Agent Action API

01

Authentication

Create an rnk_ bearer key from the Agent API page in your account. Keys are scoped to one Brand, shown once, and can be revoked at any time. Never ship a raw key to a browser or include it in agent descriptions.

Authorization: Bearer rnk_your_key

02

Connect over MCP

The endpoint speaks JSON-RPC and supports initialization, tool discovery, and tool calls. It does not require a session identifier, but every POST still requires the Brand key.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}

03

Available tools

Read open tasks, opportunities, findings, and audit items for the key's Brand. Results are bounded and can be filtered without exposing the raw key in any response.

Record status changes or notes against an authorized action item. This closes the loop between a readiness report and the agent doing the work.

04

Security boundary

Missing, unknown, or revoked keys receive no tools. A key can act only inside its Brand, and the endpoint returns JSON-RPC results rather than opening a user session.

Keep one key per agent integration.
Revoke it when the integration is no longer trusted.
Treat the raw value like a password.

05

What this interface does

This interface does not give an agent permission to edit your website, sync feeds, or place purchases. Those permissions remain in the systems where the work is carried out.