> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Register an extension > Makes a program at an HTTPS address a principal of this home: it may then observe the event stream, transform what the agent assembles, and occupy the slots it claims. **This response carries the registration's secret**, and it is not stored anywhere a read can reach — a caller that loses it rotates rather than re-reads. Requires `extensions:manage`, which is what "the home's owner" means in the mechanism; an ordinary member is answered 403 NRY-0028. The endpoint must be `https://` with no exception, loopback included, and the address it resolves to is judged before anything is stored: a loopback or private address is refused unless an operator wrote that range into this host's configuration, and a link-local, metadata, unspecified, multicast or NAT64-wrapped address is refused with no configuration able to admit it. A second claimant on an exclusive slot is answered 409 NRY-0006 naming the one that already holds it — **unless this host's `[extensions] prefer` configuration already names one of the two contesting registrations as that slot's winner.** That entry is the explicit tie-break, and it is the only thing that admits a second claimant here: without it, no winner may be picked implicitly, so the registration is refused. Where it is present the second registration is stored, the named registration occupies the slot, and the other one stays registered, stays enabled, keeps every other slot it claims and simply stops occupying the contested one. Revoking the occupant returns the slot to the survivor. **A slot this write claims is stored CLAIMED AND UNSERVED (a `model-supplier` given `models` in this body serves them already), and this write reaches the endpoint NOT AT ALL.** A discovery call made here would be signed under the secret this response has not handed over yet. Register in ONE write, take the secret from this response, configure the far side with it, and send `refreshModels: true`. On an enabled row — which is what this write leaves behind unless it asked for otherwise — that update reads `/models` under a secret both sides hold by then, and is the same road that re-reads the list afterwards. **Until that read the slot is claimed and offers no model.** It is in `slots`, `models` is ABSENT — the property is omitted from the response rather than served as an empty array — and no picker, no turn and no spend ceiling can select anything from it: the catalogue skips a claimed-and-unserved row exactly as it skips a disabled one, so nothing half-registered is selectable. What this write still decides is everything this home can decide alone — the arity above, and a 409 for a supplier whose models would answer under a provider name this host's catalogue already carries. Stating `models` on this write is the one way to register a supplier already serving, because those are on the row rather than at the far side. **A `tool-server` slot is stored the same way, for the same reason.** The `/tools` listing a tool name is judged against would be signed under that same unhanded secret, so it is not read here either. The listing is read on the first write that follows under a secret both sides hold — a change whose resulting row is enabled and that moves the `endpoint` or claims the slot — and on the tool sweep's own clock regardless. Until a list is read this home serves none of that registration's tools, and a name it would contest is refused on the write that reads it rather than on this one. An operator install rides this same operation under the plane's operator credential rather than a token carrying `extensions:manage`. A home holding no operator credential — every BYOC and every local deployment — cannot authenticate such a caller at all. ## OpenAPI ````yaml /pt/openapi/v3-current/narya.yaml post /v1/extensions openapi: 3.1.0 info: title: Narya Host API version: 1.0.0 description: >- The contract between the Narya host and every client. One long-lived host serves this API over a Unix socket in your Narya home. The terminal client and the one-shot command that Lerian ships drive this API, and a client you write drives the same one. Requests authenticate with a bearer token issued by the identity provider the host is configured with. An operation that declares another security scheme also accepts that credential. A request without a valid credential gets 401 with NRY-0011. A caller whose role lacks the permission an operation needs gets 403 with NRY-0028. Submitting a message returns 202 with a turn id. Everything the turn produces streams over GET /v1/events as server-sent events with a typed envelope, and a stream resumes from a Last-Event-ID header. One error envelope: code, title and message. Codes are NRY- followed by four digits. Cursors are opaque. servers: [] security: - bearerAuth: [] tags: - name: host description: The host process itself — version, uptime, mode, store. - name: sessions description: Durable conversation containers. Archive, never destroy. - name: messages description: Submitting work into a session and interrupting it. - name: events description: The server-sent event stream every client consumes. - name: lanes description: Parallel tracks inside a session — main, subagent, side. - name: agents description: Named recipes — instructions, tools, model, policy. Read-only in v1. - name: ladder description: >- What a person can type: the skills and command files in force for one repository, and expanding one into text. Five origins merged, nearest winning a name, the repository's own rungs gated on trust. - name: permissions description: Pending permission asks, decisions, and the decision audit. - name: intercom description: Sessions on one machine finding and messaging each other. - name: packages description: The one thing a user installs — resources, Go code, or both. - name: extensions description: >- Host-side extensions and the operations each exposes over the wire. This is the generic lane a host extension uses to serve its own client half (a TUI component, a web panel) or any API-only