Site HTTP APIs

The NextBento marketing site publishes a small set of HTTP APIs for checkout, health, and IndexNow. Agents can discover them from a single catalog instead of scraping HTML.

The product repo has a larger authenticated API surface (auth, billing, teams, keys). That surface is not hosted on this domain.

Discovery

curl -sI https://www.nextbento.dev/.well-known/api-catalog
curl -s https://www.nextbento.dev/.well-known/api-catalog
curl -s https://www.nextbento.dev/openapi.json

Each catalog entry uses:

• anchor — the API URL
• service-desc — OpenAPI document
• service-doc — this page
• status — /api/health

The homepage also sends RFC 8288 Link headers (api-catalog, service-desc, service-doc, describedby, ai-catalog, ard) so agents do not have to guess these paths.

curl -sI https://www.nextbento.dev/ | grep -i '^link:'

ARD — /.well-known/ai-catalog.json

This origin publishes an Agentic Resource Discovery catalog so registries can index callable resources without scraping HTML.

curl -s https://www.nextbento.dev/.well-known/ai-catalog.json

The document is application/json with Access-Control-Allow-Origin: *. It includes specVersion, a host object, and an entries array. Each entry has a urn:air:www.nextbento.dev:<namespace>:<name> identifier, displayName, IANA type, exactly one of url or data, and 2–5 representativeQueries. Listed resources: the public MCP server card, OpenAPI, the RFC 9727 API catalog, and published SKILL.md files. There is no A2A agent on this origin.

The current spec path /.well-known/ard.json serves the same document.

MCP — /mcp and /.well-known/mcp/server-card.json

This origin publishes an MCP Server Card so agents can discover a public Streamable HTTP server before connecting. The transport endpoint is POST /mcp.

Opening /mcp in a browser returns a short HTML explanation (or Markdown if you send Accept: text/markdown). That GET is for humans and docs links. It is not a JSON-RPC session. This origin does not offer GET Server-Sent Events; MCP clients that request text/event-stream on GET receive 405 and should POST instead.

curl -s https://www.nextbento.dev/.well-known/mcp/server-card.json
curl -s https://www.nextbento.dev/mcp
curl -s https://www.nextbento.dev/mcp -H "Accept: text/markdown"

The card includes serverInfo (name, version), transport.endpoint (/mcp), and capabilities for tools and resources. Tools return marketing facts and docs. This server does not authenticate users or create accounts. Humans still purchase via GET /api/checkout.

Agent Skills — /.well-known/agent-skills/index.json

This origin publishes an Agent Skills Discovery index (v0.2.0) so agents can find SKILL.md files without scraping the repo.

curl -s https://www.nextbento.dev/.well-known/agent-skills/index.json

The index includes $schema and a skills array. Each entry has name, type (skill-md), description, url, and a digest (sha256: + hex of the file bytes). Fetch the url, hash the bytes, and compare before using the skill.

WebMCP

On HTML page load, /webmcp.js registers browser tools with navigator.modelContext.registerTool() (and provideContext() when the user agent still exposes it). Tools: navigate, search_docs, get_product_facts, start_checkout. An AbortController unregisters them on pagehide. This is in-page agent assistance, not account signup.

Checkout — GET /api/checkout

Starts a Stripe Checkout session for the $59 NextBento license and redirects to Stripe. The buyer must supply a GitHub username in Checkout so repo access can be granted after payment.

Not a JSON API: browsers follow the 302. If Stripe is not configured, the origin returns 500 with { "error": "..." }.

Health — GET /api/health

Returns { "status": "healthy", "timestamp": "<ISO-8601>" } when the origin can serve requests. It does not probe Stripe, Resend, or GitHub.

IndexNow — POST /api/indexnow

Submits HTTPS URLs on nextbento.dev / www.nextbento.dev to the IndexNow protocol. Requires header x-indexnow-key matching the origin INDEXNOW_KEY. Do not call this from untrusted clients.

See SEO for the submit script.

Not in the catalog

These exist on the origin but are not third-party APIs:

• POST /api/webhooks/stripe — Stripe → origin only; verify signatures

Related

• API routes in the product repo
• AI Search Discoverability
• RFC 9727
• SEP-1649 MCP Server Cards
• Agent Skills Discovery RFC
• Agentic Resource Discovery