Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,93 @@
+# Database Query Tools — Self-Hosted REST API Options
+
+Researched 2026-07-09. Source: detailed multi-step web research of 9 database-to-API tools.
+
+## The Landscape
+
+| Tool | Self-Hosted | Free | REST API | Raw SQL | MySQL | SQLite | Postgres | MCP | Setup |
+|------|:-----------:|:----:|:--------:|:-------:|:----:|:------:|:--------:|:---:|:-----:|
+| **Faucet** | ✅ | ✅ MIT | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ Native | <1 min |
+| **Python Skill** | ✅ (in-process) | ✅ | N/A | ✅ | ✅ | ✅ | ✅ | ❌ | ~30 min |
+| Directus | ✅ | ✅ MIT | ✅ | 🔶 Custom | ✅ | ❌ | ✅ | ❌ | ~30 min |
+| Supabase | ✅ | ✅ (limited) | ✅ | ❌ (RPC only) | ❌ | ❌ | ✅ | ❌ | ~15 min |
+| NocoDB | ✅ | 🔶 fair-code | ✅ | ❌ | ✅ | ✅ | ✅ | ❌ | ~15 min |
+| Adminer | ✅ | ✅ | ❌ None | ❌ | ✅ | ✅ | ✅ | ❌ | ~5 min |
+| CloudBeaver | ✅ | 🔶 API paid | 🔶 Enterprise | 🔶 Enterprise | ✅ | ✅ | ✅ | 🔶 Enterprise | ~20 min |
+| PostgREST | ✅ | ✅ MIT | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ~10 min |
+| restSQL | ✅ | ✅ Apache | ✅ | ✅ | ✅ | ❌ | ✅ | ❌ | ~30 min |
+
+## 🏆 Top Pick: Faucet
+
+- **MIT licensed, completely free** self-hosted. Cloud $5/mo Pro / $50/mo Team optional.
+- **Single 47MB Go binary, zero dependencies.** No Docker, Node.js, PHP, or system DB needed.
+- **All 3+ target databases:** MySQL 5.7+, SQLite 3.35+, PostgreSQL 9.6+ (also SQL Server, Oracle, Snowflake).
+- **Auto-generates REST API** per table — CRUD + filtering + pagination + RBAC + OpenAPI docs.
+- **Raw SQL via `faucet_raw_sql` MCP tool** — opt-in, disabled by default.
+- **Native MCP server built in** — Hermes connects directly via mcp_servers config.
+
+### Hermes Integration
+
+**MCP server config in ~/.hermes/config.yaml:**
+```yaml
+mcp_servers:
+  database:
+    command: npx
+    args: ["@faucetdb/faucet", "serve", "--mcp"]
+```
+
+**Or run as standalone service then add DB connections:**
+```bash
+# Install (any method):
+npx @faucetdb/faucet serve        # npm
+brew install faucetdb/tap/faucet  # Homebrew
+docker run -p 8080:8080 faucetdb/faucet:latest  # Docker
+
+# Add a database:
+faucet db add --name mydb --driver postgres --dsn "postgres://user:pass@host/mydb"
+
+# Create API key:
+faucet key create --role default
+
+# Query:
+curl -H "X-Faucet-Api-Key: KEY" http://localhost:8080/api/v1/mydb/_table/users
+```
+
+**MCP tools available to Hermes:** faucet_list_services, faucet_list_tables, faucet_describe_table, faucet_query, faucet_insert, faucet_update, faucet_delete, faucet_raw_sql (disabled by default — enable explicitly).
+
+## ⚠️ Raw SQL: The Critical Distinction
+
+Many "database API" tools claim SQL support but actually require pre-registering queries as stored procedures (Supabase RPC, Directus custom endpoints) or defining SQL views (NocoDB). **Only Faucet and restSQL** offer ad-hoc raw SQL execution over the API.
