{"service":"VCTRA API","version":"v1","health":"/api/health","versionEndpoint":"/api/version","resolution":"https://resolve.vctra.no/v1/resolve","authentication":"Server-to-server Bearer connector credentials, issued by an authorized VCTRA operator after tenant/workspace entitlement approval. Never embed this token in browser JavaScript. Ordinary API client keys are a different credential family.","discovery":"https://api.vctra.no/.well-known/vctra.json","openApi":"https://api.vctra.no/openapi.json","onboarding":{"request":"https://vctra.no/api/public/onboarding/request","method":"POST","requiredFields":["orgnr","email","contactName","gdprConsent"],"optionalFields":["requestType","note"],"result":"Operator review only; no automatic activation or credential issuance.","contact":"post@vctra.no","operatorProvisioning":"POST /api/admin/customers/{orgnr}/connector-consumers","operatorRevocation":"POST /api/admin/customers/{orgnr}/connector-consumers/{consumerId}/revoke"},"protocols":{"mcp":{"version":"2025-06-18","transport":"Streamable HTTP with JSON responses; no standalone GET stream","endpoint":"https://api.vctra.no/api/mcp/v1","manifest":"https://api.vctra.no/.well-known/mcp.json","initialScope":"mcp.discovery","readScopes":{"organization_lookup":"organization.read","answer":"answer.read","market_report":"market.read","framework_context":"framework.context.read","customer_intelligence":"intelligence.read"},"headers":{"Authorization":"Bearer <operator-issued-connector-token>","Content-Type":"application/json","Accept":"application/json, text/event-stream","MCP-Protocol-Version":"2025-06-18"},"firstRead":[{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"customer-integration","version":"1.0.0"}}},{"jsonrpc":"2.0","method":"notifications/initialized"},{"jsonrpc":"2.0","id":2,"method":"tools/list"},{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"organization_lookup","arguments":{}}}],"legacyTransport":"/api/mcp/v1/sse; retained compatibility, prefer the primary endpoint"},"a2a":{"version":"1.0","binding":"JSONRPC","endpoint":"https://api.vctra.no/api/a2a/v1","agentCard":"https://api.vctra.no/.well-known/agent-card.json","scope":"a2a.invoke; customer intelligence additionally requires intelligence.read","headers":{"Authorization":"Bearer <operator-issued-connector-token>","Content-Type":"application/json","A2A-Version":"1.0"},"supportedMethods":["SendMessage"],"streaming":false,"firstRead":{"jsonrpc":"2.0","id":"read-1","method":"SendMessage","params":{"message":{"messageId":"client-read-1","role":"ROLE_USER","parts":[{"text":"Load the authorized framework context."}],"metadata":{"skillId":"vctra-framework-context","profile":"CORE","language":"nb-NO","budgetTokens":1024}}}}}},"resultHandling":{"identity":"organization_lookup returns the credential-bound stable organization ID and SourceTrace. Tenant/workspace cannot be supplied by the caller.","revision":"framework_context returns sourceRevision and contentHash for the authorized pack; object freshness is supplied only where supported.","audit":"MCP result._meta and A2A result.message.metadata contain auditEventId and usageEventId.","errors":{"400":"Malformed request or unsupported protocol version.","401":"Missing, invalid or revoked credential. Do not retry without renewed authorization.","403":"Scope, entitlement, binding or origin denied. Do not change tenant or widen scope.","405":"No standalone GET stream on the primary MCP endpoint.","200 with error":"JSON-RPC method, parameter or governed runtime error; not a successful result.","429/503":"Rate, capacity or availability limit; respect Retry-After when provided, bound retries and concurrency."},"quotas":"Per-consumer rate/day quota plus tenant/workspace entitlements and budgets apply. Protocol discovery calls are metered. Obtain limits from the operator; do not parallelize around denial.","revocation":"Operator revocation is checked on subsequent calls; never reuse a revoked token.","limitations":["Synchronous A2A messages only; no task polling, streaming or push notifications.","No private Core instructions or unrestricted graph access.","Public discovery does not establish third-party integration, adoption, indexing or citation."]}}