Skip to main content
The SuperEmber Control API exposes workforce, Fleet, workflow, team membership, usage, A2A policy, onboarding, Emberbase knowledge, activity, approvals, and recovery controls at https://api.superember.ai. REST is versioned under /v1, the OpenAPI 3.1 document is served at /openapi.json, and MCP uses stateless Streamable HTTP at /mcp. Authenticate interactive clients with OAuth and PKCE, automation with a scoped se_sa_… service-account token, and native agents with short-lived se_ag_… tokens issued by the trusted workload exchange. Send bearer tokens only in Authorization; never place them in URLs or Fleet files. Every mutation needs Idempotency-Key. Resource updates and deletes also need the current numeric revision in If-Match. Successful mutations return a durable operation that can be polled at /v1/operations/{id}. Errors use RFC 9457 problem details with a stable code and x-request-id.
Service accounts should carry only the scopes and team/subtree constraints needed by the job. Rotate them with overlap, update the consumer, verify the new token, and revoke the old credential. The one-time secret is never returned again. Provider authorization remains a browser handoff. Public approval records omit tool arguments and session keys; conversation lists return opaque one-way IDs; activity previews are sanitized. Scheduled workers, provider callbacks, and billing redemption are not general control endpoints.