App-to-app APIs — ChatOSS Docs

Every app can EXPORT functions other apps call, and CALL other apps' APIs — with consent at install and zero runtime prompts. This is how apps compose like OS services (the Kanban app is the flagship example).

Exporting

Declare the names in "apiExports" in the manifest, register the implementations at load:

// app.json
"apiExports": [
  { "name": "getNotes", "description": "List the user's notes (newest first).",
    "params": { "type": "object", "properties": {} }, "why": "Other apps read the user's notes." }
]

window.chatoss.apps.registerApi('getNotes', async (args) => {
  // args = the caller's args object. Return any structured-clone-safe value
  // (data in, data out — no callbacks). Throw to reject the call.
  return [{ id: 'n1', text: 'hello' }];
});

Calling

Declare the target in "apiRequests" (approved at install), then call:

// app.json
"apiRequests": [
  { "appId": "com.example.notesapi", "methods": ["getNotes", "addNote"], "why": "Show the user's notes." }
]

const notes = await window.chatoss.apps.call('com.example.notesapi', 'getNotes');
await window.chatoss.apps.call('com.example.notesapi', 'addNote', { text: 'hi' });

The target app answers even when it's CLOSED — the OS boots it headless (offscreen sandboxed frame), waits for its handlers, dispatches, and returns (30s call timeout; headless sessions idle-timeout after 5 minutes). Your exported APIs ALSO become global tools named <yourAppId>.<name> that any AI agent can call, headless too. The install screen discloses both lists. Without an apiRequests entry for an app id, apps.call to it is refused; without an apiExports entry, registerApi for a name is refused.

Discovering what's out there

apps.listApis() needs no capability and no declaration at all (it is read-only metadata):

const listings = await window.chatoss.apps.listApis();
// → every app-to-app surface the OS currently has (built-in services + installed apps),
//   each with its exports, its requests, and whether it has a live session right now.

You still need an apiRequests entry to CALL anything you find — discovery and permission are separate. A developer tool that must call whatever it discovers is exactly what the "appId": "*" wildcard in the manifest is for.

The flagship built-in app-to-app service is the Agent Engine (com.chatoss.engine) — the platform coding-agent engine.