u

.agents/skills/backend/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 
 # Dash API Routes Overview (All)
 
-Overview of all 216 API endpoints across all modules.
+Overview of all 229 API endpoints across all modules.
 
 ### Notation
 
@@ -70,6 +70,15 @@ Params: path values first, then `query:` and `body:` (`body?` = optional body).
 ### Routes
 
 
+### Section: /.well-known
+
+#### OAuth 2.0 Authorization Server Metadata (RFC 8414) — `GET /.well-known/oauth-authorization-server`
+_none_
+- Returns: `200`
+#### OAuth 2.0 Protected Resource Metadata (RFC 9728) — `GET /.well-known/oauth-protected-resource`
+_none_
+- Returns: `200`
+
 ### Section: /account
 
 #### List accounts — `GET /account`
@@ -512,6 +521,30 @@ _none_
 - Params: `sku: str, query: transaction_type?: str`
 - Returns: `200 T16`
 
+### Section: /mcp
+
+#### Model Context Protocol (MCP) Streamable HTTP endpoint — `POST /mcp`
+_none_
+- Returns: `200`
+#### List active MCP client authorizations — `GET /mcp/authorizations`
+_none_
+- Returns: `200`
+#### Revoke MCP client authorizations — `DELETE /mcp/authorizations/{clientId}`
+- Params: `clientId: str`
+- Returns: `200`
+#### Get MCP authorization prompt details — `GET /mcp/authorize`
+- Params: `query: client_id: str, redirect_uri: str, response_type?: str, code_challenge?: str, code_challenge_method?: str, state?: str, scope?: str`
+- Returns: `200`
+#### Grant or deny MCP client authorization — `POST /mcp/authorize`
+- Params: `body: { client_id: str, redirect_uri: str, action: str, code_challenge?: str, code_challenge_method?: str, state?: str, scope?: str }`
+- Returns: `200`
+#### List registered MCP clients — `GET /mcp/clients`
+_none_
+- Returns: `200`
+#### Delete registered MCP client — `DELETE /mcp/clients/{clientId}`
+- Params: `clientId: str`
+- Returns: `200`
+
 ### Section: /modelconversation
 
 #### List conversations — `GET /modelconversation`
@@ -545,10 +578,25 @@ _none_
 - Params: `id: int, body: { prefix?: str, padding?: int, next?: int }`
 - Returns: `200 { number: { id: int, type: str, prefix: str, padding: int, next: int } }`
 
+### Section: /oauth
+
+#### OAuth 2.1 Authorization Endpoint (RFC 6749 & RFC 7636) — `GET /oauth/authorize`
+- Params: `query: client_id?: str, redirect_uri?: str, response_type?: str, code_challenge?: str, code_challenge_method?: str, state?: str`
+_no response body_
+#### OAuth 2.0 Token Introspection (RFC 7662) — `POST /oauth/introspect`
+_none_
+- Returns: `200`
+#### Dynamic Client Registration (RFC 7591) — `POST /oauth/register`
+- Params: `body: { redirect_uris: str[], client_name?: str }`
+- Returns: `201`
+#### OAuth 2.1 Token Endpoint (RFC 6749 & RFC 7636) — `POST /oauth/token`
+- Params: `application/x-www-form-urlencoded`
+- Returns: `200`
+
 ### Section: /order
 
 #### List orders — `GET /order`
-- Params: `query: offset?: int, limit?: int`
+- Params: `query: offset?: int, limit?: int, search?: str, onlyUnpaid?: bool, onlyUndelivered?: bool, seekMonths?: int`
 - Returns: `200 { orders: T2[], total: int, offset: int, limit: int }`
 #### Create order — `POST /order`
 - Params: `body: { number: str, date: str, lines: T30[], entityId?: int|null }`