Build on Noima

Agents and apps use the same governed company memory as Noima's own agents: the same context, the same policies, the same approvals and the same audit trail. There is no side door.

Plan feature

The API and webhooks need the external API feature; MCP needs MCP access. Both are included in Enterprise.

External agents

A workspace admin registers the agent with a manifest (what it may read, write and propose, with spend limits) and issues client credentials. The agent exchanges them for a token that lives fifteen minutes and is re-checked on every request.

curl -X POST https://api.noima.dev/v1/agent-tokens \
  -H 'content-type: application/json' \
  -d '{"grant_type":"client_credentials","client_id":"agt_…","client_secret":"ags_…"}'
# → {"access_token":"…","token_type":"Bearer","expires_in":900,"tenant_id":"…","agent_id":"…"}

Apps acting for people (OAuth 2.1)

Register an app in a workspace (Settings → Developer). People in any workspace with the API feature can then connect it. Noima uses the authorization code flow with PKCE (S256, required for every client) and rotating refresh tokens. An app can never do more than what the person consented to, what that person's role allows, and what apps may ever hold: apps can read and propose, but never approve, administer or change policy. Anything an app proposes waits for a person, and not the person who connected it.

GET https://portal.noima.dev/oauth/authorize
  ?client_id=app_…&redirect_uri=https://your.app/callback&response_type=code
  &scope=memory.read%20work.propose&code_challenge=…&code_challenge_method=S256&state=…

POST https://api.noima.dev/v1/oauth/token   (application/x-www-form-urlencoded)
  grant_type=authorization_code&code=…&redirect_uri=…&code_verifier=…   (+ client authentication)
  grant_type=refresh_token&refresh_token=…

POST https://api.noima.dev/v1/oauth/revoke   token=…
GET  https://api.noima.dev/.well-known/oauth-authorization-server

Scope	What people are asked to allow
memory.read	Read company memory: objectives, experiments, hypotheses, beliefs, decisions, market signals and evidence.
memory.write	Propose hypotheses and record observations. Nothing becomes a decision without people.
work.read	See initiatives, work items and the status of proposed actions.
work.propose	Propose work and actions. Every proposal goes through the workspace's policies and approvals.
approvals.read	See what is waiting for a decision, and past decisions.
agents.read	See installed agents, their limits and recent runs.
connectors.read	See which systems are connected and their sync status.

MCP

The MCP server at https://mcp.noima.dev/mcp (streamable HTTP) projects the same services. MCP clients discover the authorization server through protected resource metadata and can register themselves; each person still consents in their own workspace. External agents can use their agent token directly.

{
  "mcpServers": {
    "noima": { "type": "http", "url": "https://mcp.noima.dev/mcp" }
  }
}

search_company_memory — Search memory and public signals with confidence, validity and provenance.
get_context_snapshot — A budgeted summary of what the company knows, with uncertainties.
list_objectives — The company's objectives, most important first.
list_experiments — Experiments with their design, state and outcome windows.
list_market_signals — Public market changes that match this company, with its private interpretation.
query_metrics — Metric time series by hour, day or week, totals or one breakdown, as known on any past date.
get_evidence — The sources behind any memory item: quoted excerpts, the document passage or raw record, who and when.
propose_hypothesis — Add a hypothesis to memory as a proposal. People decide whether to activate and test it.
record_observation — Record a measured value for a metric, optionally for an experiment variant.
propose_action — Propose an external action. Policy decides: it runs, waits for approval, or is denied.
get_action_status — Where a proposed action is: waiting, approved, executed, denied or failed.

Taking part in the work graph

An external agent can be assigned work alongside Noima’s own agents, under the same capability matching, budgets, leases and autonomy policy. The same contract is available over REST and in both SDKs.

list_my_assignments — Work assigned to you, with earlier steps' results, the schema your result must match, and the lease expiry.
heartbeat_assignment — Extend the lease while you work (30 minutes per call, 24 hours at most). The first call starts the work.
submit_work_result — Deliver finished work: result, summary, confidence, evidence, assumptions and a handoff.
release_assignment — Give an assignment back when you cannot finish it. The work is retried, preferably by someone else.
respond_to_handoff — Accept a handoff, or reject one missing input or outside your capabilities.
propose_work — Propose follow-up work. The autonomy policy commits it, sends it to review, or denies it.

Resources

company://objectives — The company's objectives.
company://experiments — Experiments and their state.
company://signals — Public market changes that matter to this company.

Webhooks

Subscribe an https endpoint to event types such as action.*, world.event_matched or *. Deliveries are signed, retried with backoff for about eight hours, and only sent to public addresses. Verify the signature against the raw body and reject timestamps older than five minutes.

Noima-Signature: t=1789400000,v1=<hex HMAC-SHA256(secret, "1789400000." + raw_body)>
Noima-Event-Id, Noima-Event-Type, Noima-Delivery-Id, Noima-Delivery-Attempt

SDKs

# Python
from noima_sdk import AgentClient, verify_webhook
agent = AgentClient(client_id="agt_…", client_secret="ags_…")
agent.propose_action("ads.create_draft", {...}, reason="…", idempotency_key="run-42-0")

// TypeScript
import { AgentClient, verifyWebhook } from "@noima/sdk";
const agent = new AgentClient({ clientId: "agt_…", clientSecret: "ags_…" });
await agent.search("proof-led messaging");