---
title: "Private and callback endpoints"
description: "Operator, internal runtime, webhook, callback, and legacy route boundaries."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.tooluse.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Private and callback endpoints

<p>These routes appear in the generated OpenAPI because they are part of the deployed <code>/v1</code> surface. They are not general developer endpoints.</p>
<h2 id="workspace-operator-api">Workspace operator API</h2>
<p><code>/v1/platform/**</code> manages reviewed platform connections, price books, test invocations, application credit, and grants. Access requires an interactive session for an explicitly allowlisted workspace operator.</p>
<h2 id="internal-runtime-bridges">Internal runtime bridges</h2>
<table>
<thead>
<tr>
<th>Family</th>
<th>Purpose</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>/v1/internal/actions/**</code></td>
<td>Execute or inspect an already authorized native Action</td>
</tr>
<tr>
<td><code>/v1/internal/services/execute</code></td>
<td>Native task bridge for one application-scoped service query</td>
</tr>
<tr>
<td><code>/v1/internal/recipes/**</code></td>
<td>Deterministic Recipe dispatch and runtime bridge</td>
</tr>
<tr>
<td><code>/v1/internal/bot-execution-credentials/**</code></td>
<td>Issue, inspect, or revoke short-lived Bot execution credentials</td>
</tr>
</tbody>
</table>
<p>Each family has a private configured credential and rejects Clerk sessions, developer tokens, and ordinary Agent keys.</p>
<h2 id="provider-callbacks-and-webhooks">Provider callbacks and webhooks</h2>
<table>
<thead>
<tr>
<th>Route</th>
<th>Trust basis</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>/v1/oauth/callback</code></td>
<td>Single-use OAuth state created by Tooluse.net</td>
</tr>
<tr>
<td><code>/v1/webhooks/clerk</code></td>
<td>Clerk signature over raw request bytes</td>
</tr>
<tr>
<td><code>/v1/webhooks/clerk/applications/{bindingId}</code></td>
<td>Application identity webhook binding and signature</td>
</tr>
<tr>
<td><code>/v1/webhooks/stripe</code></td>
<td>Stripe signature over raw request bytes</td>
</tr>
</tbody>
</table>
<p>A redirect or client-side success page is never authoritative payment proof.</p>
<h2 id="legacy-and-historical-bridges">Legacy and historical bridges</h2>
<p><code>/v1/topups</code>, <code>/v1/topups/reversals</code>, <code>/v1/topups/{id}/refund</code>, <code>/v1/topups/{id}/suspend</code>, <code>/v1/purchases</code>, and <code>/v1/purchases/{id}/refund</code> are authenticated integration routes for historical provisioning or reconciliation. Public clients must not call them with a user or Agent credential.</p>
<h2 id="source-of-truth">Source of truth</h2>
<p>Use the <a href="https://help.tooluse.net/openapi.yaml">OpenAPI document</a> for complete schemas. Authentication configuration is intentionally kept outside that downloadable document.</p>

Source: https://help.tooluse.net/reference/private-endpoints/index.mdx