---
title: "The SalexHub API and MCP server are open | SalexHub"
description: "The tools the Agent and workflows use now answer your own code and agents that speak MCP, with a key you issue in Settings. The same permissions apply."
url: "https://salexhub.com/news/api-and-mcp"
kind: "Announcement"
published: "2026-10-07"
release: "The API and the MCP server are open"
---

# The API and the MCP server are open

The registry of tools the Agent and workflows act through now answers your own code, and any agent that speaks MCP. One key, the permissions of the person who issued it, and approvals still held for people.

Shipped 2026-10-07. [Read the release in the changelog](https://salexhub.com/changelog#2026-10-07-the-api-and-the-mcp-server-are-open).

## At a glance

- Shipped: October 7, 2026
- REST API: One operation for each tool, at `https://app.salexhub.com/api/v1`, with an OpenAPI document served beside it.
- MCP server: The same tools for agents that speak MCP, at the same address, as a compact listing or a flat one.
- A key: Issued in Settings, shown once. It acts as the person who made it and never above them.
- Approvals: A tool that needs a person's approval is refused to a key, not queued.
- Contract: Marked preview: operations are added in place, and a renamed one keeps answering, marked deprecated.

## One registry, one more door

Everything the Agent and workflows do in an organization, they do through one registry of tools: create a record, update a deal, turn a quote into an invoice. From October 7, your own code can call it too.

There is one operation for each tool, and the OpenAPI document that describes each of them is served at `/api/v1/openapi.json`. If a capability is not in the registry, it is not in the API.

## Call a tool with a key

An Owner or Admin issues a key in Settings, and it is shown once. Your code sends it as a bearer token, and the tool's own input as the body. See [the API keys docs](https://salexhub.com/docs/developers/api-keys) for the steps and for what a key may do.

- **A key acts as a person.** It acts at the weaker of its own role and its creator's, checked on every call, and it stops when the creator leaves or is suspended, or when the key expires or is revoked.
- **Approvals stay with people.** A key calls the tools that need no approval. A tool that would draw an approval card for the Agent is refused to a key with a 403, and nothing is queued.
- **Safe to retry.** Send an `Idempotency-Key` on a write, and a retry within 24 hours answers from the first result.
- **Limits you can see.** Every answer carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`, and a body is at most 1 MB.

## Agents that speak MCP

The same door speaks MCP over Streamable HTTP, with the same key. By default it lists a few entries to look a tool up and then call it, because the whole catalogue would spend much of a model's context before anyone typed a word. A flat listing, one MCP tool for each operation, is there for a client that filters the list itself.

Every call is recorded with the key, the address and the time.

## What is not here yet

The TypeScript SDK is generated from the same contract and is not published. The MCP door streams nothing from the server: a GET to it answers 405.

The picture at the top of the page: A request from a developer's own code to the SalexHub API: a POST to the record list tool with the API key as a bearer token, asking for ten contacts. The key acts as Dana Whitfield, the person who issued it.

---

The same page for people: https://salexhub.com/news/api-and-mcp. Index of this site for agents: https://salexhub.com/llms.txt