# Order custom parts with an AI agent

API base: https://api.rmfg.com
Current generated reference: https://api.rmfg.com/v1/docs
Current OpenAPI: https://api.rmfg.com/v1/openapi.json
Website guide: https://www.rmfg.com/docs/api

## Hosted MCP (recommended for quoting)

Server URL: https://api.rmfg.com/mcp
Website setup guide: https://www.rmfg.com/docs/api/mcp
Transport: Streamable HTTP. Use your MCP client's native OAuth login; no local RMFG server or manual token handling is needed. OAuth uses dynamic client registration and authorization code with S256 PKCE. The API origin is the OAuth resource. Requested scopes are designs dfm quotes carts, without payments. Disconnect at https://www.rmfg.com/account#agent-connections.

Codex setup:
codex mcp add rmfg --url https://api.rmfg.com/mcp
codex mcp login rmfg

1. Call prepare_upload with request.filename (STEP/STP basename), optional size_bytes and sha256, and operation_key. This hosted server cannot read local paths or chat attachments. Upload raw file bytes with HTTP PUT to the returned upload_url, using upload_headers. If you cannot access file bytes, show browser_upload_url to the user. Upload links expire after 15 minutes and are private. Maximum file size: 50 MiB. Do not put file bytes or base64 in MCP arguments.
2. Call inspect_design with the returned design_id. Pending results have durable IDs: resume reading rather than uploading again. Inspect every unique part, instance count, hole, and weld candidate. Use preview_design for labeled views.
3. Use search_catalog for current material, finish, and hardware IDs. All dimensions are millimetres and money is integer USD cents. Select actual holes and seam paths; do not assume every opening should be tapped or every contact perimeter welded.
4. Use quote_designs with items containing design_id, quantity, and configuration. Quoting includes DFM. configure_design is optional for detailed capabilities and corrected previews. Explain unresolved decisions and ask the customer before adding accepted_risks. Never silently accept a manufacturing risk. Use get_quote or get_dfm to resume processing; tools poll for a bounded period.
5. Use create_review_link to let the customer inspect the configuration. After an edit, get_review_link and re-quote the returned configuration before checkout.
6. Call create_checkout with a ready quote_id. It uses the configuration stored on that quote and returns a website checkout link. No payment tool is exposed. Creating a cart does not place an order. Quote and cart totals can differ with delivery, tax, and current pricing; the customer reviews the final total on the website.

Writes require operation_key. Reuse it for an identical retry; choose a new key when inputs change. The integration handles pagination, bounded retries and polling. Keep upload, review, and checkout links private.

Example prompt:
Use RMFG to quote one copy of bracket.step in hot rolled steel. Inspect the assembly and suggest suitable welds. Tap the small mounting holes M5 × 0.8 and preserve larger openings.

Show me the material thickness, selected holes and welds, price, and any manufacturing risks that need my decision. When the quote is ready, give me a link to review and pay on rmfg.com.


## Direct REST API alternative

The following workflow is for HTTP clients without MCP and integrations that need approved API payment. MCP users should follow the workflow above.

1. Connect through OAuth using your existing HTTP or OAuth client. Discover endpoints at https://api.rmfg.com/.well-known/oauth-authorization-server. For a remote agent, POST /v1/oauth/device/code with client_id=rmfg-agent, show the customer verification_uri_complete and user_code, and poll the token endpoint at the returned interval. For a browser callback, use authorization code + S256 PKCE. Store access and refresh tokens in your client’s private credential storage and implement token refresh as described below. No RMFG program needs to be installed. Manual API keys at /account#api-keys remain an alternative.

2. POST /v1/analyze with a STEP file. Poll the returned status_url while queued or processing. On ready, inspect parts, suggested_process, and instance_count. Quantity is completed design units; the API multiplies by each part's instance_count.

3. Read /v1/materials for sheet or /v1/tube-profiles for tube. Discover finishes, powder-coat colors, taps, studs, nuts, and standoffs from their catalog endpoints. Follow pagination. Use returned string IDs, not names or guessed IDs. Dimensions are millimetres; money is integer USD cents.

