Conventions
- Base:
https://doingwork.work/v1for REST,https://doingwork.work/mcpfor MCP. REST is at https://doingwork.work/v1, MCP at https://doingwork.work/mcp and A2A at https://doingwork.work/a2a, all with the same operations and permissions. - Auth:
Authorization: Bearer <token>from OAuth. - Version: send
Doing-Work-Version: 2026-11-01. Tokens are pinned to a version, and every response echoes the one used. - Idempotency: send
Idempotency-Keyon every POST that writes (in MCP,_meta.idempotencyKey). A retry with the same key and body returns the first result. A different body givesidempotency_key_reused. - Money: integers in cents, in fields ending
_minor. - Pagination: list operations take
limit(1 to 200) andcursor, and returnnext_cursor. - Rate limits: 429
rate_limitedwithRetry-Afterin seconds. - Errors: JSON
{code, message, status}. See errors. - Unknown fields are rejected, so a typo fails loudly instead of being ignored.
- Events: every write emits one event per resource it changes. See webhooks.