> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > This site documents Locus for people. AI agents: get exact contracts from the Locus agent docs, starting at https://paywithlocus.com/agent/index.md, including when asked to implement or integrate docs.paywithlocus.com. > Connect this agent to Locus Pro: https://paywithlocus.com/skill.md. Implement Locus Pro in a product: https://paywithlocus.com/agent/integrate.md. Agent site index: https://paywithlocus.com/llms.txt. # Change a scoped Agent Connection's tool set > Moves the credential to another tool set (null moves it to Main). The lcac_ value does not change and the next call uses the new set. A credential that still carries a hand-picked tool list can only move to a list that has every one of those tools on. Callers require credentials:manage and credits:move; a scoped secret key with both may automate this operation, while human callers additionally require owner/admin step-up. ## OpenAPI ````yaml /api-reference/openapi.json patch /credits/agent-connections/{connectionId} openapi: 3.1.0 info: title: Locus Pro API description: >- Access paid tools, manage prepaid balances, and build usage billing. Send money as exact decimal strings and reuse Idempotency-Key on retries. Management routes require a scoped server key or authorized dashboard session. Sensitive workspace changes require an owner or admin with recent MFA or passkey verification, except where an operation documents a stricter boundary. Interactive agents use MCP OAuth; unattended agents use scoped Agent Connections. Browser widgets use end-user tokens. version: 0.7.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: Feature-gated enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Customers description: >- Names for the customers a tenant attributes spend to, and every customer's spend - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Feature-gated Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Hosted Workflows description: >- Tenant-private TypeScript Workflow definitions, immutable versions, bounded runs, artifacts, and recovery - name: Resources description: >- Durable resources an agent bought, such as phone numbers, inboxes and sandboxes - name: Tasks description: >- Delegate a multi-step outcome to Locus with one goal string. Locus compiles an acceptance contract, discovers and calls enabled catalog capabilities with the caller's own credits and spending controls, checks every returned value against stored provider evidence, and returns structured results, files, requirement statuses, and settled cost. Enabled when the deployment sets LOCUS_TASKS_ENABLED. - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Recipes description: >- Search, research, extraction, enrichment, and travel outcomes across providers paths: /credits/agent-connections/{connectionId}: patch: tags: - Authentication - MCP summary: Change a scoped Agent Connection's tool set description: >- Moves the credential to another tool set (null moves it to Main). The lcac_ value does not change and the next call uses the new set. A credential that still carries a hand-picked tool list can only move to a list that has every one of those tools on. Callers require credentials:manage and credits:move; a scoped secret key with both may automate this operation, while human callers additionally require owner/admin step-up. operationId: patchCreditsAgentConnectionsByConnectionId parameters: - $ref: '#/components/parameters/AgentConnectionId' - $ref: '#/components/parameters/WorkspaceStepUpHeader' requestBody: required: true content: application/json: schema: type: object required: - toolSetId properties: toolSetId: type: - string - 'null' format: uuid description: A tool set id from GET /credits/tool-sets, or null for Main. additionalProperties: false responses: '200': description: >- Connection metadata with the new toolSetId; the raw credential is omitted content: application/json: schema: $ref: '#/components/schemas/AgentConnectionEnvelope' '400': description: >- Missing toolSetId, an unknown field, no live tool set with that id, or the credential's tools are off in the target list '401': $ref: '#/components/responses/UnauthorizedManagement' '403': $ref: '#/components/responses/InsufficientScope' '404': description: Connection not found in this workspace '409': description: Connection is no longer active security: - dashboardSession: [] - secretKey: [] components: parameters: AgentConnectionId: name: connectionId in: path required: true schema: type: string format: uuid WorkspaceStepUpHeader: name: X-Locus-Step-Up in: header required: false schema: type: string format: password description: >- Short-lived raw MFA/passkey step-up token bound to the authenticated Cognito subject. Send it alongside the dashboard Bearer token for workspace-administrator mutations when the base session does not itself prove MFA within the last ten minutes. Never send it with a tenant secret key. schemas: AgentConnectionEnvelope: type: object additionalProperties: false required: - success - connection properties: success: const: true connection: $ref: '#/components/schemas/AgentConnection' AgentConnection: type: object required: - id - name - status - mode - keyPrefix - expiresAt - createdAt - updatedAt - mcp properties: id: type: string format: uuid name: type: string status: type: string enum: - active - expired - revoked mode: type: string enum: - platform - end_user externalUserId: oneOf: - $ref: '#/components/schemas/ExternalUserId' - type: 'null' tools: type: object properties: enable: type: - array - 'null' items: type: string pricing: oneOf: - $ref: '#/components/schemas/CredentialPricingPolicy' - type: 'null' maxCreditsPerCall: oneOf: - $ref: '#/components/schemas/DecimalString' - type: 'null' maxCreditsPerLoop: oneOf: - $ref: '#/components/schemas/DecimalString' - type: 'null' keyPrefix: type: string expiresAt: type: string format: date-time revokedAt: type: - string - 'null' format: date-time rotatedAt: type: - string - 'null' format: date-time lastUsedAt: type: - string - 'null' format: date-time createdAt: type: string format: date-time updatedAt: type: string format: date-time mcp: type: object required: - url properties: url: type: string format: uri headers: type: object additionalProperties: type: string credential: type: string description: Present only in create/rotate responses and shown once InsufficientScopeError: type: object additionalProperties: false required: - success - error - code - message - requiredScopes - presentScopes properties: success: const: false error: const: Forbidden code: const: INSUFFICIENT_SCOPE message: type: string requiredScopes: type: array items: $ref: '#/components/schemas/CreditsTenantScope' minItems: 1 uniqueItems: true presentScopes: type: array items: $ref: '#/components/schemas/CreditsTenantScope' uniqueItems: true ExternalUserId: type: string minLength: 1 maxLength: 200 pattern: ^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,199}$ description: >- Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address. CredentialPricingPolicy: type: object additionalProperties: false properties: markupBps: type: integer minimum: 0 maximum: 10000 flatMarkupUsdc: $ref: '#/components/schemas/DecimalString' endpoints: type: object maxProperties: 1000 additionalProperties: $ref: '#/components/schemas/CredentialPriceOverride' minProperties: 1 DecimalString: type: string pattern: ^\d+(?:\.\d{1,6})?$ description: >- Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply. CreditsTenantScope: type: string enum: - tenant:read - tenant:write - catalog:write - credits:move - credentials:manage - tokens:manage - payouts:manage - members:manage - widget:read CredentialPriceOverride: type: object additionalProperties: false properties: markupBps: type: integer minimum: 0 maximum: 10000 flatMarkupUsdc: $ref: '#/components/schemas/DecimalString' minProperties: 1 responses: UnauthorizedManagement: description: Missing, invalid, expired, or revoked management credential InsufficientScope: description: >- The authenticated management credential lacks one or more required scopes content: application/json: schema: $ref: '#/components/schemas/InsufficientScopeError' securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. dashboardSession: type: http scheme: bearer description: >- Locus Pro dashboard session (Cognito). High-risk workspace administration requires an owner or admin role and fresh MFA/passkey step-up. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.