# HMK developer documentation

Canonical docs: https://docs.hmk.dk/
OpenAPI: https://docs.hmk.dk/openapi.json
REST: https://app.hmk.dk/api/v1
MCP Streamable HTTP: https://app.hmk.dk/mcp
OAuth protected resource: https://app.hmk.dk
OAuth discovery: https://app.hmk.dk/.well-known/oauth-authorization-server

Shared identity, one workspace per OAuth grant. PKCE S256 required, DCR public clients (none), exact redirects, resource parameter required. Browser consent grants requested scopes. Tokens last 1h; rotating refresh tokens 30 days. Revoke from HMK app. No secrets in chat.

Every project/order write records the authenticated person and client in append-only activity, in the same DynamoDB transaction. Clients cannot set actor fields. Project edits require expectedRevision. UUIDs deduplicate project creation and print submission.

Current features: list_workspaces, list_projects, get_project, create_project, update_project, list_configurations, submit_print_order, list_print_orders, get_order_status, list_activity.
Print requests require HMK review. Not automatic printer start. No inventory, quoting, slicing, CAD editing or ETA in this release. Never claim a project was manufactured because an order was accepted. Only predefined custom-pos configurations can be ordered.