API reference

Everything the Amitte registry exposes — JSON-RPC for read paths, REST for state changes and well-known surfaces.

Base URL

https://registry.amitte.com

All JSON-RPC methods POST to https://registry.amitte.com/rpc with content-type: application/json.

JSON-RPC envelope

{
  "jsonrpc": "2.0",
  "method": "search" | "fetch" | "compose" | "stats",
  "params": { ... },
  "id": <number | string>
}

The server always echoes the request id on response. Notification-style requests (no id) are accepted but never get a response body.

RPC methods

POST https://registry.amitte.com/rpc

method: search

#search

Hybrid vector + full-text search across published skills. Returns ranked matches with score blending semantic similarity, FTS, trust tier, and freshness.

Params

field	type	note
query*	string	1–500 chars. Use `*` for "any".
filters	object	Narrow results.
filters.trust_floor	"unverified" \| "verified" \| "official"	Minimum tier.
filters.mode	"artifact" \| "hybrid" \| "endpoint"	Skill mode.
filters.domains	string[]	Match any of these domains.
filters.capabilities	string[]	Match any of these capabilities.
filters.max_age_days	number	Only skills published within N days.
filters.publisher	string	Restrict to one publisher handle.
limit	number	Default 10, max 50.
offset	number	Default 0.

Returns

{ items: SearchResultItem[]; total: number; took_ms: number }

Request

curl -X POST https://registry.amitte.com/rpc \
  -H 'content-type: application/json' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "search",
    "params": {
      "query": "publish iOS app to TestFlight",
      "filters": { "trust_floor": "verified", "mode": "artifact" },
      "limit": 5
    }
  }'

Response

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "items": [
      {
        "id": "mobile/ios-publishing",
        "version": "0.1.0",
        "description": "...",
        "trust_tier": "verified",
        "score": 0.832,
        "manifest": { /* full manifest */ }
      }
    ],
    "total": 1,
    "took_ms": 47
  }
}

method: fetch

#fetch

Resolve a single skill by id. Returns the full manifest, a presigned artifact URL, and (optionally) inline artifact content. Honors version pin or returns latest.

Params

field	type	note
id*	string	`namespace/name` form.
version	string	Exact semver or range. Defaults to latest published.
include_content	boolean	When true, returns artifact_content inline. Default true.

Returns

{ manifest: Manifest; artifact_url?: string; artifact_content?: string; revoked: boolean; deprecated: boolean; versions: FetchVersionEntry[] }

Request

curl -X POST https://registry.amitte.com/rpc \
  -H 'content-type: application/json' \
  -d '{
    "jsonrpc": "2.0", "id": 1,
    "method": "fetch",
    "params": { "id": "claude-code/launch-checklist" }
  }'

Response

{
  "jsonrpc": "2.0", "id": 1,
  "result": {
    "manifest": { "id": "claude-code/launch-checklist", "version": "0.1.0", ... },
    "artifact_url": "https://amitte-artifacts.r2.cloudflarestorage.com/.../skill.md?X-Amz-Signature=...",
    "artifact_content": "# Launch checklist\n...",
    "revoked": false,
    "deprecated": false,
    "versions": [
      { "version": "0.1.0", "status": "published", "trust_tier": "verified" }
    ]
  }
}

Method-specific errors

-32004 NOT_FOUND — Skill or version does not exist.
-32007 REVOKED — The pinned version was revoked.

method: compose

#compose

Merge multiple skills into a single artifact with provenance comments. Conflicts resolved per the supplied strategy.

Params

field	type	note
ids	string[]	Skill ids to compose (alternative to `goal`).
goal	string	Natural-language goal — let the registry select skills.
constraints.trust_floor	TrustTier	Reject skills below this tier.
constraints.resolve_conflicts	"error" \| "trust-tier" \| "score" \| "llm-judge"	How to resolve overlapping sections. Default "trust-tier".

Returns

{ artifact: string; sections: ComposeSection[]; sources: SourceRef[]; conflicts: ConflictNote[]; took_ms: number }

Request

curl -X POST https://registry.amitte.com/rpc \
  -H 'content-type: application/json' \
  -d '{
    "jsonrpc": "2.0", "id": 1,
    "method": "compose",
    "params": {
      "ids": ["mobile/ios-publishing", "mobile/android-play-release"],
      "constraints": { "resolve_conflicts": "trust-tier" }
    }
  }'

Response

{
  "jsonrpc": "2.0", "id": 1,
  "result": {
    "artifact": "<!-- from mobile/ios-publishing@... -->\n# iOS\n...\n<!-- from mobile/android-play-release@... -->\n# Android\n...",
    "sections": [...],
    "sources": [
      { "id": "mobile/ios-publishing", "version": "0.1.0", "trust_tier": "verified" },
      { "id": "mobile/android-play-release", "version": "0.1.0", "trust_tier": "verified" }
    ],
    "conflicts": [],
    "took_ms": 92
  }
}

method: stats

#stats

Registry-wide counts. Used by the portal landing page and ops probes.