4. POST /v1/quotes with items containing design_id, quantity, and configuration.parts for every unique part. Use material_id for sheet and tube_profile_id for tube. Add quantity_options to compare quantities. Quoting includes DFM; a separate POST /v1/dfm is useful for detailed service capabilities and corrected-file previews. Use returned capabilities and annotated images to choose hole IDs and installation sides.

5. Read quote status and requirements. Resolve requires_input or blocked findings before checkout. Explain required risk acceptance and obtain the customer's decision. Failed or pending automatic production-file generation alone is advisory: show manufacturing_warnings or production_files.review_warning; it does not prevent buying an otherwise ready quote. POST /v1/review-links with design_id and configuration when a person needs to inspect or edit the part; read back the link's configuration before continuing.

6. POST /v1/carts with the same configured items. Return cart_url for the customer to review, select delivery, sign in, and pay on rmfg.com. A cart or quote is not a paid order. Keep review and cart links private; their tokens grant access.

7. For agent-token API payment, include payments in the requested OAuth scopes and have the customer explicitly enable paid orders in the browser; quotes and checkout links do not need this permission. For API payment, first GET /v1/account and ensure a card is saved; use payment_method_setup_url if needed. Set ship_to (name, street1, city, state, postal_code, country US) on the cart, choose a shipping_option_id returned in quote.fulfillment.shipping_options, and PATCH /v1/carts/{id}. Recheck the updated totals, ready quote, open cart, selected shipping, and calculated tax. Obtain approval of that exact cart and totals.amount_total_cents before POST /v1/carts/{id}/pay with payment.type card_on_file. This creates a real charge and production order.

8. Use a stable Idempotency-Key for each write and reuse it only for an identical retry. A changed request needs a new key. Honor Retry-After on 429. When payment returns 202 processing or the connection times out, poll the existing cart or retry the same payment; never start a second purchase. Confirm checked_out and order_id, then GET /v1/orders/{id} for status and tracking. A webhook subscription to cart.checked_out and order.status_changed can replace polling.

## Example: quote and let me pay

Read https://www.rmfg.com/docs/api/agent-guide.txt and the current API schema at https://api.rmfg.com/v1/openapi.json.

If you are not connected, follow the guide to start OAuth device authorization using your HTTP client and give me its browser approval link. Quote 10 copies of the attached bracket.step in 5052 aluminum, approximately 0.125 inches thick, with no finish. Compare quantities 1, 10, and 25 using current catalog options.

Inspect every unique part and its instance count. Show me the selected stock thickness, price, manufacturing findings, and a review link. Ask me about any substitutions or required risk acceptance. Then create a cart and give me its cart_url so I can sign in and pay on rmfg.com.

## Example: approved purchase with saved card

Read https://www.rmfg.com/docs/api/agent-guide.txt and the current API schema at https://api.rmfg.com/v1/openapi.json. Connect using OAuth with the payments scope in addition to the default permissions and give me the approval link if needed.

Prepare 10 copies of bracket.step in the material and finish I approved. Use my provided shipping address, show the available delivery options, and create a cart for my selected option.

Show me the exact cart total including shipping and tax, the delivery estimate, and any manufacturing findings. Ask for my approval of that cart and total before charging my saved card. After approval, pay that same cart using card_on_file. Reuse the same idempotency key on retries. If payment is processing, check that attempt instead of creating another cart. Return the order ID and tracking when available.

## Browser login and agent requests

# Start browser approval using your existing HTTP client.
curl --fail-with-body https://api.rmfg.com/v1/oauth/device/code \
  --data-urlencode "client_id=rmfg-agent" \
  --data-urlencode "scope=designs dfm quotes carts orders"

# Show verification_uri_complete and user_code to the customer.
# Save device_code privately as RMFG_DEVICE_CODE.
# Wait interval seconds between polls; add 5 seconds on slow_down.
curl --fail-with-body https://api.rmfg.com/v1/oauth/token \
  --data-urlencode "client_id=rmfg-agent" \
  --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
  --data-urlencode "device_code=$RMFG_DEVICE_CODE"

# authorization_pending means keep waiting; it is an HTTP 400 response.
# Stop on access_denied or expired_token. After approval, store the
# returned access_token and refresh_token in private credential storage.
# Use the access token as RMFG_TOKEN for the API examples below.

