Discover
Read the public capability document or OpenAPI spec. These endpoints need no account, token, or API key.
Developers & AI agents
Connect to AIOD without guessing the contract.
Start with zero-auth service discovery, then connect an MCP client through OAuth 2.1 to work with discounts on one authorized Shopify store.
$ curl https://www.aiodapp.com/api/v1/agent-capabilities
# No API key required for discovery
# Store actions continue through OAuth-protected MCP
Authorize
Give your MCP client the server URL. OAuth 2.1 with PKCE opens Shopify authorization for the single store you choose.
Test safely
Draft without creating anything, or publish in test mode for the store's test email. The MCP server cannot make a discount live or delete it.
Public REST discovery
Small, versioned, and typed.
The REST surface describes how to connect. Store-specific reads and writes stay behind the MCP server and its aiod:discounts scope.
GET
/api/v1/health Verify that the public discovery API is available.
GET
/api/v1/agent-capabilities Discover the MCP endpoint, OAuth metadata, supported protocol revisions, capabilities, and safety limits.
GET
/openapi.json Read the OpenAPI 3.1 contract, schemas, OAuth scope, and versioning policy.
GET
/.well-known/mcp/server-card.json Read AIOD's experimental MCP Server Card and remote connection details.
GET
/.well-known/api-catalog Discover the REST and MCP surfaces through an RFC 9727 Linkset.
GET
/.well-known/ard.json Discover AIOD's API, MCP server, and agent skill through ARD.
GET
/.well-known/agent-skills/index.json Find AIOD's reusable Shopify discount skill and Agent Plugin bundle.
Protected MCP service
One URL for compatible clients
https://aiod-automatic-discount.com/mcp - Transport
- Stateless Streamable HTTP, POST only
- Authentication
- OAuth 2.1 authorization code flow with PKCE (S256)
- Permission
aiod:discounts- Access
- Self-serve connection for installed stores; AIOD also has a free plan.
Versioning and deprecation
Stable REST discovery endpoints use a major version in the URL, beginning with /api/v1/. Breaking contract changes ship under a new major path.
When AIOD schedules an endpoint retirement, responses will use the standardized Deprecation header and, once a removal date exists, the Sunset header. Unversioned URLs remain compatibility aliases today.