# Nettipoika Sivusto agent discovery

Environment: dev
Release: dev-3a382c5
Source commit: 3a382c557c1643ae17b0ea70ef7836d47c0a8bb4
HTTP API: v1
Payment API: 0.23.0
MCP protocol: 2025-11-25
Canonical URL: https://sivusto-dev.nettipoika.fi/llms.txt
Product discovery index: https://nettipoika.fi/llms.txt

Nettipoika lets a customer-owned agent operate one authorized website through a deterministic HTTP API or its thin MCP adapter. Discovery never grants authority. A human authorizes identity, terms, recurring payment, sensitive scopes, account recovery, destructive database actions and final deletion.

Start with https://sivusto-dev.nettipoika.fi/agents/v1/getting-started.md.

- Operational OpenAPI: https://sivusto-dev.nettipoika.fi/openapi.json
- Human enrollment and account OpenAPI: https://sivusto-dev.nettipoika.fi/payment/openapi.json
- Executable capabilities: https://sivusto-dev.nettipoika.fi/api/v1/capabilities
- Retry and operation rules: https://sivusto-dev.nettipoika.fi/agents/v1/operations.md
- Capability boundaries: https://sivusto-dev.nettipoika.fi/agents/v1/capabilities.md
- MCP endpoint: https://sivusto-dev.nettipoika.fi/mcp
- OAuth protected-resource metadata: https://sivusto-dev.nettipoika.fi/.well-known/oauth-protected-resource/mcp

An authorization is bound to one site, explicit scopes and a revocable connection. Access tokens expire in at most 15 minutes; a conforming OAuth client renews them with the advertised metadata and its protected rotating refresh credential. Never put credentials or verifiers in a URL, source file, prompt, log or version control. Every HTTP mutation requires an `Idempotency-Key`; poll returned operation resources until a terminal state.

Customer sites use hostnames returned by the authenticated site API under the configured `dev.nettipoika.fi` suffix. Do not infer a site hostname from this product origin or from an incoming Host header.