Public commercial API and authorized operational API

Public endpoints

• GET /api/commercial/catalog
• GET /api/commercial/company
• GET /api/commercial/capabilities
• GET /api/commercial/trust
• GET /api/commercial/use-cases
• POST /api/commercial/navigator
• POST /api/commercial/roi
• GET /api/commercial/status
• POST /api/commercial/checkout-intents

First steps with a token

• Always send the credential as Authorization: Bearer, in the REST API and in the operational MCP alike.
• dpk_ is a project API key: the project is implicit, so no projectId is needed.
• dpa_ is a global agent token: add ?projectId= or the X-DigitalPublic-Project-Id header on project-scoped calls.
• First call: POST /api/agent/discover returns the project, granted scopes, modules, and endpoint catalog.
• GET /api/agent/projects lists the projects accessible with the presented credential.
• Full operational contract: https://platform.digitalpublic.com/api/openapi
• Keep the token in the connector configuration or an environment variable, never pasted into a conversation.

curl -X POST https://platform.digitalpublic.com/api/agent/discover \
  -H "Authorization: Bearer dpk_YOUR_PROJECT_API_KEY"

curl https://platform.digitalpublic.com/api/agent/projects \
  -H "Authorization: Bearer dpa_YOUR_AGENT_TOKEN"

curl -X POST "https://platform.digitalpublic.com/api/agent/discover?projectId=YOUR_PROJECT_ID" \
  -H "Authorization: Bearer dpa_YOUR_AGENT_TOKEN"

Operational Navigator

• POST /api/agent/navigator
• Operations: ask, find_capabilities, plan_workflow, check_readiness, explain_error, summarize_project, and report_product_signal.
• Requires an agent credential and never expands granted access.

Canonical sources

OpenAPI: https://platform.digitalpublic.com/api/commercial/openapi. All public responses include a version or depend on the same catalog and contain no customer data.