A small API surface, in the open.

Automated discovery

We publish a machine-readable catalog of our APIs at the well-known location /.well-known/api-catalog, in the linkset format RFC 9727 defines. Every response we serve also advertises it in a Link header with rel="api-catalog".

curl -s https://thethirdwaycompany.com/.well-known/api-catalog

Each catalog entry carries an anchor (the API itself), a service-desc link to its OpenAPI description, a service-doc link to the section of this page about it, and a status link to the health endpoint.

Content API

GET /api/webmcp

Read-only JSON over the site's public content — services, case studies, and blog posts. This is the same data rendered in our HTML and used by our own WebMCP tools; nothing here is authenticated or private. It exists so agents can pull structured content without parsing pages. Please cache responses and treat the content as changing weekly.

curl -s "https://thethirdwaycompany.com/api/webmcp?resource=services"

[
  {
    "slug": "ai-workflows",
    "name": "AI Workflow Automation",
    "summary": "…",
    "path": "/services/ai-workflows"
  },
  …
]

Adding &slug=ai-workflows returns the full record — overview, deliverables, process, and FAQs. Unknown resources return a 400 with the valid options; unknown slugs return a 404 with the available ones.

Contact API

POST /api/contact

The endpoint behind the contact form: payload validation, a Cloudflare Turnstile check, honeypot and timing filters, then delivery to our inbox. We publish it for completeness — but read this next part before you build against it.

An honest note for automated clients: every submission must carry a Turnstile token minted during a real browser visit, so agents cannot POST here successfully — by design. If you are an agent with a message for us, email hello@thethirdwaycompany.com instead.

curl -s -X POST https://thethirdwaycompany.com/api/contact \
  -H "Content-Type: application/json" \
  -d '{"name":"…","email":"…","message":"…","renderedAt":0,"turnstileToken":"…"}'

{ "error": "Verification failed — reload the page and try again." }

Lead capture API

POST /api/lead

The endpoint behind the free tools “email me the report” offers and the tools newsletter slot: an email address, the tool result the visitor asked us to send, and an explicit opt-in that names the purpose. The tools themselves stay ungated — the capture form only appears after a result does, and the tool never requires it.

The same agent-facing note as the contact API applies: submissions need a Turnstile token from a real browser visit, so there is nothing useful to POST here programmatically. It is published for completeness, like the form it backs.

Health

GET /api/status

A deliberately cheap endpoint: no dependencies, no database, safe to poll. Returns 200 with a single JSON object while the site is up.

curl -s https://thethirdwaycompany.com/api/status

{ "status": "ok", "service": "thethirdwaycompany.com" }

Agent protocols: MCP, A2A, skills

Beyond plain HTTP, the same read-only capability is served over the protocols agents already speak:

Authentication for all of it: none. We publish Protected Resource Metadata and an auth.md that say so explicitly — there is nothing to register for.