> ## Documentation Index > Fetch the complete documentation index at: https://docs.simforge.ai/llms.txt > Use this file to discover all available pages before exploring further. # Authorization server metadata > RFC 8414 authorization server metadata, also served at `/.well-known/oauth-authorization-server`. The CLI knows only the host's name and reads every endpoint here; an AI agent reads the auth.md `agent_auth` block. ## OpenAPI ````yaml /api-reference/openapi.json get /api/cli/metadata openapi: 3.1.0 info: title: SimForge Cloud API version: '2026-10-24' description: >- The public SimForge API: what `simforge --cloud`, `simforge login` and the Python client call. Authenticate with a bearer token: the access token `simforge login` stores, an AI agent's access token (its recipe is `/auth.md`), or an `sfk_` API key. A `/api/v1` 401 carries `WWW-Authenticate: Bearer resource_metadata="/.well-known/oauth-protected-resource"`. `/api/v1` errors are an `ErrorEnvelope`; `/api/cli` and `/agent` errors are an OAuth error object. Versions: send `SimForge-Version: ` (2026-10-01, 2026-10-21, 2026-10-22, 2026-10-23, 2026-10-24) and every `/api/v1` response is in that version's shape and names it in the same header; this document describes 2026-10-24. A request without the header gets 2026-10-01, where an error's hint is `detail.hint` and `GET /api/v1/evaluations` names its rows `jobs`. A header that is not a date, or a date before 2026-10-01, is `400 bad_request`. Every response also carries `SimForge-Cli-Minimum`: the oldest `simforge` CLI the server serves. Retries: from 2026-10-21, send a new `Idempotency-Key` (1-255 characters) with every POST, PUT, PATCH and DELETE, and the same key when retrying that request. The first request's answer is kept for 24 hours and a repeat gets it again with `Idempotent-Replayed: true`; the key with any other request, or while the first is still running, is `409 idempotency_conflict` (`retryable` while running). A 5xx answer is not kept. Creating an API key refuses a key (its secret is shown once). license: name: Apache-2.0 identifier: Apache-2.0 servers: - url: https://dev.simforge.ai description: Development (dev.simforge.ai) security: [] tags: - name: Sign-in description: >- `simforge login`: OAuth 2.0 device and browser sign-in for the CLI, the session behind a token. AI agents sign in through auth.md (`/auth.md`): register, a person approves, then the claim and JWT-bearer grants. - name: Account description: The principal, its workspaces, API keys and usage, and system status. - name: Runs description: >- Cloud runs (`--cloud`): renders, simulations, Recast log ingestion and transfers, their events and artifacts. - name: Models description: Customer fine-tunes and their workspace-owned model weights. - name: Datasets description: >- Datasets, their files as signed links (`simforge.dataset-files/v1`, `simforge datasets pull`), and copies out of shared datasets (SIMLOG-25k). - name: Maps and vehicles description: >- Maps the workspace can use, the vehicles a scenario can bind and the asset gallery. - name: Authoring description: >- Hosted scenario authoring: drafts, transactions, validation and map discovery. - name: Distribution description: >- The runtime and map pack agreement and signed downloads (`simforge runtime install`, `simforge maps pull`). - name: Telemetry description: Runtime usage telemetry, a condition of the runtime terms. - name: Benchmark description: Renderer benchmark results and scene packs (`simforge bench`). - name: Challenge description: >- The driving challenge: team, registry login and submissions (`simforge challenge`). paths: /api/cli/metadata: get: tags: - Sign-in summary: Authorization server metadata description: >- RFC 8414 authorization server metadata, also served at `/.well-known/oauth-authorization-server`. The CLI knows only the host's name and reads every endpoint here; an AI agent reads the auth.md `agent_auth` block. operationId: getCliAuthorizationServer responses: '200': description: The server's endpoints, scopes and grants. content: application/json: schema: $ref: '#/components/schemas/CliAuthorizationServerMetadata' security: [] components: schemas: CliAuthorizationServerMetadata: type: object properties: issuer: type: string resource: type: string description: >- The protected resource (`/api/v1`), as its RFC 9728 metadata names it. authorization_servers: type: array items: type: string bearer_methods_supported: type: array items: type: string enum: - header authorization_endpoint: type: string token_endpoint: type: string device_authorization_endpoint: type: string revocation_endpoint: type: string userinfo_endpoint: type: string scopes_supported: type: array items: type: string response_types_supported: type: array items: type: string enum: - code grant_types_supported: type: array items: type: string code_challenge_methods_supported: type: array items: type: string enum: - S256 token_endpoint_auth_methods_supported: type: array items: type: string enum: - none revocation_endpoint_auth_methods_supported: type: array items: type: string enum: - none simforge_bench_results: type: string simforge_bench_packs: type: string simforge_scenario_documents: type: string simforge_cli_sessions_page: type: string agent_auth: type: object properties: skill: type: string description: 'This host''s auth.md: the agent recipe.' identity_endpoint: type: string claim_endpoint: type: string identity_types_supported: type: array items: type: string enum: - service_auth - identity_assertion events_endpoint: type: string description: >- Where a trusted agent provider pushes Security Event Tokens (RFC 8935). Present while a provider is trusted. identity_assertion: type: object properties: assertion_types_supported: type: array items: type: string enum: - urn:ietf:params:oauth:token-type:id-jag trusted_issuers: type: array items: type: string description: The agent providers whose ID-JAGs this host accepts. required: - assertion_types_supported - trusted_issuers events_supported: type: array items: type: string enum: - >- https://schemas.workos.com/events/agent/auth/identity/assertion/revoked required: - skill - identity_endpoint - claim_endpoint - identity_types_supported description: >- The auth.md profile: how an AI agent registers and is approved by a person. required: - issuer - resource - authorization_servers - bearer_methods_supported - authorization_endpoint - token_endpoint - device_authorization_endpoint - revocation_endpoint - userinfo_endpoint - scopes_supported - response_types_supported - grant_types_supported - code_challenge_methods_supported - token_endpoint_auth_methods_supported - revocation_endpoint_auth_methods_supported - simforge_bench_results - simforge_bench_packs - simforge_scenario_documents - simforge_cli_sessions_page - agent_auth ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.