List secrets the calling agent can access. Returns names and descriptions only — never values.

Args: did: Agent's DID (did:key:...) for identity verification. agentmail_inbox: Agent's AgentMail address (e.g. sofer@agentmail.to) as fallback identity.

Make an authenticated API call using a managed secret. The key never appears in the response.

The keyring retrieves the secret, makes the API call, and returns only the response data. Every call is logged to the checkout ledger.

Args: service: Service identifier (e.g. 'agentmail', 'stripe', 'ga4', 'firebase'). For unregistered services, pass any name — the generic adapter handles the request if base_url is in params. secret_name: Name of the secret to use (from keyring_list_available). method: HTTP method (GET, POST, PUT, DELETE). endpoint: API endpoint path (appended to service base URL). params: Query parameters for the request. For unregistered services, include: base_url (required), auth_type ('bearer'|'header'|'basic'|'query', default 'bearer'), auth_header (header name when auth_type='header'). body: JSON body for POST/PUT requests. scope: Optional scope for multi-value keys (e.g. 'fleet', 'mcp'). When set, tries secret_name:scope first, falls back to secret_name. purpose: Why this request is being made (logged to ledger). did: Agent's DID for identity verification. agentmail_token: AgentMail API key for identity fallback. agentmail_inbox: Agent's AgentMail address for identity fallback.

Query the checkout ledger — who accessed what, when, and why.

Args: agent_id: Filter by agent (DID or AM address). service: Filter by service name. secret_name: Filter by secret name. days: How far back to look (default 30).

Analyze agent-service affinity patterns from the checkout ledger.

Returns which agents use which services most — the raw data for workstation specialization analysis and context overload detection.

Args: days: How far back to analyze (default 30).