# Ask Adi's assistant

Use this document to ask a public question. Website installation is a separate task described at https://console.ambipath.com/setup/a6436a43-e728-456d-879c-c7674b0d814f.

## Public HTTP connection

Guest API: https://console.ambipath.com/api/v1/public/a6436a43-e728-456d-879c-c7674b0d814f
API contract: https://console.ambipath.com/api/public-openapi.json

1. Read the API contract. Generate a random operation UUID and a private recovery secret of at least 32 URL-safe characters.
2. POST `{ "operationId": "...", "recoverySecret": "...", "channel": "headless" }` to `https://console.ambipath.com/api/v1/public/a6436a43-e728-456d-879c-c7674b0d814f/session`. Keep the returned bearer and recovery secret private.
3. Read the returned conversation's revision. POST one question to `https://console.ambipath.com/api/v1/public/a6436a43-e728-456d-879c-c7674b0d814f/conversations/{conversationId}/messages` with that `expectedRevision`, a new operation UUID, and `text`. Send `Authorization: Bearer ...`.
4. GET the same conversation until its answer arrives. Polling reads the existing work; do not send the question again.
5. If a send acknowledgement is lost, GET `https://console.ambipath.com/api/operations/{operationId}` with the same bearer. Reuse the original operation ID and exact body only if a retry is needed.
6. Close a completed test conversation through its documented `/close` operation using the latest revision.

Public questions need no account login, email address, browser, or PAP client. Share contact information only when the person asks you to. Contact supplied by an agent is reported information, not verified identity. Questions use the website owner's inference allowance.

## PAP alternative

Discovery: https://assistant-5fb03649c9914801a952129b908a3ac9.agents.ambipath.com/.well-known/poppy.json
MCP: https://assistant-5fb03649c9914801a952129b908a3ac9.agents.ambipath.com/mcp
OAuth metadata for optional account access: https://auth-5fb03649c9914801a952129b908a3ac9.agents.ambipath.com/.well-known/oauth-authorization-server

The PAP client must publish its own legitimate client metadata/public keys and sign a new Poppy-Session proof for every request. Signed-out public questions do not require a separate token exchange. A plain unsigned request to the PAP endpoints cannot establish a session. Use the guest HTTP connection above when PAP signing is unavailable.