SkillServer Integration

Listing SkillServer Integrations

Retrieve a paginated list of your SkillServer integrations to inventory which skillsets you have exposed as text-first HTTP skill servers and review their configuration.

The endpoint supports cursor-based pagination (cursor, take, order) and filtering by blueprintId and meta. The static access token is never returned by the list endpoint for security reasons; fetch a single integration as a user-audience session to retrieve it.

The SkillServer Integration lets you expose a skillset's abilities as a plain-HTTP "skill server" that agents consume by reading a text manual and then invoking abilities directly. It is a sibling of the MCP Server integration: both publish a skillset to external consumers, but a skillserver needs no MCP client, no JSON-RPC, and no handshake - just an HTTP request and a static access token.

Creating SkillServer Integrations

Specify the skillset you want to expose. Its abilities become discoverable through the manual endpoint and callable through the invoke endpoint.

The API returns the integration ID and generates a static access token used to authenticate every runtime request:

Authentication

Unlike the MCP Server integration, a skillserver uses a single static access token - the same model as a trigger integration's secret. Every runtime request, including the manual, must present it as a bearer token:

Treat the token like an API key. It unlocks every ability in the linked skillset, so distribute it only to trusted consumers and rotate it (by recreating the integration) if it leaks.

Runtime Surface

Once created, the skillserver exposes two authenticated runtime endpoints under its ID:

• GET /integration/skillserver/{id}/manual - a text manual describing the available abilities and how to call them
• POST /integration/skillserver/{id}/invoke - invoke an ability by name with its input

The standard create, list, fetch, update, and delete endpoints manage the integration itself and use normal session authentication.

The Skill Server Runtime Endpoint

A skill server exposes a single runtime URL, dispatched by HTTP method:

• GET returns the manual - a text description of the available abilities and how to call them, generated from the linked skillset so it always reflects what is callable.
• POST invokes an ability by name with its input.

Both share one URL so the runtime surface is a single endpoint, which also makes it easy to remap onto a per-skill-server subdomain later.

Although the manual is "public information" describing the server, it is still gated by the static access token - a skill server is never anonymous.

Invocation responses are plain text by default - the ability result rendered for an agent to read. Append ?format=json (or send Accept: application/json) for a structured { "result": ..., "error": ... } response. Pass an optional ?session=<id> to group tool state across calls.

Security

The static access token unlocks every ability in the linked skillset, including any that touch secrets, bots, spaces, or files. Distribute it only to trusted consumers and scope the linked skillset to exactly the abilities you intend to expose.

Deleting SkillServer Integrations

Permanently remove a SkillServer integration. External consumers immediately lose access to the manual and invoke endpoints, and the static access token is invalidated. The linked skillset and its abilities are not affected.

Fetching SkillServer Integration Details

Retrieve the configuration for a SkillServer integration, including the linked skillset and - for user-audience sessions - the static access token external consumers use to authenticate.

The accessToken is only included for user-audience sessions. Store it securely; it grants access to every ability in the linked skillset.

Updating SkillServer Integrations

Change which skillset is exposed, update organizational information, or re-associate the integration with a different blueprint. Updates take effect immediately for subsequent manual and invoke requests.

Changing skillsetId replaces which abilities are available; consumers should re-read the manual after a change. The static access token is unaffected by updates.