+
+**If ad-hoc SQL querying is needed** (the Hermes agent needs to explore unknown schemas, run arbitrary SELECTs, or debug production data), Faucet is the only actively maintained option that supports all 3 databases and raw SQL.
+
+## 🥈 Fallback: Custom Python Skill
+
+When you can't run an external service, write a Hermes skill with Python DB drivers:
+
+```python
+# ~/.hermes/skills/db-query/query.py
+import sqlite3, mysql.connector, psycopg2, json, sys
+
+def query_mysql(sql, params=None):
+    conn = mysql.connector.connect(host="wphost02", user=..., password=..., database=...)
+    cursor = conn.cursor(dictionary=True)
+    cursor.execute(sql, params or ())
+    return cursor.fetchall()
+```
+
+Hermes calls via: `python3 query.py --db mysql --query "SELECT * FROM users"`
+
+**Pros:** Zero-infra, full control, works with any existing DB immediately.
+**Cons:** Requires writing Python code, no automatic schema introspection, no RBAC layer.
+
+## Research Methodology for Database Tools
+
+When evaluating a database-to-API tool, check these axes in order:
+
+1. **License** — MIT/Apache = safe. AGPL/fair-code/SSPL = legal risk for commercial.
+2. **Single-binary vs stack** — fewer deps = less ops burden. Java runtimes are heavy.
+3. **Databases supported** — must match your target set. Many are PostgreSQL-only.
+4. **Raw SQL via API** — does it allow arbitrary queries, or only pre-defined CRUD on tables?
+5. **MCP support** — native MCP is best (Hermes connects directly). REST + OpenAPI next.
+6. **Active maintenance** — check GitHub: recent commits, release cadence, issue responsiveness.
+7. **SaaS vs self-hosted paywall** — some are "open source" but API/MCP is enterprise-only (CloudBeaver).
@@ -0,0 +1,58 @@
+# API Integration Research: Debt Recovery Platform
+
+## Online Notarization (RON) — Proof (formerly Notarize)
+
+**URL:** https://www.proof.com
+
+**Pricing (Jul 2026):**
+| Plan | Cost | Best For |
+|------|------|----------|
+| Pro | $25/notarization in-house; $10/additional seal; $10/on-demand witness; $5/additional signer | Low-volume (<=25 tx/mo) |
+| Premium | Custom pricing, billed annually | API access, fraud monitoring |
+| Enterprise | Contact sales | SSO, sandbox, dedicated CSM |
+
+**Key features:**
+- Notarize Network: on-demand notaries 24/7
+- Identity verification (NIST IAL2 compliant, $4/signer)
+- eSignature included ($4/transaction)
+- All 50 states compliant including Texas RON
+- REST API + webhooks (Premium+)
+- Custom co-branding available
+
+**Texas compliance:** HB 3496 (2017) + SB 1624 (2021) — two-way live audio-video, identity proofing (KBA + credential analysis), electronic journal, tamper-evident digital certificates.
+
+**Integration:** REST API embedded in web portal. Document templates pre-fill POA forms. User initiates notary session from within your portal.
+
+**Alternatives:**
+- NotaryCam: Custom quote, real-estate focused
+- Pavaso: Enterprise pricing, Texas-based but real-estate only
+- OneNotary: ~$25-35/ea, no public API
+
+## Electronic Certified Mail — LetterStream
+
+**URL:** https://www.letterstream.com
+
+**Pricing:**
+| Service | Starting Price |
+|---------|---------------|
+| Certified Mail | $8.34/letter |
+| Certified + Return Receipt | $10.34/letter |
+| First Class | $1.19/letter |
+
+No monthly fees, no minimums. REST API for document submission, tracking, and proof of delivery.
+
+## Digital Signatures — Documenso vs DocuSeal (under evaluation)
+
+Both open-source self-hosted. Comparison results will be added when the subagent returns.
