Endpoints
The spec is regenerated on every deploy from the same Zod schemas the API uses at runtime — there is no drift between what the spec describes and what the server accepts.
Authentication schemes
Every operation declares its required auth with one or more of five security schemes:
Each operation also exposes an
x-payment-info vendor extension so agent crawlers can decide whether payment is required before issuing the request.
Generating an SDK
The spec follows OpenAPI 3.1 conventions and uses$ref for shared schemas, so every mainstream client generator works out of the box.
For most use cases you should use the official
@oneshot-agent/sdk instead of generating your own client — it handles x402 payment signing, async polling, and ETH→USDC swaps automatically.Importing into other tools
- Postman — File → Import → paste
https://win.oneshotagent.com/openapi.json - Insomnia — Application → Preferences → Data → Import Data → From URL
- ChatGPT Custom Actions — paste the JSON URL directly into the actions UI
- Claude / OpenAI Assistants — provide the URL or JSON as a tool definition
What’s in the spec
The spec is the single source of truth for the OneShot API surface. If something is documented here, it works. If it’s not in the spec, it’s either internal infrastructure or hasn’t shipped yet.