Returns

{ skills: number; publishers: number; domains: number; downloads_total: number; tiers: { unverified, verified, official }; top_domains: { domain, count }[]; updated_at: string }

Request

curl -X POST https://registry.amitte.com/rpc \
  -H 'content-type: application/json' \
  -d '{ "jsonrpc": "2.0", "id": 1, "method": "stats", "params": {} }'

Response

{
  "jsonrpc": "2.0", "id": 1,
  "result": {
    "skills": 12,
    "publishers": 3,
    "domains": 7,
    "downloads_total": 0,
    "tiers": { "unverified": 8, "verified": 3, "official": 1 },
    "top_domains": [{ "domain": "claude-code", "count": 4 }],
    "updated_at": "2026-04-26T..."
  }
}

REST endpoints

method	path	summary
POST	/v1/submit	Publish a skill. Body: `{ manifest, artifact_base64, signature_bundle?, publisher_handle? }`. Runs the 6-stage pipeline (schema → injection-lint → duplicate → adversarial-eval → content-eval → policy) and persists on pass.
GET	/v1/revocations.json	Append-only revocation feed. Consumers should poll periodically and reject any pinned version that appears here.
GET	/.well-known/agent.json	A2A AgentCard for the registry itself. Lists `search` / `fetch` / `compose` as advertised RPC methods.
GET	/.well-known/agents/<namespace>/<name>.json	Per-skill A2A AgentCard. The skill's endpoints (or a single `fetch` skill for artifact-only entries) are advertised; private/draft/revoked versions return 404.
POST	/v1/auth/device/start	GitHub device-flow proxy: start. Returns `{ user_code, verification_uri, device_code, interval, expires_in }`.
POST	/v1/auth/device/poll	GitHub device-flow proxy: poll. Body: `{ device_code }`. Returns `{ status, access_token?, handle?, github_id? }`.
GET	/healthz	Liveness probe. Returns `{ ok: true, uptime_s }`. No auth.

Error envelope

{
  "jsonrpc": "2.0",
  "id": <same as request>,
  "error": { "code": <number>, "message": <string>, "data"?: <any> }
}

code	name	meaning
-32700	PARSE_ERROR	JSON could not be parsed.
-32600	INVALID_REQUEST	Envelope missing required fields.
-32601	METHOD_NOT_FOUND	Unknown RPC method.
-32602	INVALID_PARAMS	Params failed schema validation.
-32603	INTERNAL_ERROR	Server error; safe to retry.
-32001	UNAUTHENTICATED	Auth required for this method.
-32002	FORBIDDEN	Authenticated but not authorized.
-32003	RATE_LIMITED	Per-IP / per-publisher quota exceeded.
-32004	NOT_FOUND	Skill / version / publisher does not exist.
-32005	CONFLICT	Duplicate or conflicting state.
-32006	VALIDATION_ERROR	Input passed schema but failed semantic checks.
-32007	REVOKED	The requested version was revoked.

SDK

For JavaScript / TypeScript, prefer @amitte-ai/sdk over hand-rolling RPC calls — it handles retries, signature verification, freshness TTLs, and BYOK provider routing.

→ SDK guide

field

type

note

query*

string

1–500 chars. Use `*` for "any".

filters

object

Narrow results.

filters.trust_floor

"unverified" | "verified" | "official"

Minimum tier.

filters.mode

"artifact" | "hybrid" | "endpoint"

Skill mode.

filters.domains

string[]

Match any of these domains.

filters.capabilities

string[]

Match any of these capabilities.

filters.max_age_days

number

Only skills published within N days.

filters.publisher

string

Restrict to one publisher handle.

limit

number

Default 10, max 50.

offset

number

Default 0.

curl -X POST https://registry.amitte.com/rpc \ -H 'content-type: application/json' \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "search", "params": { "query": "publish iOS app to TestFlight", "filters": { "trust_floor": "verified", "mode": "artifact" }, "limit": 5 } }'

