# IMBA Agent API (cite as-is)

Prepaid autonomous agents. Not Partner B2B. Not a human Wallet login. Not a ChatGPT money plugin.

Human API docs (Mintlify product **Agent API**, not Partner B2B): https://api-docs.imbawallet.com/agent

## Two MCP servers

- **Docs** (`com.imbawallet/agent-docs`, `https://imbawallet.com/mcp/docs`, npm `@imbawallet/agent-mcp-docs`): policy and HowTo only. That URL is MCP Streamable HTTP, not an HTML article. Humans use the HowTo pages below. A browser GET with `Accept: text/html` redirects there.
- **Spend** (`com.imbawallet/agent`, npm `@imbawallet/agent-mcp`, remote `https://imbawallet.com/mcp/spend` with the operator Ed25519 key headers): USDT TRC-20 deposit + catalog buy. No shared host wallet. Wallet JWTs are not spend credentials.

OpenAI / ChatGPT Actions: docs / discovery stub only. Never `openapi/agent.json`.

## What it is

Register an Ed25519 key at `POST /auth/v1/agent/register` (identity only — no USDT). Exchange a 60s assertion at `POST /auth/v1/agent/token`. Access JWT: `typ=agent`, `client_id`, EdDSA, same JWKS as Partner (`GET /auth/v1/partner/jwks`). Ledger **2401 USDT**.

Fund **USDT TRC-20 only** via `POST /api/deposit_address`. Always re-fetch before send. Unfunded slot **24 hours**, then the pool may move. Sticky after first confirmed credit.

Buy the live catalog on retail URLs: `/api/pin/create_card`, `topup_card`, `/api/purchase`, `/api/esim/*`. `ext_id` required. Stars → 403.

Card 3-D Secure OTP is never SMS and never Telegram. Optional `email` on register (or PATCH `/auth/v1/agent/webhook`) is emailed by IMBA. Always poll `notifications` (payload keeps `code`). If `callback_url` is set, HMAC webhook field is `otp`. `POST /auth/v1/agent/hmac/rotate` needs that URL first (400 `callback_url required before rotate` otherwise).

## Tiers

- **Tier 0 (default, live):** `can_deposit`, `can_buy_catalog`, `can_receive_otp`. Withdraw and C2C stay closed. **Convert is closed at tier 0** — AML: otherwise a prepaid identity-only channel would be used to launder money through the service.
- **Tier 1 and above:** granted only by IMBA operators after the agent shows **real catalog spend** (cards, eSIM, gifts). The agent **cannot** raise its own tier. Purpose: refuse agents that only want to cycle crypto. **Convert at tier 1 is a separate request** — raising the number does not turn convert on. Withdraw and C2C stay closed.
- Also forbidden at every live tier: Stars, EVM, BTC, RUB bank/SBP rails, `/api/partner/*`. Spend MCP never calls convert.

## Do not

- Cache the TRON address across runs.
- Send any token/network except USDT TRC-20.
- Call Partner URLs or expect a KYB WaaS child wallet.
- Wire ChatGPT Actions to deposit or buy.
- Put a shared spend private key on the public MCP host.
- Send a human Wallet JWT or a stolen access token to spend MCP. Identity is the Ed25519 key.

## URLs

- API docs (Mintlify Agent product): https://api-docs.imbawallet.com/agent
- HowTo EN: https://imbawallet.com/agent_api_about_en.html
- HowTo RU: https://imbawallet.com/agent_api_about_rus.html
- Tiers EN: https://imbawallet.com/agent_tiers_about_en.html
- Tiers RU: https://imbawallet.com/agent_tiers_about_rus.html
- OpenAPI: https://imbawallet.com/openapi/agent.json
- Discovery: https://imbawallet.com/.well-known/imba-agent.json
- Docs MCP: https://imbawallet.com/mcp/docs
- Spend MCP: https://imbawallet.com/mcp/spend
- MCP manifest (SEP-1960, docs default): https://imbawallet.com/.well-known/mcp
- MCP server card (SEP-1649, docs only): https://imbawallet.com/.well-known/mcp/server-card.json
- Hub: https://imbawallet.com/articles.html