Festapp - operator / dpop

operator / bearer | operator / dpop | order-summary / bearer | order-summary / dpop

Contract 0.1.0; projectionDigest: d5788d6b8a642f26fd21a0af5619b4d44e5cfff93da61d21524506c35cc6ad90

Register an explicit client, authorize with code + PKCE S256 at https://mcp.festapp.net/auth and resource https://api.festapp.net/integrations. Select one context and consented units/events. Exchange with the same issuer and resource; verify callback iss and state. Inspect context.inspect and access.inspect before scoped operations. Keep tokens in protected storage.

For writes read the aggregate version, preserve commandId and payload through retry, and use required preview/confirmation. A timeout or revocation after admission can hide a committed write: an authorized administrator must establish its outcome before any replacement command. A new connection is not permission to duplicate an uncertain command.

Sensitive operations in the DPoP projection require a registered DPoP + PAR client and GoTrue-verified AAL2 authentication from a verified TOTP factor no older than 300 seconds. Refresh does not renew MFA time. An insufficient_user_authentication challenge includes acr_values=urn:festapp:aal2 and max_age=300; reconnect and verify a new code in the tenant consent. Request-body authentication claims are ignored.

Artwork: retain the complete original saveRequest. Repeating it preserves the same canonical SQL command after an uncertain outward reply, including after reconnect. Pending/resume recovers unresolved upstream results.

Serialize refresh and atomically store the new refresh token. Lost responses or reuse require reconnect. Revoke at https://mcp.festapp.net/token/revocation. Artifacts require the original active grant and scopes, expire after 15 minutes, and disappear on restart. API cookies do not authenticate requests. No autonomous service identities.

Use a DPoP-capable OAuth client to sign every request; the reference describes all required token and proof headers.

Proof profile: dpop. DPoP-only clients require Authorization: DPoP and a fresh signed proof on every retry, binding htm, public htu, ath, iat and jti to the token key; Bearer is never an alternative for a bound token.

Festapp integrations API (0.1.0)

Delegated personal OAuth, code + PKCE S256, explicit resource and consent. Not an autonomous organization identity. Read-only POSTs may be repeated; keyset pages are not a snapshot. Decimal money remains a string. Never generate a new commandId after a timeout. Refresh once per connection; atomically persist the rotated token. Reuse, lost refresh responses and grant expiry require reconnect. Consent defaults to 7 days; 30/90/365 days require explicit client policy. Consumed refresh proofs use capped encrypted buckets, never eviction of live evidence. Capacity exhaustion rejects new grants or exchanges. A 30-day idle limit never extends consent. Access tokens live at most 300 seconds. OAuth 2.1 and Idempotency-Key are drafts; no FAPI compliance claim. API data uses no-store. Runtime cross-field refinements remain mandatory.

Overview

URL

https://festapp.net

License

Proprietary

Servers

https://api.festapp.net/integrations/v1