The HTTP API, curl-pasteable

Everything the SDK and the MCP server do is a plain HTTP call you can make yourself. Listing providers and reading schemas needs no account; running an operation needs one, and says so with a status you can act on.

Public reads, owned writes

The catalogue endpoints are open, because the catalogue is the advertisement. Anything that spends — a call through our credentials, a call through a stored key — requires a session or an API key, because the owner is who the charge and the refusal both attach to.

What a refusal looks like

An exhausted quota is a 402 carrying the limit, the count and what would lift it. A missing capability is a 402 naming the capability. A bad argument is a 400 naming the field and the type it wanted. None of them is a bare string, because a paywall a UI cannot act on is a bug in the paywall.

Questions

Can I use this without a Leumas account?

Browsing, reading every schema and comparing providers need no account at all. Making a call needs one, because a call that cannot be attributed to an owner cannot be charged to anyone and cannot be refused to anyone — that boundary is the security model as much as the billing one.

Is every call metered?

Yes, and deliberately so: every path — HTTP, the MCP server, a chatbot function call, a workflow step — goes through one pipeline that charges before it executes. This engine once ran entirely unmetered, which is free compute with a price list on it, and a test now asserts there is no route around the meter.

Do you rate-limit me?

Per account, never per IP. Everything here sits behind a proxy the whole platform shares, so a per-IP bound would be a platform-wide bound the first busy hour exhausts. Where a provider publishes its own limits we pass its throttling response straight back rather than retrying into it.