Integration API reference

Connect with scoped API keys and webhooks, or authorize an AI assistant through OAuth MCP. Both stay within your current workspace permissions. The REST endpoint list below comes from the running API’s OpenAPI document.

Open the raw OpenAPI document Connect an AI assistant with MCP Manage developer access

Watch the walkthrough

Who acts: Authorized Owner or Admin; integration developer

Go straight to the steps

Connect an integration with narrow, repeat-safe access. Written steps follow below. — Silent tutorial · Captions included · Recorded interactions in the actual interface.

Follow the steps.

Prepare a named integration key
The recording types a descriptive key name in Developer access without creating a key. Before choosing permissions, use the live API schema for exact operations, bodies and grants. If the schema cannot load, restore the API connection; this recording does not snapshot or replace the running reference.
Open the live OpenAPI document
Choose one least-privilege scope
The recording checks one native scope control without submitting. In your workspace, select only necessary scopes and create the key as an authorized user. Store the once-shown secret in a secret manager, never browser code. Keys inherit current access and cannot provide client signatures or consent.
Open developer access
Set expiry and preserve request identity
The recording sets an explicit key expiry without creating a secret. For actual mutations, use an Idempotency-Key and expectedVersion on edits and decisions. Retry the same body with the same key; after a version conflict, reload the permitted record and review before a new decision. Expiry never expands authority.
Verify webhooks and monitor access
If needed, Register a webhook with a public HTTPS/443 endpoint and selected events, then acknowledge its signed verification event. Verify timestamp and signature, deduplicate event IDs and inspect Delivery history. Revoke unused API keys and disable obsolete endpoints.

What changes when you finish

The integration operates within current grants and an explicit version/idempotency contract. At-least-once webhook delivery requires consumer deduplication; no secret or live provider success is demonstrated here.

Give your AI assistant a scoped view of the work

The walkthrough above covers the integration API, API keys and webhooks. MCP is a separate OAuth connection: use your Moolamochi origin followed by /api/mcp in an MCP client that supports OAuth. Do not paste an API key, session cookie or password into a chat.

Connect and sign in. Add the remote MCP endpoint in your client, then follow its OAuth authorization flow to Moolamochi. The connection uses authorization code flow with S256 PKCE.
Choose one workspace and review the requested access. The consent applies only to that workspace. mcp:read allows supported reads of records you already have permission to see. Optional mcp:drafts additionally allows supported draft preparation; leave it off when you only need answers. If requested and approved, offline_access allows refresh access rather than expanding business permissions.
Ask for a summary or prepare a draft. For example, ask the assistant to summarize permitted project work. With draft access, have it prepare a supported draft, then open Moolamochi to review the result. The available tools and current permissions determine what it can do; an assistant answer is not proof of provider completion.
Review or revoke the connection. Manage authorized connections in Developer access. Workspace membership, session and grant revocation are checked on new requests. Revoke unused connections; copies already shared with an external client cannot be recalled.

No client consent, invoice issuance or payments. MCP has no tools to sign agreements, approve scope or delivery for a client, issue invoices, collect payments or make refunds. Draft permission does not grant those actions, and it never rewrites issued money.

Only connect an assistant you trust with the permitted data it will receive. Its own data-handling policies also apply. A declined authorization or unavailable connection is not a successful connection; resolve it before relying on workspace answers.

Review developer access and connections

Authenticate with narrow authority

Create a key with only the required permissions and keep it in a server-side secret store. Send it in the Authorization: Bearer header. Expiry and revocation apply to every new request. A workspace ID in the URL never grants tenant access, and a key cannot impersonate a human client’s commercial or delivery consent.

Retain the identity of a mutation

Send Idempotency-Key for business mutations. If a network response is uncertain, retry the same body with the same key. Reusing a key with a changed body yields 409 IDEMPOTENCY_CONFLICT. Edits and decisions also supply expectedVersion; stale records return 409 VERSION_CONFLICT rather than overwriting a newer decision.

Verified outbound webhooks

Register a public HTTPS endpoint and selected event types in developer settings. Delivery is at least once. Deduplicate the stable Moolamochi-Event-Id and verify the timestamp and HMAC in Moolamochi-Signature against the untouched incoming request body: t=<unix-seconds>,v1=<HMAC-SHA256(secret,t+'.'+rawBody)>. Store the signing secret privately and reject stale timestamps. Redirects, private network destinations and arbitrary credential-bearing headers are not supported.

Published endpoint contracts

The running API reference could not be loaded. The guidance below remains available, but endpoint details are not being substituted with an example schema. Retry this page or open the raw OpenAPI document.

Retry loading the live reference

Need an operation that is not listed?

The published schema is the reference for this running deployment. Do not guess an endpoint from a documentation example or send real secrets to an online request playground. Contact support with the intended operation and a redacted request ID.

Ask an API question