REST API

Bare paths on the API host. Browser apps proxy /api/* to the same Nest routes.

Base URL

Production: https://api.userill.com, local: http://localhost:3001

Auth

OwnerSupabase JWT (dashboard), invalid JWT → 401
Sellerrill_sk_* (Accept)
Agentrill_vw_* (Spend)

Discovery

GET /agent/capabilities returns auth modes, pay shapes, MCP URLs, trust ladder, and seed IDs. Also: /llms.txt, /llms-full.txt, /.well-known/agent.json, /agent-openapi.json.

Try it

GET /agent/capabilities

Contracts

Every response includes request_id (body) and X-Request-Id. Errors: { ok:false, error:{code,message,details?}, request_id }. Send Idempotency-Key on mutating writes. Rate limits expose X-RateLimit-* + Retry-After.

Health

GET /health (liveness) · GET /ready (Supabase dependency probe, 503 when not ready).