{"service":"Vigil EHS","protocol":{"name":"vigil-agent","version":1},"authorization":{"type":"device_authorization","human_approval_required":true,"start":{"method":"POST","url":"https://vigilehs.com/api/v1/cli-auth/start","content_type":"application/json","body_schema":{"type":"object","properties":{"client_name":{"type":"string","minLength":1,"maxLength":100,"description":"Optional name shown to the approving Vigil user."},"scopes":{"type":"array","items":{"type":"string","enum":["users:read","users:write","invites:read","invites:write","inspections:write","asset_types:read","asset_types:write","audit:read","exports:read"]},"description":"Optional least-privilege scopes. Omit to request the defaults grantable by the approving user."}}},"example_body":{"client_name":"My Agent"},"success_status":201,"instructions":"The response supplies the verification URL, temporary polling credentials, polling request, token storage rules, and next steps."},"approval":{"requires_existing_vigil_session":true,"instructions":"Give verify_url from the start response to an existing Vigil user. They must sign in and approve from their home organization."}},"after_authorization":{"verify":{"method":"GET","url":"https://vigilehs.com/api/v1/auth/me","authorization_header":"Bearer <token>"},"capabilities":{"method":"GET","url":"https://vigilehs.com/api/v1/auth/capabilities","authorization_header":"Bearer <token>","instructions":"Use only the returned routes and follow each route contract, including required dry runs."}},"security":{"grants_access":false,"includes_tenant_data":false,"instructions":"This document is public metadata. It does not create a user, issue a token, or reveal tenant capabilities."}}