API & Integrations

One OAuth2 engine (Authorization Code Flow) serves any service — the provider is data, not code. Builtin providers: google, gmail, avito, github, slack, notion, threads, twitter, dropbox, spotify, yandex, vk.

Flow

• AI calls get_oauth_url(service='...') and returns a real authorize URL with a one-time state stored in the database
• You approve access at the provider and are redirected to /auth/oauth2/callback (or a provider-specific path such as /auth/google/callback)
• The server validates state, exchanges code for tokens and stores them encrypted (Fernet/AES) per user
• AI reads tokens with credential_get('oauth2:'); expired tokens are refreshed automatically with retry/backoff

Endpoints

Add your own provider — no code changes

MY_SERVICE_CLIENT_ID=...
MY_SERVICE_CLIENT_SECRET=...
MY_SERVICE_AUTH_URL=https://example.com/oauth/authorize
MY_SERVICE_TOKEN_URL=https://example.com/oauth/token
MY_SERVICE_SCOPES=read,write
MY_SERVICE_PROBE_URL=https://api.example.com/me
OAUTH_PROVIDERS=my_service

Optional: {NAME}_SCOPE_SEPARATOR, {NAME}_TOKEN_AUTH_METHOD (client_secret_post / client_secret_basic), {NAME}_USE_PKCE, {NAME}_REFRESH_SUPPORTED, {NAME}_REDIRECT_PATH, {NAME}_PROBE_URL. Redirect URI: https://asibiont.com/auth/oauth2/callback (canonical host without www).

Security

• PKCE (RFC 7636) — code_verifier + code_challenge (S256) for providers that support it
• State — one-time, stored in the oauth_pending_states table with a 10-minute TTL; survives restarts and multiple workers
• Encryption — tokens are encrypted with Fernet (AES) and never shared between users
• Health check — credential_health refreshes the token and makes a real probe request to the provider

AI receives events from any external service. Register a webhook with register_webhook(service, webhook_url, secret) — the service then POSTs to /api/webhooks/{service}.

Endpoints

Signature verification

If a secret is configured, the request must carry X-Signature-256 or X-Hub-Signature-256 — HMAC-SHA256 of the raw body, either bare hex or sha256=. A mismatch returns 403. Events are isolated per user; the queue holds up to 1000 events per user.

import hmac, hashlib
expected = hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
assert hmac.compare_digest(expected, received.replace('sha256=', ''))

Python handlers run with retry (3 attempts, exponential backoff); when all attempts are exhausted the event goes to a dead-letter queue (up to 100 events per user) that AI can inspect.

Subscribe to AI events and receive HTTP POST notifications to your URL. Every webhook payload is signed with HMAC-SHA256 — verify authenticity on your end.

Event Types

• mission_created — New mission created
• task_completed — Task completed
• ai_message — AI message in chat
• reminder_triggered — Reminder triggered
• note_created — Note created
• scheduled_trigger — Scheduled task executed
• integration_connected — Integration connected

Each webhook includes the X-ASI-Signature header — HMAC-SHA256 of the body signed with your webhook's secret key. Delivery timeout is 15 seconds; if your server doesn't respond with HTTP 200, the delivery fails. No automatic retries — design your endpoint to be idempotent.

Schedule AI prompt execution with cron expressions. Set a prompt and time — AI executes the task, saves results to notes, and sends a report.

Examples

The background worker checks for due tasks every 60 seconds. On trigger, AI executes the prompt, saves the response as a note, and emits a scheduled_trigger event (can be caught by webhooks).

The Event System is the core messaging bus that connects all components of ASI Biont. Built on an asyncio.Queue architecture, it ensures reliable, asynchronous event delivery across the platform.

Architecture

• Events are pushed to an in-memory asyncio.Queue
• A background worker processes events one by one
• Each event is logged to the event_logs table for audit
• Handlers are registered via the @EventSystem.on('event_type') decorator

Event Format

{
    "user_id": 42,
    "event_type": "task_completed",
    "payload": {
        "task_id": 123,
        "title": "Analyze sales data",
        "status": "completed"
    }
}

Built-in Handlers

• Outgoing Webhooks — Delivers events to registered webhook URLs with HMAC-SHA256 signing
• Event Logging — Saves every event to the database for audit and debugging

ASI Biont AI can connect to remote servers via SSH and communicate with hardware devices through serial ports. SSH connections run in the secure Python sandbox; serial port access goes through Hardware Bridge — a separate application (bridge.py) running on the user's PC.

SSH (paramiko)

AI uses the paramiko library to connect to any SSH server. Credentials are stored encrypted (Fernet: AES-128-CBC + HMAC-SHA256) via credential_set and never exposed to AI code.

• Read-only commands by default (logs, monitoring, diagnostics)
• Destructive commands require explicit user approval
• SSRF protection — connections to private IPs (10.x, 192.168.x, 127.0.0.1) are blocked
• 30-second timeout — hanging connections are killed automatically

Serial Ports — Hardware Bridge

AI communicates with serial devices through Hardware Bridge — a separate bridge.py application running on the user's PC. The bridge connects to ASI Biont via WebSocket (the only communication channel) and provides access to COM ports locally via pyserial. AI sends commands through industrial_command — they are routed to the user's bridge, which reads/writes to the serial port.

• Arduino, ESP32, ESP8266 — read sensors, control pins
• Industrial controllers — Modbus RTU, RS-232/RS-485
• GPS receivers — read NMEA data
• Any USB-serial device — barcode scanners, receipt printers, terminals
• Atomic serial_write_and_read — write and read in one operation, no timeout risk
• HELP protocol — send serial_write_and_read(data="48454c500a") to discover device commands
• Cross-platform: Windows (CancelIoEx + PurgeComm fallback), Linux, macOS