{"product":"forwardslash.ch","version":"1","documentation":"https://forwardslash.ch/developers","openapi":"https://forwardslash.ch/api/openapi.json","mcp":{"url":"https://forwardslash.ch/api/mcp","transport":"streamable-http","protocolVersion":"2025-03-26","manifest":"https://forwardslash.ch/api/mcp/manifest"},"authentication":{"type":"http","scheme":"bearer","keyPrefix":"ak_","createAt":"https://forwardslash.ch/settings/connect"},"agent":{"version":"1","identity":{"authority":"https://forwardslash.ch/api/auth/whoami","note":"whoami is authoritative for organization, environment, dry-run state and permitted tools. Never infer any of them from the hostname, the package name or the user's prompt."},"capabilities":[{"capability":"read","means":"Read the records this Organization key is scoped to.","doesNotMean":"It does not permit creating, changing or deleting anything."},{"capability":"write","means":"Create and change records, including drafts, lists, tasks and campaign plans.","doesNotMean":"It does not permit sending, dialling, publishing or enrolling anybody."},{"capability":"send","means":"Execute an outbound action the user has explicitly approved, one action at a time.","doesNotMean":"It is never standing consent. A send-capable key does not mean the user has agreed to this send; preview it and get explicit confirmation first."}],"stages":[{"stage":"read","description":"Fetch the records and settings the request actually depends on."},{"stage":"understand","description":"Explain in plain language what you found and what is missing."},{"stage":"propose","description":"State the specific change you intend, in the user's terms."},{"stage":"preview","description":"Show exactly what would be created, changed or contacted, including exclusions."},{"stage":"confirm","description":"Get explicit human approval for that exact action. Silence is not approval."},{"stage":"execute","description":"Perform only the approved action, through a tool that tools/list returned."},{"stage":"report","description":"Say what happened, what was skipped and what failed, with request ids."}],"nextSteps":[{"order":1,"action":"Read this discovery document","url":"https://forwardslash.ch/.well-known/forwardslash","why":"It names the startup order, what each capability means and where the boundaries are."},{"order":2,"action":"Ask the user for their email address, then POST it to /api/agent/connect/start","url":"https://forwardslash.ch/settings/connect","why":"Use the least privilege that completes the task. A read key cannot be misused into a send. With no key, ask the user one thing: the email they use (or want to use) for forwardslash. POST it to connect.start (MCP: agent_connect_start); forwardslash emails them a link that signs them in, or creates a passwordless account, and asks them to enter the user_code you show them and approve. Poll connect.poll (MCP: agent_connect_poll) every poll_interval seconds; the key is returned once. Never ask for a password or for the user to paste a key. A user can also create a key at the url above.","connect":{"start":"https://forwardslash.ch/api/agent/connect/start","poll":"https://forwardslash.ch/api/agent/connect/poll","mcpTools":["agent_connect_start","agent_connect_poll"],"startBody":["email","agent_name","client","requested_capability","purpose"],"pollBody":["connect_id"],"ask_user_for":["email"],"never_ask_for":["password","api key"],"alternatives":["handoff code (POST /api/auth/handoff/redeem)","https://forwardslash.ch/settings/connect"]},"freeTrial":{"transport":"REST only (no MCP tools exist for it; MCP-only agents must call these over HTTPS or connect an account)","endpoints":["https://forwardslash.ch/api/anon/workspace","https://forwardslash.ch/api/anon/tasks","https://forwardslash.ch/api/anon/leads","https://forwardslash.ch/api/anon/campaign_drafts","https://forwardslash.ch/api/anon/magic_link"],"keep_data":"POST /api/anon/magic_link with the user's email turns the trial workspace into a real account."}},{"order":3,"action":"Call whoami","url":"https://forwardslash.ch/api/auth/whoami","why":"This is the authority on organization, environment, dry-run state and permitted tools. Never infer any of them from a hostname, a package name or the user's prompt."},{"order":4,"action":"Initialize the MCP session","url":"https://forwardslash.ch/api/mcp","why":"Streamable HTTP transport. The initialize response repeats these operating instructions."},{"order":5,"action":"Call tools/list","why":"The only callable contract. If an operation is not there, it is not available to this key — report the blocker and stop. Do not invent a tool, invent an argument, fill a dummy value or fall back to a REST route that was not offered."