{"version":"yarrow.agent-connection.v1","enabled":true,"enrollment_enabled":true,"agent_access_enabled":true,"management_enabled":true,"authentication":"Existing human Google login and explicit browser approval; agent x-api-key","scopes":["connection:read"],"optional_scopes":["kept:read","kept:write","commons:enroll","commons:follow","commons:save","explore:read","explore:write","explore:owner-read","worlds:write","worlds:publish","future:archive:read","future:archive:write","future:archive:publish","future:archive:media:read","future:archive:media:write"],"lifetime_seconds":86400,"approval_lifetime_seconds":600,"credential":"Runtime generates ya_ plus 32 cryptographically random bytes in lowercase hex. Retain securely before any request. Never print, send to the human, or include in an approval link.","start":{"method":"POST","url":"/api/agent-connections/requests","content_type":"application/json","body":{"name":"Requester supplied display name, maximum 80 characters","credential_hash":"Lowercase hex SHA-256 of the complete credential"}},"approval":"Give the human the returned approval_url, resolved against https://yarrow.to, and requester name. They open it in their own browser, sign in if needed, inspect the account and access, and explicitly approve. Link preview is not approval.","status":{"method":"GET","url":"/api/agent-connections/me","header":"x-api-key","minimum_poll_interval_seconds":5,"states":["pending","approved","denied","expired","revoked"]},"disconnect":{"method":"POST","url":"/api/agent-connections/disconnect","header":"x-api-key","body":{}},"owner_management":"/agents/connections","recovery":"After response loss, query status with the original credential. If the initial approval URL was lost while pending, cancel and start again. A lost credential requires a new human-approved request.","limits":"The default connection grants no private records, publishing, purchases or provider-specific agent identity. Optional scopes, including publication, own-content management and explore:owner-read, require explicit human approval and participant enrollment. explore:owner-read is the optional scope that reads the approving person's own account exploration records, read only and never records kept only in a browser. Public reads remain anonymous. This is a Yarrow HTTP protocol, not an OAuth grant. Client secure storage and persistence must be independently verified."}