Developers and agents
Build with HOL through documented, self-describing interfaces.
HOL publishes predictable URLs and machine-readable contracts so developers and autonomous agents can understand the available products without scraping marketing pages or waiting for manual integration support. Public discovery and the onboarding sandbox are available immediately. A free Registry account unlocks self-service API-key management. Protected resources publish OAuth metadata, scopes, and throttling conventions so clients can authenticate and self-regulate correctly. Use the root OpenAPI document for discovery, then follow the product-specific contract when a workflow needs the full surface area.
Root OpenAPI document
Start here for a stable map of HOL public discovery resources, OAuth metadata, Registry search, and MCP endpoints. Operations have unique operation IDs, descriptions, typed parameters, response schemas, and authentication requirements for function-calling clients.
Open resourceAgent onboarding sandbox
Test typed JSON calls without an account, API key, credit balance, or mutation risk. The sandbox supports ping and Registry-search validation, returns standard throttling fields, and never executes the previewed Registry request.
Open resourceUniversal Agentic Registry API
Search across indexed agents, MCP servers, protocols, capabilities, and registry adapters. The complete Registry Broker contract is published at /registry/api/v1/openapi.json and public discovery does not require a sales-assisted onboarding flow.
Open resourceFree account and self-serve API keys
Create a free Registry account, then generate, copy, rotate, review, and revoke API keys through the Registry documentation or dashboard. API keys are shown once and can be managed without contacting sales.
Open resourceOAuth 2.0 metadata
Discover authorization, token, registration, revocation, device, introspection, userinfo, and JWKS endpoints. Protected-resource metadata explains which authorization server and scopes apply to MCP and other protected APIs.
Open resourcePublic MCP endpoint
Connect to the first-party HOL Streamable HTTP endpoint, initialize an MCP session, list read-only tools, and search the Universal Agentic Registry. The endpoint supports JSON-RPC notifications, origin checks, protocol-version headers, and IETF RateLimit fields.
Open resourceOfficial HOL Guard CLI
Install the official public CLI from PyPI with pipx install hol-guard, then run hol-guard init. The local-first CLI works without a cloud account and exposes status, approvals, receipts, command analysis, package protection, and optional Cloud connection.
Open resourceSDKs and open standards
Use HOL SDKs and HCS specifications for agent identity, profiles, communication, registries, state, privacy, auditability, and other interoperable workflows. Specifications and source repositories are public for implementation and review.
Open resourceHOL Guard developer resources
Install and integrate runtime protection for coding agents, command execution, packages, tools, and configuration changes. HOL Guard publishes local and cloud documentation, CLI instructions, OAuth-backed APIs, and a protected MCP endpoint.
Open resourceZero-friction agent onboarding
Start by calling the no-credential sandbox. A POST body of {"operation":"ping"} verifies JSON transport, while validate_registry_search normalizes a proposed Registry request without executing it. Public Registry discovery is read-only and can be explored before signup. When a workflow needs an API key, create a free Registry account and open the API Keys tab to generate and manage a key directly. No contact-sales form is required for these steps.
Agent calling sequence
- Read llms.txt for product selection and when-to-use guidance.
- Request the homepage with
Accept: text/markdownwhen compact text is preferable to HTML. - Load /openapi.json and select the operation whose typed contract matches the job.
- Use /api/agent-sandbox to test request formatting without credentials or side effects.
- For protected APIs, load both OAuth metadata documents and request only the required scopes.
- Read RateLimit-Policy, RateLimit, and Retry-After response fields and back off automatically.