{ "jsonrpc": "2.0", "id": 1, "result": { "items": [ { "id": "mobile/ios-publishing", "version": "0.1.0", "description": "...", "trust_tier": "verified", "score": 0.832, "manifest": { /* full manifest */ } } ], "total": 1, "took_ms": 47 } }

field

type

note

id*

string

`namespace/name` form.

version

string

Exact semver or range. Defaults to latest published.

include_content

boolean

When true, returns artifact_content inline. Default true.

curl -X POST https://registry.amitte.com/rpc \ -H 'content-type: application/json' \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "fetch", "params": { "id": "claude-code/launch-checklist" } }'

{ "jsonrpc": "2.0", "id": 1, "result": { "manifest": { "id": "claude-code/launch-checklist", "version": "0.1.0", ... }, "artifact_url": "https://amitte-artifacts.r2.cloudflarestorage.com/.../skill.md?X-Amz-Signature=...", "artifact_content": "# Launch checklist\n...", "revoked": false, "deprecated": false, "versions": [ { "version": "0.1.0", "status": "published", "trust_tier": "verified" } ] } }

field

type

note

ids

string[]

Skill ids to compose (alternative to `goal`).

goal

string

Natural-language goal — let the registry select skills.

constraints.trust_floor

TrustTier

Reject skills below this tier.

constraints.resolve_conflicts

"error" | "trust-tier" | "score" | "llm-judge"

How to resolve overlapping sections. Default "trust-tier".

curl -X POST https://registry.amitte.com/rpc \ -H 'content-type: application/json' \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "compose", "params": { "ids": ["mobile/ios-publishing", "mobile/android-play-release"], "constraints": { "resolve_conflicts": "trust-tier" } } }'

{ "jsonrpc": "2.0", "id": 1, "result": { "artifact": "\n# iOS\n...\n\n# Android\n...", "sections": [...], "sources": [ { "id": "mobile/ios-publishing", "version": "0.1.0", "trust_tier": "verified" }, { "id": "mobile/android-play-release", "version": "0.1.0", "trust_tier": "verified" } ], "conflicts": [], "took_ms": 92 } }

{ "jsonrpc": "2.0", "id": 1, "result": { "skills": 12, "publishers": 3, "domains": 7, "downloads_total": 0, "tiers": { "unverified": 8, "verified": 3, "official": 1 }, "top_domains": [{ "domain": "claude-code", "count": 4 }], "updated_at": "2026-04-26T..." } }

REST endpoints

method	path	summary
POST	/v1/submit	Publish a skill. Body: `{ manifest, artifact_base64, signature_bundle?, publisher_handle? }`. Runs the 6-stage pipeline (schema → injection-lint → duplicate → adversarial-eval → content-eval → policy) and persists on pass.
GET	/v1/revocations.json	Append-only revocation feed. Consumers should poll periodically and reject any pinned version that appears here.
GET	/.well-known/agent.json	A2A AgentCard for the registry itself. Lists `search` / `fetch` / `compose` as advertised RPC methods.
GET	/.well-known/agents/<namespace>/<name>.json	Per-skill A2A AgentCard. The skill's endpoints (or a single `fetch` skill for artifact-only entries) are advertised; private/draft/revoked versions return 404.
POST	/v1/auth/device/start	GitHub device-flow proxy: start. Returns `{ user_code, verification_uri, device_code, interval, expires_in }`.
POST	/v1/auth/device/poll	GitHub device-flow proxy: poll. Body: `{ device_code }`. Returns `{ status, access_token?, handle?, github_id? }`.
GET	/healthz	Liveness probe. Returns `{ ok: true, uptime_s }`. No auth.

Error envelope

{ "jsonrpc": "2.0", "id": <same as request>, "error": { "code": <number>, "message": <string>, "data"?: <any> } }

code	name	meaning
-32700	PARSE_ERROR	JSON could not be parsed.
-32600	INVALID_REQUEST	Envelope missing required fields.
-32601	METHOD_NOT_FOUND	Unknown RPC method.
-32602	INVALID_PARAMS	Params failed schema validation.
-32603	INTERNAL_ERROR	Server error; safe to retry.
-32001	UNAUTHENTICATED	Auth required for this method.
-32002	FORBIDDEN	Authenticated but not authorized.
-32003	RATE_LIMITED	Per-IP / per-publisher quota exceeded.
-32004	NOT_FOUND	Skill / version / publisher does not exist.
-32005	CONFLICT	Duplicate or conflicting state.
-32006	VALIDATION_ERROR	Input passed schema but failed semantic checks.
-32007	REVOKED	The requested version was revoked.