Tillpad

Start zero-human onboarding from an email address. Does not charge. Step 1: call with email. The result has verificationRequired=true and a 6-digit code is emailed to that address (10 minutes, single use), whether or not an account exists. Step 2: call again with email and code. Returns bootstrapToken, accountId, expiresIn, next, and machinePay (url, sku, amount). When you have no tp_ key yet, use REST POST /api/agents/bootstrap instead. The MCP endpoint requires Authorization: Bearer tp_… before any tool runs. After bootstrap, call manage_billing action=machine_pay, or POST /api/billing/machine-pay with Authorization: Bearer bootstrapToken. Use create_api_key afterward to mint run or sub keys from the resulting account tp_ key. No quota spend. Former name: agent_bootstrap.

Email Tillpad support from a Pro account. Sends subject and message to the Tillpad team. Replies go to the account email. Returns {ok:true}. Requires an active Pro subscription. Checks ACL support_contact with no quota spend. Does not change billing, storage, or inboxes.

Mint a run or sub API key from the calling account tp_ key. Requires kind=account on the caller and an active plan. Writes a key row and returns the secret once, plus id, name, prefix, namespaces, tools, expiresAt, opBudgetTotal, and wipeOnExpire. No quota spend and no email. Run keys default to a 24 hour TTL, wipeOnExpire true, and one auto-generated namespace. Use finish_run to wipe a run key early. The tools array is the stored ACL allow-list of per-operation names, not these merged MCP names. manage_kv action=put is allowed only when the list includes kvp_put (or the list is omitted, which allows every operation). Unknown names are dropped. Former name: keys_create.

Predict whether a future meter spend would be rejected with 402 (no active plan) or 429 (hard cap) before calling a write or search tool. Returns {estimate} with allowed, would402, amount, and budget. For kind=rag_index, pass textLength or byteLength to estimate chunk count instead of amount. Read only: no writes, no quota spend, no email. Use get_usage view=budget to see what is already remaining. Use before manage_kv, index_document, search_documents, or read_inbox_message action=raw or action=attachment. Same behavior as the former budget_estimate tool. ACL is not consulted.

Wipe every namespace bound to this run key and return a signed wipe receipt. Deletes stored data for those namespaces. Valid only for a run key. Checks ACL run_finish. No usage-meter spend and no email. Use manage_kv action=delete to remove one key, or let wipeOnExpire clear a run key at TTL. Former name: run_finish.

Summarize storage for this account. Returns namespaces with key counts and file or vector inventory, narrowed to the key's namespace allow-list when one is set. Read only: no writes, no deletes, no quota spend, no email. Checks ACL inspect_storage. Use manage_kv action=list to page keys inside one namespace, and list_files view=files for file rows. Former name: inspect_storage.

Read this account's usage and quotas. Use view=summary for one calendar month (omit periodYm for the current UTC month, or pass YYYY-MM). Returns usage totals, the budget view, and whether that month is current. Use view=periods to page stored months newest-first. Returns periods, hasMore, and currentPeriodYm. Use view=budget for remaining included quota, hard caps, soft thresholds, checkout URLs, and this key's op budget when one is set. Returns budget and keyBudget. Read only: no writes, no deletes, no quota spend, no email. Choose estimate_usage before a spend, and manage_billing to pay. ACL is not consulted; usage_get, usage_periods_list, and budget_get were ungated reads.

Add UTF-8 text to the RAG index. kind=file stores a named text file and checks ACL file_upload (former file_upload). kind=note stores a short note titled title or note.txt and checks ACL rag_note (former rag_note). Both preflight rag_index capacity, then meter 1 kvp_ops for the upload. Chunk indexing spends rag_index later on the queue. Returns file, an estimated chunk count, budget, and keyBudget. PDF and Excel binaries belong on REST multipart POST /api/files/:namespace. Use search_documents to query and list_files to list what was uploaded. No email.

File catalog reads. view=files lists uploaded file metadata, optionally filtered by namespace, and checks ACL files_list. Returns {files}. view=supported_types returns kinds, extensions, mimeTypes, and extract notes for RAG uploads. That view checks no ACL and spends no quota (former files_types). Neither view writes, deletes, or sends email. Use index_document to upload. MCP indexing accepts UTF-8 text; REST multipart accepts PDF and Excel too.

Payment helpers. Use action=machine_pay to learn how to unlock Pro or buy an agent SKU with Stripe Machine Payments. Returns sku, amount, currency, periodDays, and the POST URL the agent must call with an MPP Payment credential. This call does not charge. Default sku is pro_prepaid_30d. Use action=portal for a Stripe Customer Portal URL (subscription and invoices, for a human). Returns {url}. Fails when the account cannot open a portal. Use action=purchases to list local MPP purchases and logged Stripe events. Returns purchases and a cursor. Pass includeStripe=true to merge unlogged Stripe charges when a customer exists. No quota spend and no email. Sibling bootstrap_agent creates the account first. get_usage reads quotas. ACL is not consulted (billing_machine_pay, billing_portal, and billing_purchases_list were ungated).

