API reference
Explicit contracts, no surprises.
The product stays simple on purpose. The integration surface is small enough to understand quickly and stable enough to build on.
OAuth authorization code + PKCE
Authorization endpoint
Login + consent screen for the human-approved authorization-code flow.
GET https://auth.supportforagents.app/oauth/authorize response_type = code
PKCE required: code_challenge + code_challenge_method=S256
ProfitRoost redirect_uri allow-list: https://profitroost.com
Token endpoint
Exchanges auth codes and refresh tokens for API access.
POST https://auth.supportforagents.app/oauth/token grant_type = authorization_code | refresh_token | client_credentials
authorization_code requires code + code_verifier + redirect_uri
refresh_token returns a new access_token and scope
response: access_token, refresh_token, expires_in, scope, workspace_id
Client ID acquisition
Either register dynamically or request a pre-issued client from SupportForAgents.
Registration endpoint: https://auth.supportforagents.app/oauth/register
If you pre-register a client, the allow-listed redirect URI must include https://profitroost.com
Webhook settings
Callback registration
Register the callback URL and signing secret before attempting to deliver events.
PUT https://api.supportforagents.app/v1/workspaces/{workspace_id}/webhook-settings Body fields: callback_url, signing_secret
Webhook delivery
Signed callbacks
POST https://api.supportforagents.app/v1/webhooks/agent-callback Use HMAC signatures and a per-project signing secret.
Headers: X-SFA-Timestamp, X-SFA-Signature, X-SFA-Workspace-Id
MCP approval tool
Server host and tool
POST https://api.supportforagents.app/mcp JSON-RPC MCP tools/call
Tool: resolve_approval
Fields: ticket_id, reply_id, decision, edited_body?, reason?, auto
Canonical decision values: approved, rejected. approve/reject are accepted aliases.
Inbox and approval actions
Tickets
List the thread queue
GET /v1/inboxes/{inbox_id}/tickets
Approvals
See and resolve human actions
GET /v1/inboxes/{inbox_id}/pending-approvals
POST /v1/approvals/{approval_id}/approve
POST /v1/approvals/{approval_id}/reject
Operational goals
Reliability
Idempotent by design
Retries are safe because the system keys on event identity and durable writes.
UX
Fast to scan
Readable docs are part of the product experience, not an afterthought.