+
+## Payments — ACH preferred
+
+- Stripe ACH: 0.8% capped at $5
+- Stripe Connect platform model: debtor -> platform account -> disbursement to customer
+- Credit cards: 2.9% + $0.30 (pass to debtor)
+
+## Estimated per-claim cost
+Notarization: ~$25-35 + Identity verification: ~$4 + Certified mail: ~$8.34 + Processing (ACH): ~$5 = ~$42-52 total (passed to debtor)
+
+## Full report
+See /root/api-research-report.md for complete pricing tables, comparison matrices, and Texas compliance details.
@@ -0,0 +1,95 @@
+# Digital Signatures Comparison: Documenso vs DocuSeal
+
+**Context:** Self-hosted document signing for a debt recovery portal. Needs REST API, webhooks, multi-party signing, embedding in web portal, Docker-based self-hosting.
+
+**Date researched:** July 7, 2026
+
+---
+
+## Community & Project Health
+
+| Metric | Documenso | DocuSeal |
+|---|---|---|
+| GitHub Stars | 13,664 | **17,469** |
+| GitHub Forks | 2,868 | 1,694 |
+| Contributors | **~181** | ~6 |
+| Open Issues | 211 | 121 |
+| Total Releases | 52 | **160** |
+| Latest Release | v2.14.0 (Jun 28) | v3.1.3 (Jul 6) |
+| Docker Pulls | ~505K | **~1.74M** |
+| Image Size | ~690 MB | **~227 MB** |
+| License | AGPL-3.0 | AGPL-3.0 + Additional Terms |
+| Language | TypeScript (Next.js) | Ruby (Rails) |
+
+## Self-Hosting Requirements (Docker on Debian)
+
+| Aspect | Documenso | DocuSeal |
+|---|---|---|
+| Docker command | Multi-step, external DB required | **Single command: `docker run -p 3000:3000 -v.:/data docuseal/docuseal`** |
+| Database | PostgreSQL 14+ only (mandatory) | **SQLite by default** + PostgreSQL/MySQL optional |
+| Deploy time estimate | 30-60 min | 5-15 min |
+| Signing certificate | Must generate manually — signing fails without one | Handled automatically |
+| Docker Compose in repo | 404 — must construct from docs | **Full docker-compose.yml** with Caddy TLS |
+| Updates | Manual pull + run migrations | Auto DB migration on boot |
+
+## API Quality
+
+| Aspect | Documenso | DocuSeal |
+|---|---|---|
+| Auth header | `Authorization: api_xx...xxx` | `X-Auth-Token: ***` |
+| API Reference | OpenAPI at openapi.documenso.com | OpenAPI + Postman collection |
+| Webhooks | Document events | Document events with auto-retry (48h, exponential backoff) |
+| Official SDKs | None | **React, Vue, Angular, vanilla JS** embedding SDKs |
+| API versioning | v2 (explicit) | Rolling releases |
+
+## Feature Comparison
+
+| Feature | Documenso | DocuSeal |
+|---|---|---|
+| Multi-party signing | ✅ | ✅ |
+| Templates | ✅ | ✅ (PDF/DOCX field tags + HTML API) |
+| Audit trail | ✅ X.509 signed | ✅ |
+| White-label/branding | Paid tier | Pro tier |
+| WYSIWYG form builder | ✅ | ✅ (12 field types) |
+| Bulk send (CSV/XLSX) | ❌ | ✅ |
+| Conditional fields | ❌ | ✅ (Pro) |
+| Formulas | ❌ | ✅ (Pro) |
+| SMS verification | ❌ | ✅ (Pro) |
+| SSO/SAML | Enterprise | Pro |
+| Embedded signing | ✅ (white-label paid) | ✅ (React, Vue, Angular, JS — free SDKs) |
+| API document pricing | Unlimited (self-hosted) | $0.20/doc via API (Pro) |
+| Multi-language | ✅ (i18n with Lingui) | ✅ (7 UI, 14 signing) |
