> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superember.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Control API overview

> Control SuperEmber through REST, the CLI, or MCP.

The SuperEmber Control API exposes workforce, Fleet, workflow, team membership, usage, A2A policy, onboarding, Emberbase knowledge, activity, approvals, and recovery controls at `https://api.superember.ai`. REST is versioned under `/v1`, the OpenAPI 3.1 document is served at `/openapi.json`, and MCP uses stateless Streamable HTTP at `/mcp`.

Authenticate interactive clients with OAuth and PKCE, automation with a scoped `se_sa_…` service-account token, and native agents with short-lived `se_ag_…` tokens issued by the trusted workload exchange. Send bearer tokens only in `Authorization`; never place them in URLs or Fleet files.

Every mutation needs `Idempotency-Key`. Resource updates and deletes also need the current numeric revision in `If-Match`. Successful mutations return a durable operation that can be polled at `/v1/operations/{id}`. Errors use RFC 9457 problem details with a stable `code` and `x-request-id`.

```bash theme={null}
curl https://api.superember.ai/v1/actors/me \
  -H "Authorization: Bearer $SUPEREMBER_TOKEN"

curl https://api.superember.ai/v1/agents \
  -H "Authorization: Bearer $SUPEREMBER_TOKEN"
```

Service accounts should carry only the scopes and team/subtree constraints needed by the job. Rotate them with overlap, update the consumer, verify the new token, and revoke the old credential. The one-time secret is never returned again.

Provider authorization remains a browser handoff. Public approval records omit tool arguments and session keys; conversation lists return opaque one-way IDs; activity previews are sanitized. Scheduled workers, provider callbacks, and billing redemption are not general control endpoints.