> ## Documentation Index > Fetch the complete documentation index at: https://docs.altss.com/llms.txt > Use this file to discover all available pages before exploring further. # Execute explicitly accepted company research > Purchase one result from the exact quoted toolId with an explicitly accepted, unchanged quote. Requires customer authorization to spend the quoted amount. Keep the same idempotencyKey on retries. Never automatically accept a quote for a customer. Requires the API channel and company.read, confirmed funding, an active wallet and current tenant/license/privacy checks. The credential spending ceilings remain binding. The input and complete quote must match the quote request. ## OpenAPI ````yaml /console-openapi.json post /v1/console/runs openapi: 3.1.1 info: title: Altss Console machine API version: '2026-11-11' description: >- A separate description of the deployed protected Console REST, MCP and agent-authorization interfaces. The public website and documentation readers remain anonymous and are described separately. company.read is necessary but not sufficient: approved channels, verified tenant admission, current terms, per-tool eligibility, data rights, spending limits, explicit purchase approval and confirmed funding remain enforced. OAuth grant extensions below describe implemented protocols; generic OpenAPI tools may ignore extensions and cannot infer an authorization-code or device flow. x-altss-source-commit: d2432ba2f34a58ed7936598fb5b42dfbf50c6637 servers: - url: https://console.altss.com security: [] tags: - name: Console REST - name: Console MCP - name: Console authorization externalDocs: url: https://console.altss.com/auth.md description: Authoritative Console authorization and human-approval guide paths: /v1/console/runs: post: tags: - Console REST summary: Execute explicitly accepted company research description: >- Purchase one result from the exact quoted toolId with an explicitly accepted, unchanged quote. Requires customer authorization to spend the quoted amount. Keep the same idempotencyKey on retries. Never automatically accept a quote for a customer. Requires the API channel and company.read, confirmed funding, an active wallet and current tenant/license/privacy checks. The credential spending ceilings remain binding. The input and complete quote must match the quote request. operationId: runConsoleResearch parameters: - in: header name: Idempotency-Key required: false schema: type: string minLength: 1 maxLength: 180 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]*$ not: pattern: '^console-task:' description: >- Required here or as body.idempotencyKey. Both values, if supplied, must match exactly. Keep it unchanged on retries. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RestRun' responses: '200': description: >- Run outcome from the incumbent runtime. An uncertain response is not evidence that nothing was charged. content: application/json: schema: type: object additionalProperties: true '400': description: >- Invalid request, unsupported operation or invalid grant; response shape depends on the transport. content: application/json: schema: type: object additionalProperties: true '401': description: >- Missing, malformed, unknown, revoked or wrong-channel credential. These failures are deliberately indistinguishable. headers: WWW-Authenticate: schema: type: string description: >- Plain Bearer for REST; the canonical MCP endpoint includes the exact MCP protected-resource metadata URL. '402': description: >- Confirmed Console funding is required before execution. This does not grant free paid-tool access. '403': description: >- Current account, organization, permission, data-rights or other authorization checks deny this request. '429': description: Rate limit exceeded. Do not retry rapidly. '503': description: >- Unavailable or uncertain outcome. For a paid run, preserve the idempotency key and inspect the run; do not assume no charge occurred. security: - ConsoleAgentGrant: - company.read - ConsoleKey: [] components: schemas: RestRun: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: toolId: type: string enum: - company.dossier - company.financial_research input: type: object propertyNames: type: string minLength: 1 maxLength: 200 additionalProperties: b8499244-336b-49ed-8139-0d66d08b192a description: >- JSON object. The server additionally enforces at most 4096 value nodes, depth 16 and 65536 UTF-8 bytes, plus the selected tool's semantic validation. These structural refinements are not fully expressible in this JSON Schema. quote: type: object propertyNames: type: string minLength: 1 maxLength: 200 additionalProperties: b8499244-336b-49ed-8139-0d66d08b192a description: >- JSON object. The server additionally enforces at most 4096 value nodes, depth 16 and 65536 UTF-8 bytes, plus the selected tool's semantic validation. These structural refinements are not fully expressible in this JSON Schema. accept: type: boolean const: true idempotencyKey: type: string minLength: 1 maxLength: 180 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]*$ not: pattern: '^console-task:' description: >- Trim surrounding whitespace. Reuse the same key on retries. The console-task: namespace is reserved. required: - toolId - input - quote - accept additionalProperties: false $defs: __schema0: anyOf: - type: string - type: number - type: boolean - type: 'null' - type: array items: $ref: '#/components/schemas/MachineRun/$defs/__schema0' - type: object propertyNames: type: string additionalProperties: $ref: '#/components/schemas/MachineRun/$defs/__schema0' description: >- Supply idempotencyKey in this body or the Idempotency-Key header. If both are present, they must match exactly. The server applies the same key syntax and reserved-prefix restrictions after merging the header. securitySchemes: ConsoleAgentGrant: type: oauth2 description: >- Console-issued bearer credential acquired through the implemented user-claimed service_auth grant or its one-time Console-issued JWT assertion rotation. These are explicitly named specification extensions, not standard authorization-code, client-credentials or device flows. Follow the authoritative auth.md guide; extension support is optional to clients. x-oauth-authorization-server-metadata: https://console.altss.com/.well-known/oauth-authorization-server flows: x-altss-claim: grant_type: urn:workos:agent-auth:grant-type:claim tokenUrl: https://console.altss.com/v1/console/agent-auth/token scopes: company.read: >- Read the eligible Console catalog and the organization's purchased results; request qualified financial-research quotes and explicitly authorized executions, subject to approved channels, current terms, data rights, credential limits and confirmed funding. This scope does not grant unrestricted private data or authorize a purchase. identityUrl: https://console.altss.com/v1/console/agent-auth/identity documentationUrl: https://console.altss.com/auth.md codeChallengeMethods: - S256 description: >- Existing custom user-claimed service flow. Registration alone grants no access; explicit matching-human approval, original verifier and exact resource are required. x-jwt-bearer: grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer tokenUrl: https://console.altss.com/v1/console/agent-auth/token scopes: company.read: >- Read the eligible Console catalog and the organization's purchased results; request qualified financial-research quotes and explicitly authorized executions, subject to approved channels, current terms, data rights, credential limits and confirmed funding. This scope does not grant unrestricted private data or authorize a purchase. documentationUrl: https://console.altss.com/auth.md description: >- Only the short-lived assertion issued by this Console is accepted, once, with its original verifier and resource. It rotates the same principal and does not trust external assertions or implement refresh_token. ConsoleKey: type: http scheme: bearer bearerFormat: opaque description: >- Existing manually created Console credential. It must already grant company.read and the operation's API or MCP channel. The empty OpenAPI security requirement array for this non-OAuth scheme is not a scope exemption. Auth0 account tokens are not accepted. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.