At a glance
- Shipped
- October 7, 2026
- REST API
- One operation for each tool, at
https://app.salexhub.com/api/v1, with an OpenAPI document served beside it. - MCP server
- The same tools for agents that speak MCP, at the same address, as a compact listing or a flat one.
- A key
- Issued in Settings, shown once. It acts as the person who made it and never above them.
- Approvals
- A tool that needs a person's approval is refused to a key, not queued.
- Contract
- Marked preview: operations are added in place, and a renamed one keeps answering, marked deprecated.
One registry, one more door
Everything the Agent and workflows do in an organization, they do through one registry of tools: create a record, update a deal, turn a quote into an invoice. From October 7, your own code can call it too.
There is one operation for each tool, and the OpenAPI document that describes each of them is served at /api/v1/openapi.json. If a capability is not in the registry, it is not in the API.
Call a tool with a key
An Owner or Admin issues a key in Settings, and it is shown once. Your code sends it as a bearer token, and the tool's own input as the body. See the API keys docs for the steps and for what a key may do.
- A key acts as a personIt acts at the weaker of its own role and its creator's, checked on every call, and it stops when the creator leaves or is suspended, or when the key expires or is revoked.
- Approvals stay with peopleA key calls the tools that need no approval. A tool that would draw an approval card for the Agent is refused to a key with a 403, and nothing is queued.
- Safe to retrySend an
Idempotency-Keyon a write, and a retry within 24 hours answers from the first result. - Limits you can seeEvery answer carries
RateLimit-Limit,RateLimit-RemainingandRateLimit-Reset, and a body is at most 1 MB.
Agents that speak MCP
The same door speaks MCP over Streamable HTTP, with the same key. By default it lists a few entries to look a tool up and then call it, because the whole catalogue would spend much of a model's context before anyone typed a word. A flat listing, one MCP tool for each operation, is there for a client that filters the list itself.
Every call is recorded with the key, the address and the time.
What is not here yet
The TypeScript SDK is generated from the same contract and is not published. The MCP door streams nothing from the server: a GET to it answers 405.