> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Search executable and requestable tools > REST counterpart to MCP search_apis. Returns compact ranked summaries and routes a selected result through /credits/tools/describe. Workspace and agent principals see enabled and requestable disabled tools by default; end-user-bound callers see enabled tools only, and an account setting may choose enabled-only discovery. Results honor key endpoint allowlists, agent-connection scopes, and end-user policies. Secret keys require tenant:read rather than credits:move. This operation does not call a provider or burn credits. ## OpenAPI ````yaml /api-reference/openapi.json post /credits/tools/search openapi: 3.1.0 info: title: Locus Pro API description: >- Access paid tools, manage prepaid balances, and build usage billing. Send money as exact decimal strings and reuse Idempotency-Key on retries. Management routes require a scoped server key or authorized dashboard session. Sensitive workspace changes require an owner or admin with recent MFA or passkey verification, except where an operation documents a stricter boundary. Interactive agents use MCP OAuth; unattended agents use scoped Agent Connections. Browser widgets use end-user tokens. version: 0.7.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: Feature-gated enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Feature-gated Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Hosted Workflows description: >- Tenant-private TypeScript Workflow definitions, immutable versions, bounded runs, artifacts, and recovery - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Recipes description: >- Search, research, extraction, enrichment, and travel outcomes across providers paths: /credits/tools/search: post: tags: - Catalog summary: Search executable and requestable tools description: >- REST counterpart to MCP search_apis. Returns compact ranked summaries and routes a selected result through /credits/tools/describe. Workspace and agent principals see enabled and requestable disabled tools by default; end-user-bound callers see enabled tools only, and an account setting may choose enabled-only discovery. Results honor key endpoint allowlists, agent-connection scopes, and end-user policies. Secret keys require tenant:read rather than credits:move. This operation does not call a provider or burn credits. parameters: - $ref: '#/components/parameters/SessionBindingHeader' - name: X-Locus-End-User in: header required: false schema: $ref: '#/components/schemas/ExternalUserId' description: Optional end-user identity for a tenant secret key. requestBody: required: true content: application/json: schema: type: object properties: query: type: string minLength: 1 maxLength: 256 description: >- Trimmed natural-language capability, provider, or tool query. Optional with category or pack. category: type: string minLength: 1 maxLength: 120 description: Live canonical category ID or unambiguous alias. pack: type: string minLength: 1 maxLength: 120 description: Live curated-pack ID or unambiguous alias. limit: type: integer minimum: 1 maximum: 50 default: 10 cursor: type: string minLength: 1 maxLength: 500 include_facets: type: boolean default: false additionalProperties: false responses: '200': description: Ranked compact tool summaries headers: Cache-Control: schema: type: string const: private, no-store content: application/json: schema: $ref: '#/components/schemas/ToolSearchResponse' '400': description: Invalid search scope, group, or scoped cursor '401': description: Missing or invalid execution credential '500': description: Tool search failed security: - secretKey: [] - sandboxKey: [] - endUserToken: [] - agentConnection: [] components: parameters: SessionBindingHeader: name: X-Locus-Session-Id in: header required: false schema: type: string minLength: 16 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$ description: >- Required only when the end-user JWT carries sid. Send the original high-entropy session value; sid is its SHA-256 fingerprint. Ignored for secret-key authentication. schemas: ExternalUserId: type: string minLength: 1 maxLength: 200 pattern: ^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,199}$ description: >- Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address. ToolSearchResponse: type: object required: - success - query - taxonomy_revision - count - results properties: success: const: true query: type: string taxonomy_revision: type: string appliedFilters: type: object additionalProperties: type: string count: type: integer minimum: 0 maximum: 50 next_cursor: type: string facets: type: array maxItems: 50 items: type: object additionalProperties: true results: type: array maxItems: 50 items: $ref: '#/components/schemas/ToolSearchMatch' note: type: string description: Present when no enabled tool matched. additionalProperties: false ToolSearchMatch: type: object required: - slug - tool - provider - endpoint - title - enabled - description - category_ids - pack_ids - pricing - next_step properties: slug: type: string tool: type: string provider: type: string endpoint: type: string title: type: string enabled: type: boolean description: type: string category: type: string category_ids: type: array items: type: string pack_ids: type: array items: type: string credits: $ref: '#/components/schemas/DecimalString' variableCost: const: true pricing: type: object required: - type - credits - estimation_required properties: type: type: string enum: - fixed - variable - quote_required credits: oneOf: - $ref: '#/components/schemas/DecimalString' - type: 'null' estimation_required: type: boolean additionalProperties: false next_step: type: object required: - method - path - body properties: method: const: POST path: type: string enum: - /api/credits/tools/describe - /api/credits/tools/access-requests body: type: object required: - slug properties: slug: type: string operation_query: type: string maxLength: 256 additionalProperties: false additionalProperties: false additionalProperties: false DecimalString: type: string pattern: ^\d+(?:\.\d{1,6})?$ description: >- Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply. securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. sandboxKey: type: http scheme: bearer description: >- Sandbox key (lcrsb_…). Metered calls are simulated: no credits move, no providers are called. No management access. Simulation is served from fixtures for the hosted provider catalog; external-rail providers are not registered with the sandbox interceptor and answer 404. endUserToken: type: http scheme: bearer description: >- 60-3600 second end-user JWT minted via /credits/end-users/{id}/token. If the JWT has sid, send the original session value in X-Locus-Session-Id; sid contains only its SHA-256 fingerprint. Bearer tokens are replayable until expiry; use short TTLs, optional session binding, and Idempotency-Key on operations. agentConnection: type: http scheme: bearer description: >- Scoped lcac_ credential. Tenant-managed Agent Connections authorize only their bound MCP and wrapped execution surfaces. A bootstrap connection for a self-registered agent additionally authorizes the explicit /credits/agent/* self-service routes for its own account; neither form authorizes general tenant management. ````