scope, allowlist, or Cedar policy) - `-32005` Rate limited