consumer, without adding routes to this contract. - name: workflows description: Deterministic multi-agent orchestration runs. - name: providers description: Model suppliers, their auth state, and the model catalogue. - name: monitors description: >- Long-running watchers a session keeps beside its conversation — a test runner in watch mode, a build, a log being followed. Started by the model or by the person, always listed, always killable. - name: records description: The queryable local record of everything that happened. - name: environments description: >- Where a session's code lives and its commands run — this machine, or a container narya operates. A session that names none runs here. - name: schedules description: >- Work the host's own clock starts with nobody present — a repository, a prompt, a rule and what one fire may spend. Cancel, never destroy. - name: sharing description: >- Publishing a session from a developer's own home to the organisation's, and what is held back before a byte leaves the machine. - name: refinements description: >- What this owner has taught narya and allowed it to keep — distilled facts, and the skills, agents and commands the model wrote for itself. Propose, read, consent, roll back. Nothing here fires until a person answers. - name: platform description: >- Calls Lerian's control plane made to a home it hosts, as this home recorded them. paths: /v1/extensions: post: tags: - extensions summary: Register an extension description: >- Makes a program at an HTTPS address a principal of this home: it may then observe the event stream, transform what the agent assembles, and occupy the slots it claims. **This response carries the registration's secret**, and it is not stored anywhere a read can reach — a caller that loses it rotates rather than re-reads. Requires `extensions:manage`, which is what "the home's owner" means in the mechanism; an ordinary member is answered 403 NRY-0028. The endpoint must be `https://` with no exception, loopback included, and the address it resolves to is judged before anything is stored: a loopback or private address is refused unless an operator wrote that range into this host's configuration, and a link-local, metadata, unspecified, multicast or NAT64-wrapped address is refused with no configuration able to admit it. A second claimant on an exclusive slot is answered 409 NRY-0006 naming the one that already holds it — **unless this host's `[extensions] prefer` configuration already names one of the two contesting registrations as that slot's winner.** That entry is the explicit tie-break, and it is the only thing that admits a second claimant here: without it, no winner may be picked implicitly, so the registration is refused. Where it is present the second registration is stored, the named registration occupies the slot, and the other one stays registered, stays enabled, keeps every other slot it claims and simply stops occupying the contested one. Revoking the occupant returns the slot to the survivor. **A slot this write claims is stored CLAIMED AND UNSERVED (a `model-supplier` given `models` in this body serves them already), and this write reaches the endpoint NOT AT ALL.** A discovery call made here would be signed under the secret this response has not handed over yet. Register in ONE write, take the secret from this response, configure the far side with it, and send `refreshModels: true`. On an enabled row — which is what this write leaves behind unless it asked for otherwise — that update reads `/models` under a secret both sides hold by then, and is the same road that re-reads the list afterwards. **Until that read the slot is claimed and offers no model.** It is in `slots`, `models` is ABSENT — the property is omitted from the response rather than served as an empty array — and no picker, no turn and no spend ceiling can select anything from it: the catalogue skips a claimed-and-unserved row exactly as it skips a disabled one, so nothing half-registered is selectable. What this write still decides is everything this home can decide alone — the arity above, and a 409 for a supplier whose models would answer under a provider name this host's catalogue already carries. Stating `models` on this write is the one way to register a supplier already serving, because those are on the row rather than at the far side. **A `tool-server` slot is stored the same way, for the same reason.** The `/tools` listing a tool name is judged against would be signed under that same unhanded secret, so it is not read here either. The listing is read on the first write that follows under a secret both sides hold — a change whose resulting row is enabled and that moves the `endpoint` or claims the slot — and on the tool sweep's own clock regardless. Until a list is read this home serves none of that registration's tools, and a name it would contest is refused on the write that reads it rather than on this one. An operator install rides this same operation under the plane's operator credential rather than a token carrying `extensions:manage`. A home holding no operator credential — every BYOC and every local deployment — cannot authenticate such a caller at all. operationId: registerExtension requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ExtensionRegistration' responses: '201': description: >- The registration, with its secret. The secret appears here and in the rotation's response and nowhere else, ever. content: application/json: schema: $ref: '#/components/schemas/ExtensionRegistered' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': description: >- The caller's role does not carry `extensions:manage` (NRY-0028), or an operator install named an endpoint the hosted configuration does not. