# 850 Work Public API

850 Work exposes public status and website-scheduling endpoints, stateless public MCP and A2A product tools, and a narrow owner-approved OAuth 2.0 API for agent scheduling. Authenticated workspace, admin, billing, payment, customer, HR, support, and health records are not agent APIs.

## Public MCP Server

- Endpoint: `POST https://www.850work.com/mcp`
- Server card: `https://www.850work.com/.well-known/mcp/server-card.json`
- Authentication: None.
- Scope: Public product facts, public pricing, and official public-page lookup only.

The MCP endpoint uses JSON-RPC 2.0 and supports `initialize`, `ping`, `tools/list`, and `tools/call`. It is intentionally stateless and has no access to account sessions, customer data, payments, documents, staff records, billing, or admin functionality.

## Public A2A Agent

- Endpoint: `POST https://www.850work.com/a2a`
- Agent Card: `https://www.850work.com/.well-known/agent-card.json`
- Authentication: None.
- Scope: The same verified public product, pricing, and official-page information as the public MCP service.

The A2A endpoint accepts JSON-RPC 2.0 `SendMessage` requests using A2A protocol version 1.0. It cannot access private workspace data.

## Discovery

- API catalog: https://www.850work.com/.well-known/api-catalog
- OpenAPI description: https://www.850work.com/openapi.json
- API health: https://www.850work.com/api/health
- Product reference: https://www.850work.com/llms.txt
- OAuth authorization server: https://www.850work.com/.well-known/oauth-authorization-server
- OAuth protected resource: https://www.850work.com/.well-known/oauth-protected-resource
- Agent authentication guide: https://www.850work.com/auth.md

## Owner-Approved Agent OAuth

Agents can register as public OAuth clients and request only these scopes:

- `organization.read`
- `scheduling.read`
- `scheduling.request`

Authorization Code with PKCE S256 is mandatory. A signed-in, active business owner must approve access. Demo, locked, staff, and healthcare-mode accounts cannot authorize agents. Tokens never provide customer lists, documents, payments, staff records, admin access, or full workspace state.

Protected endpoints:

- `GET https://www.850work.com/api/v1/agent/context`
- `GET https://www.850work.com/api/v1/agent/scheduling/availability?date=YYYY-MM-DD`
- `POST https://www.850work.com/api/v1/agent/scheduling/request`

Use the OpenAPI description and `auth.md` for registration, consent, token, refresh, and revocation details.

## Scheduling Setup

The 850 Work business owner opens Scheduling in the authenticated app and uses the website API connection details shown there. The screen provides the business organization identifier, endpoint, and fetch example.

If 850 Work has separately enabled a scheduling key for a website form, keep that key on the business's server or protected form backend. Do not commit it to a public repository or place it in browser-visible JavaScript. Agents should use the owner-approved OAuth flow above instead of a website scheduling key.

## Check Availability

`GET https://www.850work.com/api/v1/public/scheduling/availability?orgId=ORGANIZATION_ID&date=YYYY-MM-DD`

The response lists Morning, Midday, Afternoon, and After hours windows with an `available` boolean. Availability is advisory until the business approves the request.

## Submit a Request

`POST https://www.850work.com/api/v1/public/scheduling/request`

Use `Content-Type: application/json`. When the scheduling connection requires a key, send it in the `x-850work-schedule-key` request header.

Required fields:

- `orgId`
- `name`
- `date` in `YYYY-MM-DD` format
- At least one of `email` or `phone`

Optional fields:

- `service`
- `time`
- `address`
- `notes`
- `source`

A successful request returns HTTP `201` with a request ID and `pending` status. The business must review it in 850 Work before it becomes a confirmed job.

## Security Boundaries

- Never send 850 Work account passwords, session tokens, payment credentials, card data, customer exports, or admin credentials through the public scheduling API.
- Do not crawl or attempt to discover authenticated `/app`, `/admin`, `/api/v1` workspace, customer portal, or payment routes.
- Dynamic OAuth registration creates a public client identifier only. It never creates a user, business, autonomous workspace account, or client secret, and it grants no access until the owner approves it.

Support: info@850work.com