# PubFi Developer Interfaces

> Compact entry point for live PubFi contracts, authentication, pricing, and execution boundaries.

## OpenAPI
- [Runtime OpenAPI](https://pubfi.ai/openapi.json): Environment-matched OpenAPI for current HTTP paths, methods, and schemas.
- [API reference](https://pubfi.ai/api-reference): Environment-matched interactive reference generated by the runtime API.

## Registry
- [Registry v2 catalog](https://api.pubfi.ai/v1/capabilities): Live installed capabilities, policies, billing mode, and readiness. Follow pagination until next_cursor is absent.
- [Capability detail template](https://api.pubfi.ai/v1/capabilities/{capability_id}): Replace {capability_id} with a catalog identifier before execution.

## MCP
- [MCP discovery manifest](https://pubfi.ai/.well-known/mcp.json): Hosted endpoint, public reads, authenticated tools, and the explicit x402 lane.
- [MCP Server Card](https://pubfi.ai/.well-known/mcp/server-card.json): Public server metadata and fixed Registry v2 tool surface.
- [OAuth protected-resource metadata](https://mcp.pubfi.ai/.well-known/oauth-protected-resource): Resource metadata for the current hosted MCP endpoint.
- [OAuth authorization-server metadata](https://wuugpdblvlpptlgnxwoi.supabase.co/.well-known/oauth-authorization-server/auth/v1): Authorization-server metadata for the issuer named by the protected resource.

## Authentication
- [Authentication guide](https://pubfi.ai/auth.md): Public reads, PubFi API keys, MCP OAuth, account-bound routes, and accountless x402.
- Public Registry reads do not authorize execution.
- The authenticated lane accepts one Bearer credential. It does not fall back between an API key and an OAuth access token.
- The accountless x402 lane is explicit and rejects Bearer credentials.

## Pricing
- [Pricing and access guide](https://pubfi.ai/pricing.md): Public, registered-account Credit, accountless x402, and custom-delivery access paths.
- Read the selected capability and live payment response before you assume a price or billing mode.

## API lifecycle

PubFi publishes lifecycle changes before they affect an integration.

### /v1 is the stable public REST major
PubFi does not silently remove routes or introduce breaking contract changes within the /v1 major.

### Deprecations stay explicit
Future deprecations are documented and marked in Runtime OpenAPI. An affected response uses the Deprecation header when deprecation is scheduled. It uses the RFC 8594 Sunset header only after a removal date is committed.

### No current removal is scheduled
No current /v1 route is scheduled for removal.

## Execution Boundary
- Use Discovery for source evidence. Discovery does not prove that PubFi can execute a source.
- Use the complete live Registry and matching OpenAPI as the current executable contract.
- The client selects a capability and an access lane. PubFi does not infer intent or choose a provider.
- Send the exact raw path, method, and route-specific request shape.