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- This home already registers that name (NRY-0004), or the registration claims an exclusive slot somebody else holds (NRY-0006, naming both) with no `[extensions] prefer` entry naming which of the two occupies it, or it would sit at the same position as another registration on a decision point they share (NRY-0004, naming both and the point). A tool name this host already serves is refused on the write that reads the `/tools` listing, and never on this one, which reads no listing. The order extensions run in is the owner's and is declared, so a tie is an order nobody declared: two extensions rewriting one tool call compose, and which goes first decides what the other is handed. A tool name has one owner for the same reason: there is never an implicit winner, and a source cannot take a name by registering. content: application/json: schema: $ref: '#/components/schemas/Error' '413': $ref: '#/components/responses/RequestBodyTooLarge' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalServerError' components: schemas: ExtensionRegistration: type: object description: A request to make a program at an address a principal of this home. required: - name - endpoint properties: name: type: string description: Namespaced name, publisher/extension form. pattern: ^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$ endpoint: type: string format: uri description: >- Where this host calls it. `https://` with no exception, loopback included — a developer terminating TLS locally is one command, and a leaked secret is not one command back. description: type: string maxLength: 500 points: type: array description: The decision points to sit on. items: type: string slots: type: array description: >- The slots to occupy. A slot claimed here is stored CLAIMED AND UNSERVED (a `model-supplier` given `models` in this body serves them already): this write reaches the endpoint not at all, because a call made here would be signed under a secret the caller has not been given yet. For `model-supplier`, send `refreshModels: true` once the far side holds the secret and the list is read on that update so long as the row it produces is enabled; until it is read, the slot offers no model to any turn. For `tool-server`, this registration reads no `/tools` listing: the first LATER update whose resulting row is enabled and that moves the endpoint, newly claims the slot or switches on a row already holding it reads it, and so does the tool sweep on its own clock; until it is read this home serves none of that registration's tools, and a tool name this home already holds is refused on the update that reads the listing. items: type: string position: type: integer description: Where in the ordered pipeline. Defaults to 0. grants: type: array description: Permission slugs to grant ON this registration. items: type: string models: type: array description: >- What this extension serves, if it occupies a supplier slot. Stating it here is the one way to register a supplier already SERVING, because these are on the row rather than at the far side. Leaving it out stores the slot claimed and unserved until an enabled update carrying `refreshModels`, or one moving the `endpoint`, reads the endpoint's catalogue. items: $ref: '#/components/schemas/ExtensionModel' enabled: type: boolean description: Whether it starts enabled. Defaults to true. examples: - name: lerian/redactor endpoint: https://redactor.example.com/narya points: - before-model-request slots: - tool-definitions position: 10 ExtensionRegistered: type: object description: >- A registration and the secret it was minted with. **The only other response in this contract that carries a secret is the rotation's.** required: - extension - secret properties: extension: $ref: '#/components/schemas/Extension' secret: type: string description: >- The shared secret, shown exactly once. The host signs its outbound calls under it and so does the extension when it calls back. It is stored sealed and no read path in this contract can produce it again; a caller that loses it rotates. Error: type: object description: >- The single error envelope every operation returns. Codes are NRY- followed by four digits and are catalogued in the top-level x-error-catalog extension. required: - code - title - message properties: code: type: string pattern: ^NRY-[0-9]{4}$ description: Machine-readable error code from the NRY catalogue. title: type: string maxLength: 256 description: Short human-readable summary of the error class. message: type: string maxLength: 4096 description: Specific, actionable description of what went wrong. fields: type: object description: Per-field validation problems. additionalProperties: type: string examples: - code: NRY-0002 title: Session not found message: >- No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host. ExtensionModel: type: object description: >- One model a registered supplier serves. Stored on the registration rather than asked for per turn, because narya's catalogue holds no entry for a model it has never heard of. required: - id properties: id: type: string description: The id the endpoint itself accepts, with no "/" in it. maxLength: 128 name: type: string description: The label a picker shows. Absent falls back to the id. maxLength: 128 contextWindow: type: integer minimum: 0 maxOutput: type: integer minimum: 0 pricing: allOf: - $ref: '#/components/schemas/ExtensionModelPricing' description: >- What the model costs. **A model registered without it is refused**, and this is optional in the schema rather than required for that very reason: a required object arrives as a value that cannot be absent, so "no price" would reach the server indistinguishable from a price of zero — which means free. Absent means unknown and is refused; zero is a price and is accepted. Extension: type: object description: >- An extension this host carries: a program this home REGISTERED at an HTTPS address. Never its secret, on any response that uses this schema. `package` is absent on a registered extension, which has no package — it is another deployment rather than anything installed here. required: - name properties: name: type: string description: Namespaced name, publisher/extension form. pattern: ^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$ package: type: string description: >- The installed package that carries this extension. Absent for a