+
+## Pricing (Self-Hosted)
+
+| Tier | Documenso | DocuSeal |
+|---|---|---|
+| Core | Free (AGPL-3.0) | Free (AGPL-3.0) |
+| Pro | ~$300-480/yr, 5 users, $8/mo extra | $20/user/month, API key included |
+| Enterprise | ~$3,000/yr — SSO, white-label, support | Custom pricing |
+| API documents (Pro) | Unlimited | $0.20/document via API |
+| Cloud SaaS | Free (5 docs/mo), Pro $25/mo, Team $40/mo, Enterprise $250/mo | Free tier, Pro $20/user/mo |
+
+## Legal Compliance
+
+| Regulation | Documenso | DocuSeal |
+|---|---|---|
+| ESIGN Act (US) | ✅ Dedicated page | ✅ Mentioned |
+| UETA (US) | ✅ Dedicated page | ✅ Mentioned |
+| eIDAS (EU) | ✅ Simple/Advanced/Qualified | ✅ EU Qualified Signature |
+| SOC 2 | ✅ Documented | ❌ Not prominently |
+| 21 CFR Part 11 | ✅ Documented | ❌ Not prominently |
+| GDPR | ✅ Dedicated page | ✅ Mentioned |
+
+## Verdict
+
+**Recommend: DocuSeal** for most portal integrations. Simpler deploy, lighter, richer features, free embedding SDKs. Documenso only if SOC 2 / CFR 21 compliance docs are a hard requirement.
+
+## Data Sources
+
+- GitHub API: `/repos/{owner}/{repo}` — stars, forks, open issues, license, language, topics
+- GitHub API: `/repos/{owner}/{repo}/contributors?per_page=1&anon=true` (Link header for total page count)
+- Docker Hub API: `/v2/repositories/{owner}/{image}/` — pull count, star count, last updated
+- Docker Hub API: `/v2/repositories/{owner}/{image}/tags?page_size=3` — image sizes, architectures
+- Pricing pages: scraped HTML, extracted via `grep -oP` patterns
+- Doc sites: Next.js SPA docs extracted from inline script payloads (`self.__next_f.push`)
@@ -0,0 +1,58 @@
+# OnlineNotary.net vs OneNotary — DRE Evaluation (Jul 7, 2026)
+
+**Context:** Texas debt recovery company (DRE) evaluating an online notary provider for LPOA and debt recovery document notarization. Key requirements: API integration, Texas compliance, 24/7 availability, proven reliability.
+
+## Summary
+
+| Factor | OnlineNotary.net | OneNotary |
+|--------|-----------------|-----------|
+| **Trustpilot** | 4.0 (33 reviews) | 5.0 (3,222 reviews) |
+| **API Docs** | None found | Full dev portal (dev.onenotary.us) |
+| **Pricing** | $15/signer/month | $25/session or ~$49-65/mo flat |
+| **Hours** | 9AM-2AM | 24/7 |
+| **BBB** | No profile | No profile |
+| **G2/Capterra** | Not listed | Listed |
+| **Scam Detector** | Medium-Risk ⚠️ | Not flagged |
+| **Security Certs** | None found | SOC 2, ISO 27001, MISMO |
+| **DocuSign Partner** | No | Yes |
+| **Texas Page** | No | Yes (dedicated) |
+| **Notary Pool** | Unknown | 45,000+ |
+| **Business Clients** | "1,000+" (self-reported) | "2,000+" with case studies |
+
+## Data Sources
+
+- SearXNG self-hosted search (127.0.0.1:8888)
+- Direct curl extraction of onlinenotary.net/pricing, /business-solutions, /testimonials
+- Direct curl extraction of onenotary.com, /pricing-new/, /online-notary-integration/, /texas-online-notary-for-businesses/
+- Reddit r/Notary threads (old.reddit.com): "Online Notary .net" and "Can anyone recommend a good online notary service?"