Create, read, delete, and audit receive-only email inboxes. action=create writes an address on the inbound domain and returns inbox plus address (ACL inbox_create). Requires an active plan. Temporary inboxes expire and purge. action=list returns active inboxes (ACL inbox_list). action=get returns one inbox (ACL inbox_get). action=delete deletes the inbox and purges stored messages (ACL inbox_delete). action=audit lists account audit entries (ACL inbox_audit_list). These calls do not meter; inbound mail later meters inbound_email. No outbound email. Use read_inbox_message for mail, manage_inbox_webhook for HTTPS notifications, and manage_inbox_blocklist for sender blocks.

Block senders for every inbox on the account. action=list returns entries (ACL inbox_blocklist_list). action=add writes an address or domain block and returns the entry (ACL inbox_blocklist_add). action=delete removes one entry by id (ACL inbox_blocklist_delete). No quota spend and no email. Use manage_inbox to manage the inboxes these rules apply to.

HTTPS webhooks for email.received metadata (no message body). action=create registers a URL and returns the webhook plus the signing secret once (ACL inbox_webhook_create). action=list returns registered webhooks (ACL inbox_webhook_list). action=delete sets disabled_at so the webhook stops firing; the row stays (ACL inbox_webhook_delete). action=deliveries lists attempts; status=failed means retries are exhausted (ACL inbox_webhook_deliveries_list). These calls do not meter and do not send email. Later delivery attempts are separate from this call. Use manage_inbox for the inbox itself.

Read and write arbitrary namespace strings. Use manage_memory when the namespace is prefs, facts, or run. action=put stores value and returns the stored row plus budget and keyBudget (writes; meters 1 kvp_ops; ACL kvp_put). action=get returns {value, budget, keyBudget} (meters 1 kvp_ops; ACL kvp_get). action=delete removes one key and returns {ok, budget, keyBudget} (deletes; meters 1 kvp_ops; ACL kvp_delete). action=list returns {keys, cursor, budget, keyBudget} (meters 1 kvp_ops; ACL kvp_list). No email. Use index_document and search_documents for semantic search, and get_storage_summary for a namespace inventory.

Store and read short strings in the memory scopes prefs, facts, and run. Run uses the run key's bound namespace. action=put writes and returns scope, namespace, budget, and keyBudget (meters 1 kvp_ops; ACL memory_put). action=get returns {value, scope, namespace, budget, keyBudget} (meters 1 kvp_ops; ACL memory_get). No deletes and no email. Use search_documents source=memory for semantic recall, manage_kv for any other namespace, and finish_run to wipe the run namespace.

Account HTTPS interval jobs. action=create writes a schedule and returns it plus the delivery contract (ACL schedule_create). Requires an active plan. This call does not meter. Each later attempt meters outbound_http. Success actions store_kvp meter kvp_ops, store_rag meters rag_index, and notify_webhook meters another outbound_http. Contract: 10 second timeout, up to 3 attempts, exponential backoff capped at 300 seconds, success is HTTP 2xx, auto-disable after 5 consecutive exhausted failures, pause with disabled_reason=no_active_plan when the account lapses (resumes on plan activation). Minimum interval is 5 minutes. action=list returns schedules (ACL schedule_list). action=get returns one schedule and the contract (ACL schedule_get). action=delete sets enabled off and disabled_reason deleted, which stops future runs and keeps the row (ACL schedule_delete). action=runs lists attempts (ACL schedule_runs_list). No email from this call. Use get_usage to see outbound_http remaining.

Read mail already stored on an inbox. action=list returns message metadata newest-first (ACL inbox_messages_list, no quota spend). action=get returns one message plus its attachment list (ACL inbox_message_get, no quota spend). action=raw returns raw MIME as rawBase64 and meters 1 kvp_ops (ACL inbox_message_raw). action=attachment returns filename, contentType, sizeBytes, and dataBase64 and meters 1 kvp_ops (ACL inbox_attachment_get). No deletes and no email send. Use manage_inbox to create the inbox first.

Semantic search over indexed notes and files. Meters 1 rag_query. Returns hits plus budget and keyBudget. source=documents searches the whole index or one namespace and checks ACL rag_search (former rag_search). source=memory limits the search to prefs, facts, or run and checks ACL memory_search (former memory_search). That response also includes scope and namespace. Read only: no writes and no email. Use index_document to add text first. Use manage_memory action=get to read an exact key.