# AIST

> AIST turns a business task into finished brand video: it builds a Brand Brain from your sources, writes three directions, turns the chosen one into a production-ready story and renders it. Agents drive it over REST (source of truth) or MCP (same actions as tools).

## Connect your agent

**Already have an API key?** Skip to step 3 and verify it with the authenticated
requests below. If they succeed, reuse that connection.

### 1. No key: request one link

```http
POST https://aist.solutions/api/v1/connect/requests
Content-Type: application/json

{"agentName": "ChatGPT Codex"}
```

No authorization is needed for this POST. Keep `pollUrl` and `pollToken` from
the response privately. Give the account owner `humanUrl` and ask them to
sign in and approve access. The link is valid for 60 minutes (`expiresAt`).

### 2. Wait for the owner's decision

Call the exact `pollUrl` from the POST response every 5–10 seconds:

```http
GET <pollUrl>
Authorization: Bearer <pollToken>
```

- `pending` does not mean the owner has signed in or granted access. Keep
  waiting; opening the link and signing in do not approve the request.
- `issued`: save `apiKey` in your secret manager immediately. It is returned only once,
  on the first poll after approval; later polls return `issued` with no key.
- `declined` or `expired`: stop polling and report that outcome to the owner.
  Do not create another request automatically.

Polling requires the POST response's `pollToken`, not an API key or browser
session. No token gives 401 `unauthorized`; a wrong token gives 404 `not_found`
to avoid disclosing another request. That 404 does not prove the request was lost.
Poll promptly after approval: an approved connection whose key was never
collected is revoked once `expiresAt` plus 15 minutes passes.

### 3. Verify access and restore context

With your existing or newly saved key, call these in order:

```http
GET https://aist.solutions/api/v1/last-activity
Authorization: Bearer <apiKey>
```

```http
GET https://aist.solutions/api/v1/me
Authorization: Bearer <apiKey>
```

Successful authenticated responses confirm access. Read `resume`, capabilities
and limits before doing work. Never paste `apiKey` or `pollToken` into chat.


## Docs

- [Documentation index](https://aist.solutions/docs/index.md): every agent-facing guide
- [Connect — request access and verify the connection](https://aist.solutions/docs/connect.md)
- [Quickstart — from API key to the first video](https://aist.solutions/docs/quickstart.md)
- [Workflow — states, nextAction and polling](https://aist.solutions/docs/workflow.md)
- [Brand Brain — sources, files, facts, products, taste](https://aist.solutions/docs/brand-brain.md)
- [Policies and limits — capabilities, budget, approvals](https://aist.solutions/docs/policies-and-limits.md)
- [Promo codes — trial credits and video downloads without a card](https://aist.solutions/docs/promo-codes.md)
- [OAuth 2.1 — discovery, registration, PKCE, tokens](https://aist.solutions/docs/oauth.md)
- [MCP — remote server over Streamable HTTP](https://aist.solutions/docs/mcp.md)
- [Webhooks — events, signature, retries](https://aist.solutions/docs/webhooks.md)
- [Errors — codes and what to do](https://aist.solutions/docs/errors.md)

## Machine-readable

- [OpenAPI](https://aist.solutions/openapi.json): REST contract for /api/v1
- [MCP server](https://aist.solutions/mcp): Streamable HTTP, Bearer API key or OAuth
- [OAuth resource metadata](https://aist.solutions/.well-known/oauth-protected-resource)
- [OAuth server metadata](https://aist.solutions/.well-known/oauth-authorization-server)

## Optional

- [Complete context](https://aist.solutions/llms-full.txt): all guides in one response