+- Scam Detector validator (scam-detector.com) — live page extraction
+- Clio App Directory — Clio integration pages for both providers
+- Trustpilot category pages for Notary Public (403 blocked for individual review pages, but category pages and search snippets were accessible)
+- DocuSign developer docs reference to OneNotary as official partner
+
+## Key Qualitative Findings
+
+### OnlineNotary.net Red Flags
+1. 33 Trustpilot reviews vs. claimed "1,500+ 5-star reviews" — massive discrepancy
+2. No BBB profile, no G2/Capterra presence
+3. Scam Detector "Medium-Risk" flag with no explanation provided on the validator
+4. "RESTful API" claimed but zero documentation exists publicly
+5. Only 9AM-2AM daily hours — cannot notarize in the 2AM-9AM window
+6. Only one Reddit review found: positive ("10/10 best price") but from a single user
+7. No security certifications advertised (SOC 2, ISO, etc.)
+
+### OneNotary Strengths
+1. 3,222 Trustpilot reviews at 5.0 — statistically significant positive signal
+2. Public developer portal at dev.onenotary.us with REST API, embedded widgets, webhooks
+3. Official DocuSign Notary On-Demand partner (enterprise validation)
+4. Case studies with named clients (Route, credit unions)
+5. Multiple independent Reddit recommendations from r/Notary users
+6. 24/7 availability with 45,000+ notaries
+7. SOC 2, ISO 27001, MISMO certified
+8. Dedicated Texas compliance page with automatic state-law routing
+
+## Verdict
+
+**Do not sign up for OnlineNotary.net Business plan.** The thin review profile (33 reviews across all platforms), "Medium-Risk" scam detector rating, lack of verifiable API documentation, limited hours, and absence of security certifications make it unsuitable for a legal document service — regardless of the $10/session savings vs. OneNotary.
+
+**Sign up for OneNotary** — start with Business Professional (~$49-65/mo) or pay-as-you-go. Test the full API (dev.onenotary.us) for integration. Contact sales for volume pricing if DRE scales beyond ~10 notarizations/month.
@@ -0,0 +1,119 @@
+# Open-Source CRM Comparison for DRE
+
+**Researched:** Jul 7, 2026 via GitHub API + curl-based page extraction (web tools unavailable)
+**Context:** B2B debt collection agency, ~10 staff, ~50-200 active claims, self-hosted on netcup KVM VPS (8C/15G)
+
+---
+
+## Comparison Matrix
+
+| Feature | TwentyCRM | EspoCRM | Krayin CRM |
+|---|---|---|---|
+| **GitHub Stars** | 52,418 ★ | 3,122 ★ | 23,305 ★ |
+| **GitHub Forks** | 7,816 | 895 | 1,517 |
+| **Open Issues** | 92 | 59 | 149 |
+| **License** | AGPL-3.0+ | AGPL-3.0 | MIT |
+| **Stack** | TypeScript/NestJS/React | PHP/SPA | Laravel/Vue.js |
+| **Deployment** | Docker Compose | Docker or bare metal | Composer + Docker |
+| **Min RAM** | ~2GB | ~1GB | ~3GB |
+| **Database** | PostgreSQL + Redis | MySQL/MariaDB/PostgreSQL | MySQL 8.0.32+ |
+
+### API Quality
+
+| Feature | TwentyCRM | EspoCRM | Krayin CRM |
+|---|---|---|---|
+| **API Type** | GraphQL + REST | REST | REST (Laravel) |
+| **Documentation** | docs.twenty.com (excellent) | docs.espocrm.com (good) | devdocs.krayincrm.com (adequate) |
+| **Auth** | API Keys, OAuth, SSO | API Keys | API Tokens |
+| **Webhooks** | ✅ Built-in | ✅ Built-in | ✅ Via Laravel events |
+| **MCP Server** | ✅ Native (AI assistant) | ❌ | ❌ |
+| **Custom Objects** | TypeScript code + UI | Entity Builder UI | Custom Attributes UI |
+
+### Business Features
+
+| Feature | TwentyCRM | EspoCRM | Krayin CRM |
+|---|---|---|---|
+| **Custom Fields** | ✅ No-code + Code | ✅ Entity Builder | ✅ Custom Attributes |
+| **Email (IMAP/SMTP)** | ✅ Built-in | ✅ Built-in | ⚠️ Sendgrid-based |
+| **Workflows** | ✅ Built-in | ✅ Via formula/BP | ✅ Via Laravel |
+| **File Storage** | ✅ Local/S3 | ✅ Local | ✅ Local |
+
+### Self-Hosting Deployment
+
+**TwentyCRM:**
+```bash
+curl -sL https://raw.githubusercontent.com/twentyhq/twenty/main/packages/twenty-docker/scripts/install.sh | bash
+docker compose up -d
+```
+Access at http://localhost:3000. Requires: Docker, 2GB RAM, PostgreSQL, Redis. Includes backup/restore guide.