},{"order":6,"action":"Explain what forwardslash can do for the user, then ask what outcome they want","why":"Name only operations present in tools/list, and say plainly which are unavailable. Ask for the decisions you are missing rather than choosing them."}],"productCapabilities":[{"area":"Companies and Contacts","can":"Find existing records, create reviewed Contacts, add contact details, and use published profile attributes such as role, company or location to identify relevant people.","boundary":"Distinguish stored facts from inferred or enriched profile data, and show the source and status wherever the product provides it."},{"area":"Lists","can":"Find, create and refine static or filtered Lists, add reviewed Contacts, and preview duplicates, missing details and excluded records.","boundary":"Explain which criteria produced a List. A List is the normal reusable audience for Campaigns and Calls, so its contents must be inspectable before it is used."},{"area":"References, tasks and follow-up","can":"Read permitted company and contact history, notes and references, and create supported tasks and follow-up work.","boundary":"Never claim access to material the tools did not actually return."},{"area":"Campaigns and Templates","can":"Create a campaign plan, start from or create a Template, choose a sender and a reviewed audience, and generate editable drafts.","boundary":"Approval and sending stay separate from drafting. Generating a draft is not scheduling it."},{"area":"Pages","can":"Create or attach a forwardslash Page where the published tools support it, and personalise recipient links through the governed recipient flow.","boundary":"Publishing and attaching are separate decisions, and neither is implied by the other."},{"area":"Messages and channels","can":"Draft email, SMS or social copy where supported.","boundary":"Drafting does not send or post. Social content with no published delivery tool is a reviewable draft, and must never be described as delivered."},{"area":"Calls and Sequences","can":"Prepare call lists, dial sessions and multi-step Sequences where supported.","boundary":"Do-not-call, consent, number readiness, timing and confirmation gates stay intact and are applied by the server, not by the assistant."},{"area":"Guest collaboration","can":"Share a reviewed work surface with a contractor, client or another AI through the governed Share journey, without them creating an account.","boundary":"A share grants only the displayed data and actions — never the whole workspace, hidden contacts, credentials, or authority to send, dial, publish, enrol or export. It is revocable, may expire, records guest activity and may require a password that is never placed in the URL."},{"area":"Privacy and GDPR","can":"Help document the objective, audience, relationship and lawful-basis inputs, data source, minimisation, suppression handling and retention decisions.","boundary":"forwardslash provides controls that support compliant work. Neither the product nor the assistant declares an activity legally compliant, and neither chooses the lawful basis for the user."},{"area":"Not available to agents yet","can":"Point the user to the web app: reading and replying to a single Inbox thread (/inbox), Forms (/settings/forms), data exports (/settings), Targets (/targets), Projects (/projects) and workspace settings (/settings).","boundary":"There is no tool for these areas. Say so plainly and link the web path; never improvise an endpoint or claim the action was done."}],"outboundSafety":{"rule":"Never execute an outbound action without previewing it and obtaining explicit confirmation for that exact action.","appliesTo":["email","sms","calls","sequence enrolment","page publishing"],"note":"A send-capable key is permission to carry out an approved action, not evidence that one was approved. Dry-run, suppression, do-not-call, consent and cap gates are applied by the server and cannot be waived by a client."},"recovery":[{"situation":"Missing or invalid key","action":"Ask the user for their email and start agent connect (POST /api/agent/connect/start), then restart at whoami. The response never echoes the key you sent."},{"situation":"Capability lower than expected","action":"Report the actual capability and which steps it blocks. Continue read-only or ask for a properly scoped key."},{"situation":"A tool you need is absent from tools/list","action":"Stop and report the exact missing operation. Do not improvise an endpoint or arguments."},{"situation":"The rate limit is reached","action":"Wait for the reported duration. Never tight-loop."},{"situation":"A mutation partially succeeded","action":"Report completed, skipped and failed records with their request ids. Retry only items that are explicitly idempotent."}]}}