> ## Documentation Index
> Fetch the complete documentation index at: https://docs.altss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quote qualified company research

> Quote a qualified Company Intelligence product by its exact toolId. Reads no company data and charges nothing. Show the returned plan, price, maximum and complete useTerms (permitted uses, storage, caching, retention, attribution, training restrictions and incorporated agreements) to the customer before calling altss_run. Requires the API channel and company.read. The input object is tool-specific; the runtime validates eligibility and use rights. Quoting does not authorize execution.



## OpenAPI

````yaml /console-openapi.json post /v1/console/quote
openapi: 3.1.1
info:
  title: Altss Console machine API
  version: '2026-11-11'
  description: >-
    A separate description of the deployed protected Console REST, MCP and
    agent-authorization interfaces. The public website and documentation readers
    remain anonymous and are described separately. company.read is necessary but
    not sufficient: approved channels, verified tenant admission, current terms,
    per-tool eligibility, data rights, spending limits, explicit purchase
    approval and confirmed funding remain enforced. OAuth grant extensions below
    describe implemented protocols; generic OpenAPI tools may ignore extensions
    and cannot infer an authorization-code or device flow.
  x-altss-source-commit: d2432ba2f34a58ed7936598fb5b42dfbf50c6637
servers:
  - url: https://console.altss.com
security: []
tags:
  - name: Console REST
  - name: Console MCP
  - name: Console authorization
externalDocs:
  url: https://console.altss.com/auth.md
  description: Authoritative Console authorization and human-approval guide
paths:
  /v1/console/quote:
    post:
      tags:
        - Console REST
      summary: Quote qualified company research
      description: >-
        Quote a qualified Company Intelligence product by its exact toolId.
        Reads no company data and charges nothing. Show the returned plan,
        price, maximum and complete useTerms (permitted uses, storage, caching,
        retention, attribution, training restrictions and incorporated
        agreements) to the customer before calling altss_run. Requires the API
        channel and company.read. The input object is tool-specific; the runtime
        validates eligibility and use rights. Quoting does not authorize
        execution.
      operationId: quoteConsoleResearch
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineQuote'
      responses:
        '200':
          description: >-
            Current quote and complete use terms. Preserve the returned quote
            unchanged for an explicitly authorized run. The response is
            intentionally extensible.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '400':
          description: >-
            Invalid request, unsupported operation or invalid grant; response
            shape depends on the transport.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '401':
          description: >-
            Missing, malformed, unknown, revoked or wrong-channel credential.
            These failures are deliberately indistinguishable.
          headers:
            WWW-Authenticate:
              schema:
                type: string
              description: >-
                Plain Bearer for REST; the canonical MCP endpoint includes the
                exact MCP protected-resource metadata URL.
        '403':
          description: >-
            Current account, organization, permission, data-rights or other
            authorization checks deny this request.
        '429':
          description: Rate limit exceeded. Do not retry rapidly.
        '503':
          description: >-
            Unavailable or uncertain outcome. For a paid run, preserve the
            idempotency key and inspect the run; do not assume no charge
            occurred.
      security:
        - ConsoleAgentGrant:
            - company.read
        - ConsoleKey: []
components:
  schemas:
    MachineQuote:
      $schema: https://json-schema.org/draft/2020-12/schema
      type: object
      properties:
        toolId:
          type: string
          enum:
            - company.dossier
            - company.financial_research
        input:
          type: object
          propertyNames:
            type: string
            minLength: 1
            maxLength: 200
          additionalProperties: 0cf92964-e150-4bd3-ad22-d38926a35c0c
          description: >-
            JSON object. The server additionally enforces at most 4096 value
            nodes, depth 16 and 65536 UTF-8 bytes, plus the selected tool's
            semantic validation. These structural refinements are not fully
            expressible in this JSON Schema.
      required:
        - toolId
        - input
      additionalProperties: false
      $defs:
        __schema0:
          anyOf:
            - type: string
            - type: number
            - type: boolean
            - type: 'null'
            - type: array
              items:
                $ref: '#/components/schemas/MachineQuote/$defs/__schema0'
            - type: object
              propertyNames:
                type: string
              additionalProperties:
                $ref: '#/components/schemas/MachineQuote/$defs/__schema0'
  securitySchemes:
    ConsoleAgentGrant:
      type: oauth2
      description: >-
        Console-issued bearer credential acquired through the implemented
        user-claimed service_auth grant or its one-time Console-issued JWT
        assertion rotation. These are explicitly named specification extensions,
        not standard authorization-code, client-credentials or device flows.
        Follow the authoritative auth.md guide; extension support is optional to
        clients.
      x-oauth-authorization-server-metadata: https://console.altss.com/.well-known/oauth-authorization-server
      flows:
        x-altss-claim:
          grant_type: urn:workos:agent-auth:grant-type:claim
          tokenUrl: https://console.altss.com/v1/console/agent-auth/token
          scopes:
            company.read: >-
              Read the eligible Console catalog and the organization's purchased
              results; request qualified financial-research quotes and
              explicitly authorized executions, subject to approved channels,
              current terms, data rights, credential limits and confirmed
              funding. This scope does not grant unrestricted private data or
              authorize a purchase.
          identityUrl: https://console.altss.com/v1/console/agent-auth/identity
          documentationUrl: https://console.altss.com/auth.md
          codeChallengeMethods:
            - S256
          description: >-
            Existing custom user-claimed service flow. Registration alone grants
            no access; explicit matching-human approval, original verifier and
            exact resource are required.
        x-jwt-bearer:
          grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
          tokenUrl: https://console.altss.com/v1/console/agent-auth/token
          scopes:
            company.read: >-
              Read the eligible Console catalog and the organization's purchased
              results; request qualified financial-research quotes and
              explicitly authorized executions, subject to approved channels,
              current terms, data rights, credential limits and confirmed
              funding. This scope does not grant unrestricted private data or
              authorize a purchase.
          documentationUrl: https://console.altss.com/auth.md
          description: >-
            Only the short-lived assertion issued by this Console is accepted,
            once, with its original verifier and resource. It rotates the same
            principal and does not trust external assertions or implement
            refresh_token.
    ConsoleKey:
      type: http
      scheme: bearer
      bearerFormat: opaque
      description: >-
        Existing manually created Console credential. It must already grant
        company.read and the operation's API or MCP channel. The empty OpenAPI
        security requirement array for this non-OAuth scheme is not a scope
        exemption. Auth0 account tokens are not accepted.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.