Outpost v1 HTTP API — protocol index

The full wire contract for the Outpost service-to-service HTTP API lives in PROTOCOL.md at the repo root (kept there because ~35 §X.Y anchors are cited directly by container/dashboard/v1_*.py — renumbering would orphan them). This page is the human-navigable bridge; PROTOCOL.md is authoritative.

A versioned service-to-service HTTP API on Outpost that lets another backend submit, observe, and collect the results of kin agent jobs. Authenticates as a service (not a browser), attributes work per-service, treats needs_human as a first-class terminal state, and delivers signed webhooks so clients don't have to poll. First client: purchase-advice.

Sections

§	Topic
1	Conventions
2	Authentication — HMAC bearer (v1)
3	Service registry — schema and lifecycle
4	Idempotency — the 3-layer Stripe pattern
5	Submit endpoint — POST /api/v1/jobs
6	Lifecycle state machine
7	Read endpoints
8	Cancel — POST /api/v1/jobs/<job_id>/cancel
9	needs_human semantics
10	Webhooks — Standard Webhooks
10A	Inbound triggers — signature-auth webhook receiver
11	Error model — RFC 9457
12	Rate limits and quotas
13	End-to-end example — purchase-advice
14	Versioning policy
15	Cross-references — what already exists in kin
16	CHANGELOG
17	Out of scope for v1 (explicit non-goals)
18	Acceptance criteria — the conformance test