HTTP API Reference

Run MAP as an HTTP server for production deployments. Every endpoint below is in the reference implementation.

Base URL

Default http://localhost:8787. Configure with PORT.

Dispatch

POST /dispatch

Submit a task for execution. Returns the result package plus the signed receipt.

curl -X POST http://localhost:8787/dispatch \
  -H "Content-Type: application/json" \
  -d '{ "capability": "payment.execute", "envelope": { ... } }'

Approvals

POST /approve

Approve a pending task with its approval reference. Multi-party flows accept each required approval independently until the set is complete.

Policy

GET  /policy
POST /policy

Read the active policy document, or hot-swap it at runtime with no restart:

curl -X POST http://localhost:8787/policy -d @policy.json

Tasks

GET /tasks
GET /tasks/:id

List tasks with optional filters, or retrieve one task by ID. Task states: accepted, proposed, denied, awaiting_approval, running, completed, failed, revoked.

Agents and receipts

GET /agents
GET /receipts
GET /audit-events

List registered agents, query signed execution receipts, and stream the tamper-evident audit event log (hash-chained checkpoints included).

Health

GET /health
GET /ready

Liveness and readiness probes for orchestrators and load balancers.

Replay protection

Signed HTTP requests carry two headers:

Header	Meaning
x-map-nonce	Unique per request; rejects replayed traffic
x-map-timestamp	Must fall inside a plus-or-minus five minute window

Error codes

All 24 error codes are typed and exported by the SDKs:

agent_not_found, agent_disabled,
capability_not_found, capability_disabled,
policy_denied, approval_required, approval_denied, approval_expired,
invalid_delegation_token, token_expired, token_invalid_signature, token_missing_scope,
schema_validation_failed, schema_version_unsupported, schema_negotiation_failed,
tenant_mismatch, rate_limit_exceeded, request_timeout,
internal_error, invalid_request, idempotency_conflict,
resource_not_found, unauthorized, forbidden

Each maps to the correct HTTP status code.