# InFlight > InFlight is a personal work OS. Items (emails, tickets, PRs, chat messages, alerts) are pushed in by agents, triaged into > tasks, and tasks are ranked into lanes now / next / later with one Top Priority and a WIP limit on Now. > Outside apps and LLM agents integrate over MCP, REST ingest, GraphQL and a server-sent event feed. All endpoints are relative to this site's origin. Authenticate with `Authorization: Bearer ifa__`, an actor token the workspace owner issues on the Actors screen with explicit scopes (read, items:write[:], items:close, tasks:write, ...). Requests without credentials get 401 JSON. Ids are prefixed (tsk_, itm_, prj_, ppl_, act_, att_, evt_). ## Endpoints - [MCP server](/api/mcp): Streamable HTTP, stateless. Start with `whoami`, then `get_today` or `get_overview`. Hosted clients use OAuth; metadata at [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource). - `POST /api/ingest`: push one item `{source_type, source_external_id, title, source_url?, summary?, ...}`; upsert by (source_type, source_external_id); optional `Idempotency-Key` (same body only). - `POST /api/ingest/batch`: `{items: [...]}`, 1-100 items, per-item results. - `POST /api/attachments` (multipart `taskId`, `file`) and `GET /api/attachments/att_...`. - `POST /api/graphql`: full read/write graph (bearer needs `read`); introspection is off in production. - `GET /api/events`: server-sent events, one per change, in commit order; resume with `Last-Event-ID`. Errors are `{error: {code, message, fix, details?}}`; follow `fix`. Writes return a correlation id (header `x-correlation-id`, MCP `correlation_id`) that `undo` reverts within 24h. Limits: 300-request burst, 5/s per token; 5 SSE streams per actor (429 + Retry-After). ## Docs - Agent integration guide: `docs/agent-integration.md` in the InFlight repository (scopes, every MCP tool, ingest fields, error table, attachments, GraphQL, SSE). The MCP server's own `instructions` and tool descriptions cover the same ground.