The served specification

The management API is described by an OpenAPI 3.0 specification. The published copy, for reading, is linked from Administration via REST API. Since 8.8.0 the server can also serve the specification of the exact release it runs, at a stable URL, so that agents and code generators discover the API from the server they talk to instead of a download that may describe another version:

GET https://<your server>:6443/api/v1/openapi.json

The answer is the specification with two differences from the published copy: info.version is the version of the running software, and servers[0].url is the address the request came through. The response carries an ETag and Cache-Control: no-cache, so a client can revalidate cheaply. The route needs no credential, is rate limited like the other public routes, and is off by default: a SuperAdmin enables it with serveOpenApi under Global Configuration, Automation.

Agents typically fetch it once at start, pick the operations their token's scopes allow (see GET /adm/automation-tokens/self), and generate their tool definitions from the request and response schemas. The specification documents, per operation, the dryRun parameter and the If-Match and Idempotency-Key headers described in Safe writes, and every response schema carries the messageCode and errors[].code fields described in Reason codes.