+
+**EspoCRM:**
+```bash
+# Docker
+docker pull espocrm/espocrm
+docker run -d -p 80:80 espocrm/espocrm
+```
+Or manual install: PHP 8.3+, MySQL 8.0+/MariaDB 10.3+/PostgreSQL 15+, web server. Installation script available at docs.espocrm.com.
+
+**Krayin CRM:**
+```bash
+composer create-project krayin/laravel-crm
+php artisan krayin-crm:install
+```
+Requires: PHP 8.2+, Composer, MySQL 8.0.32+, 3GB RAM, web server.
+
+### Pricing
+
+| Platform | Self-Hosted | Cloud |
+|---|---|---|
+| **TwentyCRM** | Free (AGPL) | Pro $9/user/mo, Org $19/user/mo |
+| **EspoCRM** | Free (AGPL) | ~$15-69/mo range |
+| **Krayin CRM** | Free (MIT) | Cloud hosting available |
+
+---
+
+## Eliminated Candidates
+
+### SuiteCRM (5,562 ★)
+- Legacy SugarCRM fork, PHP/MySQL
+- **1,414 open issues** — development velocity concerns
+- REST API V8 documented but outdated architecture
+- Not recommended for new projects
+
+### ERPNext CRM Module (36,605 ★)
+- Full ERP system with CRM module (Python/Frappe)
+- Heavy deployment (Frappe Bench, MariaDB)
+- Overkill for debt collection — massive overhead for CRM-only use
+- Consider only if DRE later needs accounting/ERP
+
+### Monica CRM (24,841 ★)
+- **Personal** CRM for friends/family relationships
+- No business workflow features (claims, case stages, pipelines)
+- Disqualified — wrong category entirely
+
+---
+
+## DRE Use-Case Assessment
+
+### Claim/Stage Tracking Requirements
+
+**Needed:** Debtor info (name, address, SSN/TIN, amount owed), claim lifecycle stages (new → verified → sent demand → negotiated → in litigation → paid/closed), task assignments, notes/timeline, document attachments.
+
+**TwentyCRM solution:** Define a `Claim` custom object with pipeline stages, a `Debtor` object with custom fields, linked via relationship. Everything version-controlled as TypeScript code in the Apps framework. Built-in email logging per claim.
+
+**EspoCRM solution:** Create a custom `Claim` entity type, custom `Debtor` entity, define relationships. Entity Builder UI is mature and well-documented. Email integration per entity. Formula engine for calculated fields.
+
+**Krayin CRM solution:** Custom attributes on lead/deal entities. Modular package system for extensions. Less mature entity system than EspoCRM or TwentyCRM.
