Build with Nov Pax.
A small, stable public API for agents and developers. Start without credentials, discover every operation from one OpenAPI document, and rely on structured JSON errors when a request cannot be completed.
Quickstart, one request.
The public surface lives at https://www.novpax.org/api/v1 and returns JSON.
curl --fail-with-body \
https://www.novpax.org/api/v1/healthBegin with the API index when an agent needs to choose an operation. The canonical OpenAPI specification carries unique operation IDs, closed request objects, typed responses, error schemas, and policy links.
Public operations.
/api/v1
Discover the stable public surface.
/api/v1/health
Check service liveness without authentication.
/api/v1/waitlist/stats
Read live or explicitly marked fallback signup totals.
/api/v1/contact
Send a validated contact message.
/api/v1/downloads/sanctuary-desktop
Resolve the current Windows installer URL.
/api/v1/sandbox/echo
Validate a request safely without persistence.
Authentication and API keys.
Public API v1 requires no API key.
Do not send Sanctuary session cookies or personal access tokens to these endpoints. The public contract is intentionally read-mostly; contact delivery is its only external side effect. Account data and Sanctuary's private product APIs are not part of this surface. There is currently no API-key console because v1 has no key-protected operation.
Webhooks and MCP
Nov Pax Public API v1 exposes no webhooks and no MCP server. Agents should use the versioned REST operations and OpenAPI contract directly; this page will name and link either surface if that product boundary changes.
Errors agents can act on
Non-success responses use JSON with error plus errorDetails.code, message, and a resolution hint. Unsupported methods return JSON and an Allow header. The RFC 9727 API catalog is the canonical machine-discovery entry point.
Sandbox, without persistence.
Use POST /api/v1/sandbox/echo to test JSON generation and response parsing. The endpoint validates a short message and optional string metadata, echoes the accepted payload, and stores nothing.
curl --fail-with-body \
-H "Content-Type: application/json" \
-d '{"message":"Hello from an agent"}' \
https://www.novpax.org/api/v1/sandbox/echoVersioning and deprecation.
Major API versions are explicit URL segments: /api/v1, then /api/v2.
Additive, compatible fields may ship within a major version. Breaking changes require a new major path. The complete Nov Pax API lifecycle policyis published at a stable URL. Nov Pax provides at least 90 days of notice before a public major version is retired. A deprecated response carries Deprecation and a Link with rel="deprecation"; a scheduled removal also carries Sunset. The old version remains documented during that window.
Rate limits
API responses expose RateLimit-Policy and RateLimit structured fields. A throttled request returns HTTP 429 with Retry-After. Agents should honor that delay and use jittered backoff rather than retrying in a tight loop.
Official CLI.
The official npm package is @novpax/cli.
npm install --global @novpax/cli
novpax status
novpax sandbox "Hello from an agent"The CLI is a thin client over the same versioned HTTP contract; use --jsonfor scripts and --base-url for a local or approved test deployment. Registry availability follows the package release, while OpenAPI and direct HTTPS remain the authoritative integration paths.
Agent-specific fit guidance lives in agent-instructions.txt. The curated llms.txt file lists this portal and every machine resource by name so crawlers can recover the integration surface from one predictable URL.