## Implementing an OAuth client
Discovery: https://api.rmfg.com/.well-known/oauth-authorization-server
Protected resource metadata: https://api.rmfg.com/.well-known/oauth-protected-resource

Remote/cloud agents: POST /v1/oauth/device/code as application/x-www-form-urlencoded with client_id=rmfg-agent and optional space-separated scope. Show verification_uri_complete and user_code to the user. Poll POST /v1/oauth/token with grant_type=urn:ietf:params:oauth:grant-type:device_code, client_id, and device_code at the returned interval. Continue on authorization_pending; add 5 seconds on slow_down. Stop on access_denied or expired_token. Never ask the user to share their password or browser session.

Browser/local agents: POST /v1/oauth/register as JSON with client_name, redirect_uris, grant_types=["authorization_code","refresh_token"], token_endpoint_auth_method="none". Generate a random state and a 43–128 character PKCE verifier; challenge=base64url(SHA256(verifier)) without padding. Open /v1/oauth/authorize with client_id, response_type=code, redirect_uri, state, code_challenge, code_challenge_method=S256, and scope. Callbacks must match registration: HTTPS, or HTTP on 127.0.0.1/::1 for local clients. Only the port may vary for an HTTP loopback callback. Validate callback state and iss (the API origin). Exchange the code at /v1/oauth/token as a form with grant_type=authorization_code, client_id, code, code_verifier, and redirect_uri. No client secret is issued.

Use Authorization: Bearer <access_token>. Access tokens last up to 15 minutes; connections expire after 30 days. Refresh with a form POST /v1/oauth/token containing grant_type=refresh_token, client_id, and refresh_token. Save the replacement refresh token every time. Serialize refreshes across processes: reusing a consumed refresh token revokes the whole connection. After an ambiguous refresh failure, reconnect instead of retrying an old refresh token. POST /v1/oauth/revoke with client_id and token to disconnect, or use https://www.rmfg.com/account#agent-connections.

Default permissions: designs dfm quotes carts orders. Catalogs and account summary are readable. Optional webhooks and payments; payments also requires carts and a separate, unchecked browser consent. Read the granted scope from the token response: requested payments may be declined while the connection succeeds. Agent credentials cannot manage API keys, saved cards, website sessions, or other agent connections. Keep all credentials and credential files out of prompts, logs, and source control.

## HTTP examples (OAuth access token or API key)

```sh
# RMFG_TOKEN contains the OAuth access token or an existing API key.
# Keep it in private credential storage; do not paste it into shared prompts.
curl --fail-with-body https://api.rmfg.com/v1/materials \
  -H "Authorization: Bearer $RMFG_TOKEN"

curl --fail-with-body https://api.rmfg.com/v1/analyze \
  -H "Authorization: Bearer $RMFG_TOKEN" \
  -H "Idempotency-Key: bracket-analysis-001" \
  -F "file=@bracket.step"

# Poll /v1/designs/{id} from the response until ready.
# Follow next_cursor when a catalog response has_more.
```

The following is a one-part sheet example. Include every discovered unique part for an assembly. Replace placeholders with returned design, part, and catalog IDs.

```json
{
  "items": [{
    "design_id": "DESIGN_ID",
    "quantity": 10,
    "configuration": {
      "parts": [{"part_id": "PART_ID", "material_id": "MATERIAL_ID"}]
    }
  }]
}
```

```sh
# Quote first. Review status, requirements, and each item's DFM findings.
curl --fail-with-body https://api.rmfg.com/v1/quotes \
  -H "Authorization: Bearer $RMFG_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: bracket-quote-001" \
  --data-binary @cart.json

# Once ready, create the cart and open its returned cart_url on rmfg.com.
curl --fail-with-body https://api.rmfg.com/v1/carts \
  -H "Authorization: Bearer $RMFG_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: bracket-cart-001" \
  --data-binary @cart.json
```

# Charges a real card. Run only after approval of this cart and its total.
curl --fail-with-body "https://api.rmfg.com/v1/carts/$CART_ID/pay" \
  -H "Authorization: Bearer $RMFG_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: bracket-payment-001" \
  -d '{"payment":{"type":"card_on_file"}}'