Same endpoints an agent calls
Capability playground
Everything below dispatches to /api/capabilities/* — the identical URL, schema, middleware chain and policy an autonomous caller hits. Watch the results land in the audit trail.
read · agent.whoami
Who does the server think you are?
Web Bot Auth policy is "observe": unsigned callers are served and simply come back unverified. A browser has a cookie session, not an RFC 9421 signature.
read · agent.brief · agentPolicy: require
The endpoint a browser cannot use
This capability overrides the app default and answers only cryptographically verified agents. From here you should get a typed 401 { code: "agent_required" }. Run node scripts/agent.mjs to see the other outcome.
read · projects.search
useCapability()
Concurrent calls are last-one-wins, so a stale response can never overwrite a newer one, and the previous result stays visible while a follow-up is in flight.
write · projects.create
<Form capability>
Progressive enhancement all the way down: with JavaScript this posts JSON and revalidates the page; without it, the endpoint accepts the form-encoded body, coerces the fields onto the input schema, and answers with a 303 back here.
destructive · projects.archive
Prepare, then wait for a person
You are not signed in and this request carries no verified agent identity, so the confirmation flow will fail closed with confirmation_unavailable — there is nobody to bind the proposal to. Try it, then sign in and try again.
Housekeeping
Reset the demo
This is a public playground with in-memory state. Put the three seed projects back.