Publish a private API to your Upivia

1. Register the service

From /admin/services/new (org-scoped) declare a service + one operation. You give it a name (`acme.lookup`), an endpoint URL, a request schema, and a cost-per-call estimate. Upivia hashes and stores the upstream API key with the platform's per-org KMS key - it's never readable by agents.

bash# Register a private service against your org. The platform stores the upstream secret encrypted.
curl -X POST https://www.upivia.com/v1/service-requests \
  -H "Authorization: Bearer $AGENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "service":"platform",
    "operation":"register_service",
    "payload":{
      "key":"acme.lookup",
      "endpoint":"https://api.acme.internal/v1/lookup",
      "auth":{"type":"bearer","secret_ref":"ACME_API_KEY"},
      "request_schema":{
        "type":"object",
        "properties":{"q":{"type":"string"}},
        "required":["q"]
      },
      "cost_estimate_cents":2
    }
  }'

2. Enable it on an agent

/permissions shows your custom service alongside the built-ins. Enable on an agent, set monthly cap + approval threshold like any other op.

3. Call it

Dispatch through the same endpoint your agent already uses. Upivia validates the payload against your schema, debits the budget, calls your endpoint, and writes an AuditLog. If your endpoint returns 5xx, the request fails with `provider_unavailable` and no charge sticks.

bash# Agents call it identically to a built-in service.
curl -X POST https://www.upivia.com/v1/service-requests \
  -H "Authorization: Bearer $AGENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "service":"acme",
    "operation":"lookup",
    "payload":{"q":"customer 1234"}
  }'

4. Audit + observability

Every call writes to /audit-logs with request + response previews (PII-scrubbed via the same rules as built-ins). /usage shows aggregate cost by op. Same dashboards, no new tools to learn.