Reference
Conventions
How the API is shaped, so the generated reference reads without surprises.
The OAuth, Executions, and Contract pages in the API reference are generated from the OpenAPI contract at
https://api.trywool.com/v1/openapi.yaml, so they describe the API
that's live. The conventions below apply to those endpoints and their request and response fields.
What the API covers
The OAuth flow that connects a user's account, and executions on that connection. Managing applications, icons, and connections happens in the console.
Resources
Execution routes sit under your application: /v1/applications/{id}/executions. The connection access token
implies its connection, so the routes carry no connection id. A mismatch between the application in the path and
the token is 404.
Credentials
- Execution routes take
Authorization: Bearerwith a connection access token. - The token endpoint takes form fields, with HTTP Basic for confidential clients.
Field names and pagination
Fields are snake_case. Timestamps are ISO 8601 in UTC, and ids are UUIDs. Lists take limit and after and
return has_more.
Limits
| Value | Limit |
|---|---|
| Prompt | 1–10,000 characters |
start_url | On the connected origin, at most 2,048 characters |
output_schema | Depth 4, 16 KiB |
| Result | 256 KiB |
| Request body | 64 KiB |
Versioning
Every route lives under /v1. Additive changes, such as a new field or route, arrive without notice and appear
in the changelog. A breaking change gets a new version prefix and a migration note before the
old one goes away.
Cross-origin requests
The OAuth routes, the execution routes, and the contract answer cross-origin requests from any page, so a browser app can call them directly.
Next steps
Browse the reference by group in the sidebar, or generate a client from the contract, as For coding agents suggests.
Testing with the playground
Try prompts against a real connection before you write code.
The auth link GET
The auth link. Send a user here to connect a website account to your application. The connect site, rather than the API, serves this page. It shows your application's name and icon and the website, asks the user to approve, and signs them in. It then redirects to `redirect_uri` with `code` and `state`, or with `error` (`access_denied` when the user declines, `server_error` when the sign-in fails) and `state`. An authorization expires 15 minutes after it starts; a code must be exchanged within 30 minutes. PKCE (`code_challenge` with S256) is optional for every client and recommended for public ones, because without a secret it is the only thing that ties the code exchange to the app that started it.