API & Agents
From CAD to parts, with your AI agent
Give your agent a STEP file and tell it what you need. It can check manufacturability, choose materials and services, compare prices, and prepare an order from RMFG.
The endpoint reference is generated from the deployed API. The examples below explain how to use those endpoints together.
Hosted MCP for your agent
Connect to https://api.rmfg.com/mcp and sign in to RMFG. Your agent can upload STEP files, inspect parts, configure manufacturing, and prepare checkout. Your MCP client handles login and credentials.
Set up hosted MCPThe MCP connection prepares quotes and checkout links. For custom REST integrations and approved API payment, use the examples below.
Direct HTTP integration
- Attach your STEP file and paste the prompt below into an agent that can run terminal commands and make HTTP requests.
- Your agent gives you an RMFG connection link. Open it, sign in, check the matching code, and approve its permissions.
- Return to your agent. It can now quote your parts and prepare checkout. You do not need to create or copy an API key.
Read https://www.rmfg.com/docs/api/agent-guide.txt and the current API schema at https://api.rmfg.com/v1/openapi.json.
If you are not connected, follow the guide to start OAuth device authorization using your HTTP client and give me its browser approval link. Quote 10 copies of the attached bracket.step in 5052 aluminum, approximately 0.125 inches thick, with no finish. Compare quantities 1, 10, and 25 using current catalog options.
Inspect every unique part and its instance count. Show me the selected stock thickness, price, manufacturing findings, and a review link. Ask me about any substitutions or required risk acceptance. Then create a cart and give me its cart_url so I can sign in and pay on rmfg.com.Replace the file name, material, quantity, and finish with what you need. Your agent should use the current catalog, show any required manufacturing approvals, and return a link to the configured cart. You select delivery, sign in, and pay on rmfg.com.
Let your agent complete the purchase
Save a card under Card for API orders in your account. Your agent can then purchase a ready cart through the API after you approve its configuration, delivery option, and total including tax.
Request paid ordering when connecting your agent and explicitly enable “Also allow paid orders” on the approval page. This permission starts off.
Read https://www.rmfg.com/docs/api/agent-guide.txt and the current API schema at https://api.rmfg.com/v1/openapi.json. Connect using OAuth with the payments scope in addition to the default permissions and give me the approval link if needed.
Prepare 10 copies of bracket.step in the material and finish I approved. Use my provided shipping address, show the available delivery options, and create a cart for my selected option.
Show me the exact cart total including shipping and tax, the delivery estimate, and any manufacturing findings. Ask for my approval of that cart and total before charging my saved card. After approval, pay that same cart using card_on_file. Reuse the same idempotency key on retries. If payment is processing, check that attempt instead of creating another cart. Return the order ID and tracking when available.An API payment places a real production order and charges the saved card. Creating a quote or cart alone does not place an order.
Browser login for agents
Your agent can start browser approval through its existing HTTP or OAuth client. RMFG supports device authorization for remote agents and PKCE for browser callbacks. The client manages credential storage and refresh. Disconnect anytime under Connected agents.
# Start browser approval using your existing HTTP client.
curl --fail-with-body https://api.rmfg.com/v1/oauth/device/code \
--data-urlencode "client_id=rmfg-agent" \
--data-urlencode "scope=designs dfm quotes carts orders"
# Show verification_uri_complete and user_code to the customer.
# Save device_code privately as RMFG_DEVICE_CODE.
# Wait interval seconds between polls; add 5 seconds on slow_down.
curl --fail-with-body https://api.rmfg.com/v1/oauth/token \
--data-urlencode "client_id=rmfg-agent" \
--data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
--data-urlencode "device_code=$RMFG_DEVICE_CODE"
