> ## Documentation Index > Fetch the complete documentation index at: https://docs.archyon.app/llms.txt > Use this file to discover all available pages before exploring further. # Dynamic Client Registration (RFC 7591) > Claude registers itself here on first connect. The response carries the `client_id` to use on the subsequent `/oauth/authorize` call. Public clients (every Claude installation today) don't receive a `client_secret`; PKCE replaces it. ## OpenAPI ````yaml /openapi.yaml post /oauth/register openapi: 3.1.0 info: title: Archyon API version: 0.1.0 summary: REST surface for Archyon — the hosted architecture-mapping tool. description: > Archyon's REST API powers both the web app and the MCP server. It is organised around a few core resource families: - **Workspaces** — the unit of architecture content. Components + relationships + processes + stakeholder links + per-workspace membership all live under `/api/workspaces/{id}`. - **People + Teams + Roles** — org-scoped human entities that get attached to components as stakeholders. Sibling routes to `/api/workspaces`. - **Me + Admin** — self-service (profile, API tokens) and instance-superadmin (user management, audit log). - **Notion** — OAuth connect flow + a thin search/children proxy used when linking components to Notion pages. - **Waitlist** — the only fully public endpoint; used by the marketing site. ### Authentication All non-public endpoints take a Bearer token via `Authorization: Bearer …`. Two token kinds are accepted: | Token | Where it comes from | Lifetime | |---|---|---| | Clerk session JWT | Browser — Clerk SDK mints it from the active session | Short (≤1h) | | Archyon PAT (`an_pat_…`) | User mints one at `/account` → Tokens. Bound to the active Clerk organization at mint time. | Until revoked | Tokens belong to a Clerk **organization**. Any endpoint that touches org-scoped data (`/api/people`, `/api/teams`, `/api/stakeholder-link-types`, org-scoped workspaces) returns HTTP 400 with `code: "no_active_org"` if the caller has no org context. Switch organization in the Clerk OrgSwitcher (browser) or mint a new token while the desired org is active (CLI / MCP). ### Errors Every error response is JSON: ```json { "error": "Human-readable message.", "code": "machine_readable_tag" } ``` `code` is set when callers are expected to branch (e.g. show the "Connect Notion" CTA on `notion_misconfigured`). Plain validation errors omit `code`. contact: name: Archyon support url: https://archyon.app license: name: Proprietary url: https://archyon.app servers: - url: https://archyon.app description: Production - url: http://localhost:3000 description: Local dev (npm run dev) security: - bearerAuth: [] tags: - name: Auth description: Session bootstrap + Notion OAuth. - name: Schema description: Built-in type catalogue (component types, relation types, lifecycles). - name: Me description: Self-service — profile, API tokens, workspaces. - name: Admin description: Instance superadmin only. - name: Workspaces description: Workspace CRUD + bulk replace. - name: Components description: Components inside a workspace. - name: Relationships description: Edges between components. - name: Links description: External links attached to components (Notion pages, URLs). - name: Members description: Per-workspace membership + role. - name: Stakeholders description: People/teams attached to components with a role (owner, support, …). - name: Processes description: Mermaid-stored sequence flows that overlay the workspace canvas. - name: People description: Org-scoped people. - name: Teams description: Org-scoped teams + membership. - name: Roles description: Custom stakeholder link types (org-scoped). - name: Notion description: Search + children proxy against the connected Notion workspace. - name: Waitlist description: Public; for the marketing site. - name: MCP description: > Hosted Model Context Protocol server. The discovery endpoints are documented here so OpenAPI consumers can find them; the `/mcp` endpoint itself speaks the MCP Streamable HTTP transport, not REST. See [docs.archyon.app/connectors](https://docs.archyon.app/connectors). paths: /oauth/register: post: tags: - MCP summary: Dynamic Client Registration (RFC 7591) description: | Claude registers itself here on first connect. The response carries the `client_id` to use on the subsequent `/oauth/authorize` call. Public clients (every Claude installation today) don't receive a `client_secret`; PKCE replaces it. requestBody: required: true content: application/json: schema: type: object required: - redirect_uris properties: client_name: type: string maxLength: 200 redirect_uris: type: array items: type: string format: uri minItems: 1 token_endpoint_auth_method: type: string enum: - none - client_secret_basic - client_secret_post default: none client_uri: type: string format: uri logo_uri: type: string format: uri responses: '201': description: Client registered. content: application/json: schema: type: object required: - client_id - client_id_issued_at properties: client_id: type: string client_id_issued_at: type: integer description: Seconds since epoch. client_name: type: string redirect_uris: type: array items: type: string token_endpoint_auth_method: type: string security: [] components: securitySchemes: bearerAuth: type: http scheme: bearer description: | Both Clerk session JWTs (browser) and Archyon Personal Access Tokens (`an_pat_…`, server / CLI / MCP) use the same Bearer header. The server distinguishes them by token shape. - **Clerk JWTs** carry org context in the token claims (`org_id`, `org_role`, `org_slug`) — required for org-scoped endpoints. Configure your Clerk session template to include these claims; see DEPLOYMENT.md. - **PATs** are minted at `/account` → Tokens. Each PAT is bound to whichever org was active at mint time. Switch orgs and re-mint to address a different org. ````