## What

Adds two durable reference docs to the Curogram skill and links them from `SKILL.md`:

- `references/official-api.md` — Curogram's **official AI Calls-to-Actions API**: base host, the `/actions/<token>` + `/calls-summary/<token>` endpoints (token-in-URL auth), the exact `POST /actions/<token>` request schema (`phoneNumber`/`firstName`/`lastName`/`dob`/`actionId`/`gender`), the mapped actionIds table, the support-guide link, and caveats (POST-only, side-effecting, no read path, PHI in body, must stay human-approval-gated). Also documents that the EMR "Public APIs" token is AdvancedMD-writeback plumbing, NOT a usable API.
- `references/v2-tools-guide.md` — forward-looking catalog of **potential MCP tools to build later**, grouped by area (messaging, mass-texting [now ON], patients incl. DOB-disambiguation, appointments/recalls, tasks, surveys, templates, analytics/KPIs, AI-actions trigger). Each entry: what it'd do, backing endpoint (cookie/XSRF RE'd vs the official actions API), readiness, and risk/gating. Clearly marked "reference / not yet built."

## actionIds mapping result

Navigated **read-only** to Settings → AI Calls to Actions in the owner (super-admin) Curogram session. The page exposes `/actions/<token>` and `/calls-summary/<token>` (same practice token). **Zero Actions are currently defined** ("There is currently no Action defined in this list"), so there are no per-Action `actionId` UUIDs to map yet. The endpoint + schema are documented; the actionIds table is empty with that explicit finding and instructions to re-scan once Actions exist.

## Safety

- Read-only on Curogram — no action fired, no setting toggled, no message sent.
- No secrets / PHI in docs: the practice token is referenced by env-var NAME only (`CUROGRAM_AI_ACTIONS_PRACTICE_TOKEN`); verified the actions/EMR token GUID values do not appear in either file.
- Companion to the existing `v2-plan.md` + `api-docs-and-settings.md` references.

🤖 Generated with [Claude Code](https://claude.com/claude-code)