# Nettipoika Studio agent discovery

Environment: dev
Release: main-20261029-eb57326ca804
Source commit: eb57326ca804401388f675edb738ec2556ab72eb
HTTP API: v1
Payment API: 0.25.0
MCP protocol: 2026-07-28
Canonical URL: https://studio-dev.nettipoika.fi/llms.txt
Product discovery index: https://nettipoika.fi/llms.txt

Nettipoika lets a customer-owned agent operate the websites a person authorizes through a deterministic HTTP API or its thin MCP adapter. One subscription includes any number of websites inside the account's shared CPU, memory and storage pool. Discovery never grants authority. A human authorizes identity, terms, recurring payment, sensitive scopes, account recovery, destructive database actions and final deletion.

Start with https://studio-dev.nettipoika.fi/agents/v1/getting-started.md.

- Operational OpenAPI: https://studio-dev.nettipoika.fi/openapi.json
- Human enrollment and account OpenAPI: https://studio-dev.nettipoika.fi/payment/openapi.json
- Executable capabilities: https://studio-dev.nettipoika.fi/api/v1/capabilities
- Retry and operation rules: https://studio-dev.nettipoika.fi/agents/v1/operations.md
- Capability boundaries: https://studio-dev.nettipoika.fi/agents/v1/capabilities.md
- OAuth client setup and approved scopes: https://studio-dev.nettipoika.fi/agents/v1/oauth-setup.md
- MCP endpoint: https://studio-dev.nettipoika.fi/mcp
- OAuth protected-resource metadata: https://studio-dev.nettipoika.fi/.well-known/oauth-protected-resource/mcp
- Secrets such as API keys for Go and Django websites: list names and ask the owner (`list_site_secrets`, `request_site_secret`); see the quick start
- Reporting a problem with Nettipoika itself: search, then report, then read its state (`search_problem_reports`, `report_problem`, `get_problem_report`); see the quick start
- Reporting a security vulnerability (RFC 9116): https://studio-dev.nettipoika.fi/.well-known/security.txt

An authorization is bound to one site, or with the person's explicit approval to every website of their account, plus explicit scopes and a revocable connection. With access to several websites, name the `site_id` the person means on every call and ask the person when they have not said which website; never guess. If site selection is skipped or unanswered, wait for an explicit website before editing. Deleting a website always needs the owner's confirmation on the dashboard. Access tokens expire in at most 15 minutes; a conforming OAuth client renews them with the advertised metadata and its protected rotating refresh credential. Never put credentials or verifiers in a URL, source file, prompt, log or version control. Every HTTP mutation requires an `Idempotency-Key`; poll returned operation resources until a terminal state.

Customer sites use hostnames returned by the authenticated site API under the configured `dev.nettipoika.fi` suffix. Do not infer a site hostname from this product origin or from an incoming Host header. An owner can also add their own domain, such as www.example.fi, on the website's page in their Nettipoika account. There is no API for domains: explain the DNS record that page shows and let the owner add it.