RestClientRuntimeCapability (platform.rest.client) exposes RestClientRuntimeApi independently of Analytics. It reuses saved platform OpenAPI toolsets and their authentication; it is not an arbitrary HTTP proxy.
Discover and call
scope contains the trusted actor, saved workspace/toolset IDs, signal and absolute deadline. The host requires the current identity and a same-scope toolset with category API and type openapi.
Discovery returns enabled operations, descriptions, argument schemas and opaque contract hashes. Calls pin endpoint, method, serialization and schema to that hash. A changed connection or contract requires rediscovery; it is not silently substituted.
Supported operations
Header/cookie parameters and unsupported serializers are rejected. Callers cannot provide headers, URLs, credential snapshots or policy overrides. Redirects are disabled. A read-only POST declaration narrows eligible operations but cannot prove the remote service has no side effects; register only trusted, approved connections.