+
+### Data Sources
+
+All data sourced from:
+- GitHub API (`/repos/{owner}/{repo}`) — stars, forks, issues, license, topics, created/pushed dates, language
+- Project README files (raw.githubusercontent.com) — deployment docs, features, requirements
+- Project documentation sites — API docs, self-hosting guides
+- Pricing pages — dollar amounts via grep, plan names from HTML
+- Docker Hub API (`/v2/repositories/{owner}/{image}/`) — pull counts, image sizes
+
+Referenced files:
+- Full conversation analysis: `/root/crm-comparison-for-dre.md`
+- This reference: `references/open-source-crm-comparison.md` (api-integration-research skill)
@@ -0,0 +1,75 @@
+# RingLogix CPaaS / NetSapiens API
+
+White-label phone service provider (VoIPSimplicity backend). RingLogix white-labels **NetSapiens** as their CPaaS platform.
+
+## Base URL & Docs
+
+```
+https://api.ringlogix.com/pbx/v1/
+```
+
+API docs: `https://apidocs.ringlogix.com/` (public, no login). 238 endpoints across 42 categories. Single POST endpoint with `?object=&action=` routing.
+
+## Authentication — OAuth2
+
+**Endpoint:** `POST .../oauth2/token/`
+
+```bash
+curl -X POST "https://api.ringlogix.com/pbx/v1/oauth2/token/" \
+  -d "grant_type=password&client_id=$ID&client_secret=$SECRET&username=$USER&password=$PASS"
+```
+
+Success 200 returns: `access_token`, `refresh_token`, `domain`, `scope`, `token_type`.
+
+## Critical distinctions (Jul 13, 2026)
+
+### Reseller portal vs PBX domain vs email alias
+
+| Layer | Example | Purpose |
+|---|---|---|
+| **Reseller portal login** | `itpropartner.simplelogin.net` | Manage customers, billing, support tickets |
+| **PBX tenant domain** | `itpropartner.netsapiens.com` or similar | Where phone numbers, devices, subscribers live |
+| **Email alias** | `gbrown@itpropartner.simplelogin.net` | SimpleLogin email forwarding — NOT a PBX domain |
+
+The OAuth `username` parameter needs a **PBX subscriber login**, not the reseller portal login. The PBX domain is assigned by RingLogix and is usually a `netsapiens.com` subdomain. `itpropartner.simplelogin.net` is a SimpleLogin email alias — the API rejects it.
+
+### OAuth scopes
+
+| Scope | Access |
+|---|---|
+| Basic User | Single subscriber's own data |
+| Office Manager | All subscribers in one domain |
+| Reseller | **All domains under the account** |
+
+One subscriber with Reseller scope can manage Forefront Wireless, VoIP Simplicity, and every customer domain through a single login.
+
+## WebRTC
+
+RingLogix (Jul 13, 2026): "Netsapiens doesn't offer a factory SDK, however it does support WebRTC so can use generic tools like **SIP.js** and **JsSIP**." No proprietary SDK.
+
+## Auto-Provisioning Flow
+
+1. Factory reset phone → DHCP discovery (Options 156/66/160/43)
+2. MAC registration: `POST ?object=mac&action=create`
+3. Device linking: `POST ?object=device&action=create`
+4. Phone contacts NDP server → RingLogix pushes SIP config → phone auto-reboots
+
+Provisioning server URL is set in RingLogix portal UI, NOT via API.
+
+## Key endpoints
+
+| Capability | Endpoint |
+|---|---|
+| List subscribers | `POST /?object=subscriber&action=read` |
+| Count subscribers | `POST /?object=subscriber&action=count` |
+| Create device | `POST /?object=device&action=create` (domain + MAC + model + user) |
+| Read devices | `POST /?object=device&action=read` |
+| Voicemail | `POST /?object=vmailnag&action=read/update/delete` |
+| CDR | Export, schedule, purge available |
+
+## Current state (Jul 13, 2026)
+
+- Client ID `0-t1706-c284088-r284061` / Secret confirmed valid (OAuth endpoint returns 403, not 401)
+- PBX subscriber `gbrown` rejected by API — likely not a PBX subscriber or wrong scope
+- PBX domain unknown — `itpropartner.simplelogin.net` is NOT the PBX domain
+- Support ticket open with RingLogix: asking for correct PBX domain, subscriber login, and Reseller scope assignment