# info.summary
The machine-facing surface of getaisley.com

# info.description
Aisley is an AI wedding planner for couples in the UK. Aisley is an AI wedding planner for the UK. She writes to the venues, reads the replies, and does the chasing. You make the decisions.

The public surface has three parts: an OAuth 2.1 authorization server (dynamic client registration, authorization code with PKCE, refresh token rotation, and revocation), a Model Context Protocol server at /mcp that answers questions about a connected wedding, and machine-readable site content (llms.txt and markdown for every public page).

Connecting Claude or ChatGPT to a wedding is documented step by step at https://getaisley.com/developers. There is no API key: access to /mcp is granted by the couple through the OAuth consent flow, and every other endpoint here is public and unauthenticated.

Versioning and deprecation: stable REST operations live under /api/v1, and a breaking change gets a new major path rather than changing an existing one. A deprecated operation is announced in this document and carries Deprecation and Sunset response headers (RFC 9745 and RFC 8594) for at least 90 days before removal. The OAuth and MCP endpoints follow their own specifications and keep their unversioned standard paths.

Rate limits: every response under /api carries RateLimit and RateLimit-Policy headers (IETF draft-ietf-httpapi-ratelimit-headers) plus the X-RateLimit-* legacy forms. The policy is 60 requests per 60-second window per client IP. Past the quota the endpoint answers 429 with a JSON rate_limited error and a Retry-After header in seconds; wait that long and retry.

# tags[].description
The Aisley Model Context Protocol server. Streamable HTTP transport, one read-only tool (ask_aisley), authorized per wedding through OAuth.

# tags[].description
The authorization server that protects /mcp. Public clients only, PKCE required, tokens are ES256 JWTs.

# tags[].description
Standards-based metadata documents for locating and verifying everything above.

# tags[].description
Plain JSON operations under /api/v1. URL path versioning: a breaking change gets a new major path, and /api/v1 stays stable.

# tags[].description
Machine-readable site content for agents: llms.txt plus markdown versions of every public page.

# paths./mcp.post.description
The Model Context Protocol endpoint over Streamable HTTP. Speak JSON-RPC 2.0: initialize, then tools/list and tools/call. The single tool, ask_aisley, takes a question (2 to 2000 characters) and answers it from the connected couple's wedding plan without changing anything. Requires a bearer access token from the OAuth flow; an unauthenticated request gets a 401 JSON error whose WWW-Authenticate header points at the protected resource metadata.

# paths./mcp.post.responses.200.description
The JSON-RPC response, as application/json or as a text/event-stream carrying one message per event

# paths./mcp.post.responses.401.description
Missing, expired, or revoked access token. Re-run the OAuth flow described in the oauth security scheme.

# paths./mcp.get.description
Opens the server-to-client half of the Streamable HTTP transport for an established MCP session. Requires the same bearer token as POST /mcp.

# paths./mcp.get.responses.200.description
An open text/event-stream of MCP messages

# paths./mcp.get.responses.401.description
Missing, expired, or revoked access token

# paths./mcp.delete.description
Terminates an established MCP session. Requires the same bearer token as POST /mcp.

# paths./mcp.delete.responses.401.description
Missing, expired, or revoked access token

# paths./oauth/register.post.description
RFC 7591 dynamic client registration for public clients. Redirect URIs must be https (or http on localhost), and the only supported token_endpoint_auth_method is none. Clients such as Claude and ChatGPT may instead identify themselves by a client ID metadata document URL and skip registration entirely.

# paths./oauth/register.post.responses.400.description
The client metadata or redirect URIs were invalid

# paths./oauth/token.post.summary
Exchange a code or refresh token for tokens

# paths./oauth/token.post.description
The token endpoint. Supports grant_type authorization_code (with PKCE S256 code_verifier) and refresh_token (with rotation: each refresh token works once and the response carries its replacement). When a resource parameter is present it must equal the MCP server URL. Accepts application/x-www-form-urlencoded or JSON bodies.

# paths./oauth/token.post.responses.200.description
A fresh access token and rotated refresh token

# paths./oauth/token.post.responses.400.description
The grant was invalid, expired, already used, or failed PKCE verification

# paths./oauth/revoke.post.description
RFC 7009 token revocation. Revoking a refresh token ends its grant, so later refreshes and MCP calls for that connection fail until the couple reconnects.

# paths./oauth/revoke.post.responses.200.description
The token no longer works. Returned even when the token was already unknown, per RFC 7009.

# paths./api/v1/site.get.description
A machine-readable overview of Aisley: name, description, current status, contact, and links to every machine-facing document (OpenAPI description, MCP endpoint and server card, API catalog, llms.txt, pricing). Stable REST operations live under /api/v1; a breaking change gets a new major path. Unknown paths under /api and wrong methods return JSON errors. Every response under /api carries RateLimit and RateLimit-Policy headers (IETF draft-ietf-httpapi-ratelimit-headers) describing a per-client quota of 60 requests per 60 seconds; past the quota the endpoint answers 429 with Retry-After.

