SoR spine (HTTP)

HTTP /api/v1/* on the agent host is the implementation spine for the web app and SDKs. Bots with MCP use MCP+OAuth. Bots without MCP use the same OAuth as Bearer on job-pipeline HTTP. Never static API keys.

For bots — use MCP

MCP (live now): https://mcp.wrok.app/mcp. OAuth 2.1 + PKCE. Agency tools: get_career_data, get_coding_profile, list_inbox, create_application, advance_application, get_resume, generate_tailored_resume. See MCP.

Instinct fork — OAuth Bearer on job-pipeline HTTP

Same OAuth access token as Bearer on job-pipeline HTTP — not API keys, not device-code. Bots that cannot attach MCP (Instinct-class) use this path.

Authorization: Bearer <oauth_access_token>
Host https://mcp.wrok.app
GET|POST /api/v1/job-applications
GET /api/v1/job-applications/inbox
POST /api/v1/job-applications/{id}/advance   # typed next_action
POST /api/v1/job-applications/{id}/tailored-resume   # generate_tailored_resume
POST /api/v1/resumes   # same Agency Bearer as GET
PATCH /api/v1/job-applications/{id}   # resume_id attaches YAML+PDF

Never wrok_sk_, device-code, /cli-auth, or WROK-… user codes for bot install.

Base URL

https://mcp.wrok.app

Implementation alias (do not prefer): https://wrok-agent.fly.dev — deprecate-soon side door, not the bot install Host.

Authentication (web / SDK)

Prefer an OAuth access token from the product consent flow. Static wrok_sk_ keys are a legacy/proof fallback for web and SDK callers — not the bot install path.

Muse-class dual door: Settings can mint an opt-in personal API token (wrok_pat_) for agents that cannot silent-refresh. Bearer on MCP and Agency HTTP only; same subject scopes as the OAuth user. Shown once; revoke fail-closes. Not an install pitch.

Authorization: Bearer <oauth_access_token>

Available endpoints

Category	Endpoints
Auth	signup, login, me, api-keys, OAuth
Profile	GET/PUT /api/v1/profile
Career Data	GET /api/v1/career-data
Roles	CRUD /api/v1/roles
Skills	POST/DELETE /api/v1/skills
Education	CRUD /api/v1/education
Projects	CRUD /api/v1/projects
Blog	CRUD /api/v1/blog-posts, preferences, publish
Job Apps	CRUD /api/v1/job-applications, inbox, advance
Profile Page	CRUD, publish, generate /api/v1/profile-page
Resume	POST/GET/latest/delete /api/v1/resumes (Agency Bearer)
Chat	POST /chat, /chat/stream (SSE)
Coding	GET /api/v1/coding-profile, coding-machines

See the API Reference for full endpoint documentation.

Error handling

All errors return JSON with a detail field:

{"detail": "Not authenticated"}           // 401
{"detail": "Not found"}                    // 404
{"detail": "Rate limited"}                 // 429