registered extension, which has no package. description: type: string maxLength: 500 operations: type: array description: Operations invokable via POST /v1/extensions/{name}/invoke. items: type: object required: - name properties: name: type: string maxLength: 128 description: type: string maxLength: 500 endpoint: type: string format: uri description: The HTTPS address this host calls. points: type: array description: The decision points this extension sits on. items: type: string slots: type: array description: The slots it occupies. items: type: string position: type: integer description: Where it sits in the ordered pipeline, lowest first. grants: type: array description: >- The permission slugs granted ON this registration. An extension reaches every unmarked session in its home; a private one only where `sessions:read-private` is granted here. items: type: string models: type: array description: >- What a registered supplier serves. Absent unless the extension occupies a supplier slot — and absent there too while that slot is CLAIMED AND UNSERVED. A supplier with nothing here offers nothing to any turn: the catalogue skips such a row exactly as it skips a disabled one, so a slot nobody has served yet is not selectable and not a provider anybody sees. items: $ref: '#/components/schemas/ExtensionModel' servingTools: type: boolean description: >- Whether this home is serving the tools this registration publishes RIGHT NOW — that is, whether a model in this home can call them. Present on every extension that occupies the `tool-server` slot and absent on every one that does not, because it is a fact about that claim and about nothing else. It is false far more often than an owner expects, and that is the reason this field exists. The write that registers a tool server reaches the endpoint not at all, so the slot is stored CLAIMED AND UNSERVED and stays that way until a sweep has read the endpoint's tool listing; and a listing whose names collide with tools this home already serves is refused by the tool registry, which leaves the registration standing and publishing nothing. It is the last answer this home RECORDED, never a guess made at read time, so it survives a restart: a home brought back up under a standing collision still says it is refusing those tools rather than reporting them unread. notServingBecause: type: string description: >- Why this home is not serving that registration's tools, in this host's own words — never a sentence the far side wrote. Present exactly when `servingTools` is false, and absent when it is true, because a reason for something that is not the case would be the two fields disagreeing. It can say: that no sweep of this home has read the listing yet (every claim starts here, and a host built without a registered-extension pool stays here); that the tool registry refused the listing because another source already owns one of those names, naming both claimants; that the endpoint could not be reached or would not answer; that the listing carried no tool this host can serve; or that the owner has the registration switched off. enabled: type: boolean description: >- The owner's switch. A disabled registration is still listed, and still says where it pointed, because a registry that hid one would answer "what reads our conversations" with less than the truth. installedByOperator: type: boolean description: >- True when Lerian installed this on a home Lerian hosts, without the owner's act. It travels on every read because it is the notice standing where consent would otherwise be: a member can always tell which extensions are theirs and which are Lerian's. registeredBy: type: string description: >- The subject of the verified token that registered it. Absent on an operator install, where there is no person to name. registeredAt: type: string format: date-time examples: - name: lerian/redactor endpoint: https://redactor.example.com/narya points: - before-model-request - after-tool-call slots: - tool-definitions position: 10 grants: - sessions:read-private enabled: true installedByOperator: false registeredBy: user_01J8XQ registeredAt: '2026-09-17T10:04:00Z' ExtensionModelPricing: type: object description: >- What a model costs, in US dollars per million tokens, carried through unconverted so a value here reads against a published price page without arithmetic. **A model registered without one is refused, and zero is a price.** Absent means unknown, and a turn on an unpriced model reports no cost at all. A model that is genuinely free says so by carrying zeros. The field is OPTIONAL in `ExtensionModel` rather than required, and that is what makes the refusal reachable: a required object generates as a value that cannot be absent, so an omitted price would arrive indistinguishable from a price of zero and be stored as free. required: - input - output properties: input: type: number format: double minimum: 0 output: type: number format: double minimum: 0 cacheRead: type: number format: double minimum: 0 cacheWrite: type: number format: double minimum: 0 responses: BadRequest: description: Malformed request — invalid parameter, cursor, or JSON body. content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: >- Authentication required — a request carrying no valid identity token (NRY-0011). content: application/json: schema: $ref: '#/components/schemas/Error' RequestBodyTooLarge: description: >- The request body weighs more than this operation accepts (NRY-0024). The host holds one ceiling per operation and refuses at the door, in front of every handler: a body whose declared Content-Length is past the ceiling is refused before a byte of it is read, and a body that declares no length is read only as far as the ceiling and refused there. Nothing was read past that point and nothing was written. content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: The request was well-formed but failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: The host failed — including a store that refuses writes (NRY-0012). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation. ````