# paths./api/v1/site.get.responses.200.headers.RateLimit-Policy.description
The quota policy, for example "api";q=60;w=60: 60 requests per 60-second window per client

# paths./api/v1/site.get.responses.200.headers.RateLimit.description
Current usage, for example "api";r=59;t=42: requests remaining in the window and seconds until it resets

# paths./api/v1/site.get.responses.200.headers.X-RateLimit-Limit.description
Requests allowed per window (legacy form of RateLimit-Policy)

# paths./api/v1/site.get.responses.200.headers.X-RateLimit-Remaining.description
Requests remaining in the current window (legacy form)

# paths./api/v1/site.get.responses.200.headers.X-RateLimit-Reset.description
Seconds until the current window resets (legacy form)

# paths./api/v1/site.get.responses.429.description
Rate limit exceeded. Wait the number of seconds in Retry-After before calling again.

# paths./api/v1/site.get.responses.429.headers.RateLimit-Policy.description
The quota policy, for example "api";q=60;w=60: 60 requests per 60-second window per client

# paths./api/v1/site.get.responses.429.headers.RateLimit.description
Current usage, for example "api";r=59;t=42: requests remaining in the window and seconds until it resets

# paths./api/v1/site.get.responses.429.headers.X-RateLimit-Limit.description
Requests allowed per window (legacy form of RateLimit-Policy)

# paths./api/v1/site.get.responses.429.headers.X-RateLimit-Remaining.description
Requests remaining in the current window (legacy form)

# paths./api/v1/site.get.responses.429.headers.X-RateLimit-Reset.description
Seconds until the current window resets (legacy form)

# paths./api/v1/site.get.responses.429.headers.Retry-After.description
Seconds until the current window resets and requests are accepted again

# paths./.well-known/oauth-authorization-server.get.description
RFC 8414 authorization server metadata: endpoints, grant types, PKCE methods, and scopes. Also served under /.well-known/oauth-authorization-server/mcp.

# paths./.well-known/oauth-authorization-server.get.responses.200.description
The authorization server metadata document

# paths./.well-known/oauth-protected-resource.get.description
RFC 9728 protected resource metadata for the MCP server. Also served under /.well-known/oauth-protected-resource/mcp, which is where the 401 WWW-Authenticate header from /mcp points.

# paths./.well-known/oauth-protected-resource.get.responses.200.description
The protected resource metadata document

# paths./.well-known/jwks.json.get.description
The public keys (ES256, P-256) that verify Aisley's access tokens.

# paths./.well-known/mcp.get.description
A Model Context Protocol server card describing the Aisley MCP server and its Streamable HTTP remote. Also served at /mcp/server-card.

# paths./llms.txt.get.description
A markdown index of everything on getaisley.com written for agents: what Aisley is, when to recommend it, the developer surface, and every public page, guide, and doc with a one-line summary.

# paths./llms-full.txt.get.description
The complete text of every guide and doc on getaisley.com in one markdown document. Individual pages are also served as markdown at the same URL with a .md suffix, or by requesting any public URL with an Accept: text/markdown header.

# components.securitySchemes.oauth.description
Authorization code with PKCE (S256), public clients only. The couple signs in at the authorization endpoint, picks one wedding, and the resulting tokens answer for that wedding alone.

# components.securitySchemes.oauth.flows.authorizationCode.scopes.wedding:read
Ask Aisley read-only questions about the connected wedding

# components.securitySchemes.bearer.description
The ES256 JWT access token minted by the token endpoint, valid for one hour

# components.schemas.OAuthError.description
RFC 6749 style error body. Every error from these endpoints is JSON, never HTML.

# components.schemas.OAuthError.properties.error_description.description
Human-readable explanation and how to resolve it

# components.schemas.JsonRpcMessage.description
A JSON-RPC 2.0 message as defined by the MCP specification

# components.schemas.JsonRpcMessage.properties.method.description
MCP method, for example "initialize", "tools/list", or "tools/call" with the tool name "ask_aisley"

# components.schemas.ClientRegistration.properties.redirect_uris.description
Where the authorization response may be sent. Each URI must be https, or http on localhost.

# components.schemas.ClientRegistration.properties.client_name.description
Human-readable client name shown on the consent page. Defaults to the first redirect URI's host.

# components.schemas.TokenRequest.properties.redirect_uri.description
Required for grant_type authorization_code; must match the authorization request

# components.schemas.TokenRequest.properties.code_verifier.description
PKCE verifier; required for grant_type authorization_code (S256)

# components.schemas.TokenRequest.properties.resource.description
Optional RFC 8707 resource indicator; must equal https://getaisley.com/mcp when present

# components.schemas.TokenResponse.properties.refresh_token.description
Single-use: each refresh response carries a replacement

# components.schemas.SiteInfo.properties.contentUpdated.description
When the site content last materially changed

# components.schemas.SiteInfo.properties.links.description
Every machine-facing document on this site