> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Execute a tool with an optional approved quote > Uses the same approval, spending limits, idempotency and billing result as MCP execute. Reuse the estimate approval_token and idempotency_key with the identical slug, customer and args. HTTP 200 means the execution envelope was delivered; inspect result.isError and its billing metadata before treating the call as successful. Sandbox credentials are not supported. ## OpenAPI ````yaml /api-reference/openapi.json post /credits/tools/execute openapi: 3.1.0 info: title: Locus Pro API description: >- Access paid tools, manage prepaid balances, and build usage billing. Send money as exact decimal strings and reuse Idempotency-Key on retries. Management routes require a scoped server key or authorized dashboard session. Sensitive workspace changes require an owner or admin with recent MFA or passkey verification, except where an operation documents a stricter boundary. Interactive agents use MCP OAuth; unattended agents use scoped Agent Connections. Browser widgets use end-user tokens. version: 0.7.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: Feature-gated enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Feature-gated Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Hosted Workflows description: >- Tenant-private TypeScript Workflow definitions, immutable versions, bounded runs, artifacts, and recovery - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Recipes description: >- Search, research, extraction, enrichment, and travel outcomes across providers paths: /credits/tools/execute: post: tags: - Tool discovery summary: Execute a tool with an optional approved quote description: >- Uses the same approval, spending limits, idempotency and billing result as MCP execute. Reuse the estimate approval_token and idempotency_key with the identical slug, customer and args. HTTP 200 means the execution envelope was delivered; inspect result.isError and its billing metadata before treating the call as successful. Sandbox credentials are not supported. operationId: executeCreditsTool parameters: - name: X-Locus-End-User in: header schema: type: string description: >- For a trusted workspace credential, select the same customer used for the estimate. A customer-bound credential cannot select another account. requestBody: required: true content: application/json: schema: type: object required: - slug - idempotency_key additionalProperties: false properties: slug: type: string args: type: object additionalProperties: true approval_token: type: string maxLength: 4096 idempotency_key: type: string minLength: 1 maxLength: 200 loop_id: type: string maxLength: 200 attribution: type: object additionalProperties: type: string responses: '200': description: >- MCP-compatible tool result, including success or failure and charge metadata content: application/json: schema: type: object required: - success - result properties: success: const: true result: type: object properties: isError: type: boolean content: type: array items: type: object structuredContent: type: object _meta: type: object additionalProperties: true '400': description: Invalid execution request '401': description: Invalid credentials '403': description: Execution is not permitted security: - secretKey: [] - agentConnection: [] - endUserToken: [] components: securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. agentConnection: type: http scheme: bearer description: >- Scoped lcac_ credential. Tenant-managed Agent Connections authorize only their bound MCP and wrapped execution surfaces. A bootstrap connection for a self-registered agent additionally authorizes the explicit /credits/agent/* self-service routes for its own account; neither form authorizes general tenant management. endUserToken: type: http scheme: bearer description: >- 60-3600 second end-user JWT minted via /credits/end-users/{id}/token. If the JWT has sid, send the original session value in X-Locus-Session-Id; sid contains only its SHA-256 fingerprint. Bearer tokens are replayable until expiry; use short TTLs, optional session binding, and Idempotency-Key on operations. ````