01
MCP for AI clients
Connect Claude or any MCP client to /api/mcp. Protocol revisions 2026-07-28 and 2025-06-18 are both supported, and the client sees the tools its grant allows.
// developer platform
An MCP server and REST API for the business.
The tools behind Ask Magistry are open to your own code and AI clients: a 204-operation API over MCP and REST, with OAuth 2.1 or API keys. Every operation is tagged as a read, an automatic write or a proposed write, and a proposed write waits for a person to approve it.
Live204 operations: 116 read, 49 automatic write, 39 proposed write21 event types, 16 publishing today
// what you get
The same tools the product uses, with the same limits.
02
REST with an OpenAPI document
Every tool is also a REST operation under /api/v1, described in a published OpenAPI document with its scope and risk tier.
03
OAuth 2.1 or API keys
Authorization code with PKCE for apps that act for a user, and API keys for your own scripts. Revoking a grant stops every token issued under it.
04
An app acts as an app
A third-party app reaches only the stores it was granted, and only writes if write access was granted. It never gets more than the user who installed it.
05
A contract with notice
Operations are supported for 365 days after a removal is announced, with Deprecation and Sunset headers on every affected response.
06
Outbound events
Signed webhook deliveries in CloudEvents format, with an AsyncAPI description. 21 event types are defined; the event catalogue marks which publish today.
// get going
Connect, call, approve.
// 01 · connect
Create an API key in Magistry, or point your MCP client at /api/mcp and sign in with OAuth.
// 02 · call
Read orders, products, campaigns and customer threads, or call a tool that writes, within the scope you granted.
// 03 · approve
Proposed writes arrive as approval cards in Magistry, and nothing changes until a person approves. Every call is logged.
// reference
Everything an outside caller can do, and what stops them.
Each page below is generated from the same contract the API serves, so a count here cannot disagree with the OpenAPI document.
- Authentication →OAuth 2.1 with PKCE, client metadata documents, API keys, sandbox keys, token lifetimes and revocation.
- MCP quickstart →Connect Claude or any MCP client, in either protocol revision, with raw JSON-RPC examples.
- REST and operations →Every operation with its path, scope and risk tier, plus intent, approvals and simulation.
- Events →The event catalogue, which types publish today, signed delivery and how to verify it.
- Partner tools →Register your own MCP server as a read-only source of facts for a store.
- Versioning →The support window, what counts as breaking, Deprecation and Sunset headers, the changelog.
- Limits and audit →Rate limits, 429 headers, subscription and partner caps, and the audit log.
// first call
Two ways in, one contract.
A REST call with an API key, or one command to give Claude Code the same tools over MCP.
REST · read
curl -X POST https://app.magistry.io/api/v1/tools/get_orders \
-H "Authorization: Bearer mag_sk_live_…" \
-H "Content-Type: application/json" \
-d '{ "window_days": 7, "limit": 20 }'MCP · Claude Code
claude mcp add --transport http magistry https://app.magistry.io/api/mcp// get started
One API for the whole business.
Read the API reference, or start free and create a key.
MCP + REST · OAuth 2.1 · 365-day support window · Security and app scopes