# authorization_pending means keep waiting; it is an HTTP 400 response.
# Stop on access_denied or expired_token. After approval, store the
# returned access_token and refresh_token in private credential storage.
# Use the access token as RMFG_TOKEN for the API examples below.Implement your own OAuth client
## Implementing an OAuth client Discovery: https://api.rmfg.com/.well-known/oauth-authorization-server Protected resource metadata: https://api.rmfg.com/.well-known/oauth-protected-resource Remote/cloud agents: POST /v1/oauth/device/code as application/x-www-form-urlencoded with client_id=rmfg-agent and optional space-separated scope. Show verification_uri_complete and user_code to the user. Poll POST /v1/oauth/token with grant_type=urn:ietf:params:oauth:grant-type:device_code, client_id, and device_code at the returned interval. Continue on authorization_pending; add 5 seconds on slow_down. Stop on access_denied or expired_token. Never ask the user to share their password or browser session. Browser/local agents: POST /v1/oauth/register as JSON with client_name, redirect_uris, grant_types=["authorization_code","refresh_token"], token_endpoint_auth_method="none". Generate a random state and a 43–128 character PKCE verifier; challenge=base64url(SHA256(verifier)) without padding. Open /v1/oauth/authorize with client_id, response_type=code, redirect_uri, state, code_challenge, code_challenge_method=S256, and scope. Callbacks must match registration: HTTPS, or HTTP on 127.0.0.1/::1 for local clients. Only the port may vary for an HTTP loopback callback. Validate callback state and iss (the API origin). Exchange the code at /v1/oauth/token as a form with grant_type=authorization_code, client_id, code, code_verifier, and redirect_uri. No client secret is issued. Use Authorization: Bearer <access_token>. Access tokens last up to 15 minutes; connections expire after 30 days. Refresh with a form POST /v1/oauth/token containing grant_type=refresh_token, client_id, and refresh_token. Save the replacement refresh token every time. Serialize refreshes across processes: reusing a consumed refresh token revokes the whole connection. After an ambiguous refresh failure, reconnect instead of retrying an old refresh token. POST /v1/oauth/revoke with client_id and token to disconnect, or use https://www.rmfg.com/account#agent-connections. Default permissions: designs dfm quotes carts orders. Catalogs and account summary are readable. Optional webhooks and payments; payments also requires carts and a separate, unchecked browser consent. Read the granted scope from the token response: requested payments may be declined while the connection succeeds. Agent credentials cannot manage API keys, saved cards, website sessions, or other agent connections. Keep all credentials and credential files out of prompts, logs, and source control.
For existing scripts and integrations, manual API keys remain available. The curl examples accept an OAuth access token or an API key.
How the API flow works
Base URL: https://api.rmfg.com. Authenticate with Authorization: Bearer <access token or API key>. Dimensions are millimetres and money is integer USD cents.
1. Analyze the file and choose stock
# RMFG_TOKEN contains the OAuth access token or an existing API key.
# Keep it in private credential storage; do not paste it into shared prompts.
curl --fail-with-body https://api.rmfg.com/v1/materials \
-H "Authorization: Bearer $RMFG_TOKEN"
curl --fail-with-body https://api.rmfg.com/v1/analyze \
-H "Authorization: Bearer $RMFG_TOKEN" \
-H "Idempotency-Key: bracket-analysis-001" \
-F "file=@bracket.step"
# Poll /v1/designs/{id} from the response until ready.
# Follow next_cursor when a catalog response has_more.Inspect every unique part and its instance count. Use the returned material IDs for sheet parts, or tube profile IDs for tube parts. A quantity of 10 means 10 completed designs; the API accounts for repeated parts in an assembly.
2. Configure, quote, and create a cart
This one-part sheet example uses IDs from analysis and the materials catalog. For assemblies, configure every unique part. Save the object as cart.json after replacing the placeholder IDs. Add taps, hardware, countersinks, finishes, or welding using the current schema and DFM capabilities.
{
"items": [{
"design_id": "DESIGN_ID",
"quantity": 10,
"configuration": {
"parts": [{"part_id": "PART_ID", "material_id": "MATERIAL_ID"}]
}
}]
}# Quote first. Review status, requirements, and each item's DFM findings.
curl --fail-with-body https://api.rmfg.com/v1/quotes \
-H "Authorization: Bearer $RMFG_TOKEN" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: bracket-quote-001" \
--data-binary @cart.json
# Once ready, create the cart and open its returned cart_url on rmfg.com.
curl --fail-with-body https://api.rmfg.com/v1/carts \
-H "Authorization: Bearer $RMFG_TOKEN" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: bracket-cart-001" \
--data-binary @cart.jsonQuotes include manufacturability findings. Resolve requires_input or blocked results before checkout. Pending or failed automatic file correction can be an informational manual-review warning for an otherwise ready part. Show that warning and let the customer continue.
3. Pay on the website or through the API
For website checkout, open the returned cart_url. For API payment, first set the cart's ship_to, choose a returned quote.fulfillment.shipping_options ID, and update the cart. Verify the latest total, calculated tax, and ready quote before requesting purchase approval.
# Charges a real card. Run only after approval of this cart and its total.
curl --fail-with-body "https://api.rmfg.com/v1/carts/$CART_ID/pay" \
-H "Authorization: Bearer $RMFG_TOKEN" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: bracket-payment-001" \
-d '{"payment":{"type":"card_on_file"}}'Keep an idempotency key stable for identical retries; use a new key when the request changes. If payment returns 202 processing or times out, check the existing cart or retry the same payment. Confirm checked_out and order_id, then use GET /v1/orders/{id} for status and tracking.
More ways to integrate
Generated API reference — endpoints, request and response schemas, authentication, and examples.
Plain-text agent guide — the complete workflow, review links, retries, payments, and order tracking.