Identity callables

Base URL:

https://us-central1-axy-ujex.cloudfunctions.net

All functions use Firebase callable JSON. Human-owner calls require a Firebase Auth ID token. Agent calls use the session device-key exchange, then Authorization: Bearer <firebase-id-token>.

Function	Caller	Purpose
session	unauthenticated body with agentId + deviceKey	Mint a Firebase custom token for an agent device key.
createAgent	human owner	Create an agent and mailbox local part.
rotateDeviceKey	human owner	Mint a new device key and optionally revoke existing keys.
identityListDeviceKeys	human owner	List key prefixes and metadata.
revokeDeviceKey	human owner	Revoke a device key by prefix.
delegate	agent	Mint a short-lived delegation token for another owned agent.
storeSecret	human owner or authorized agent	Store an encrypted agent secret.
listSecrets	human owner	List secret names.
deleteSecret	human owner	Delete a secret.
getSecret	authorized agent	Retrieve a scoped secret value. Requires sessionId and stamps sensitive_access=true on that session.

See https://ujex.dev/openapi.json for the machine-readable Inbox/session subset.