Files
zeekay c1c72dea64 Call IAM on api.hanzo.ai, by its resource routes
iam.hanzo.ai serves only the IAM web app, so every token exchange,
refresh and userinfo aimed there got HTML back. @hanzo/auth took its
API host from @hanzo/iam's BRAND_SERVER_URLS.hanzo, which in 0.21.17
still names that host; it now states the gateway, api.hanzo.ai, and
keeps taking the paths from @hanzo/iam. office and outlook ride on it.
vscode's standalone auth, cli-tools' HanzoAuth and the mcp server
default to the gateway too.

The mcp iam tool called IAM's verb paths, which answer 410 (get-users,
update-role, ...) or 404 (get-tokens, get-sessions, ...). It now uses
the resources: GET and POST on /v1/iam/<kind>, GET, PUT and DELETE on
/v1/iam/<kind>/<owner>/<name>. update_user nests the row under "user".
update_org writes /organizations/profile, since a PUT of the masked row
a read returns would store the mask. delete_session takes the full
owner/name/application key the session is filed under.

dxt's server.js is rebuilt from mcp. The Office manifests drop the
iam.hanzo.ai AppDomain.

Claude-Session: https://claude.ai/code/session_01Dc8DXc3fEQCRHUa6XWK4Ku
2026-09-29 12:09:09 -07:00
..