Archive API docs
esc
    Jump to
    Getting started Token, first query, response Explorer Run queries in the browser items The connection most integrations start with Changelog Additions and deprecations

    Narrow by kind with a prefix — q: queries, m: mutations, t: types, g: guides, f: fields and arguments.

    Security & data handling

    How the MCP server authenticates requests, isolates workspaces, audits writes, and handles your data.

    Transport and credentials

    • One HTTPS endpoint, stateless: no session ID is issued, so every request carries its own credentials.
    • Tokens are opaque and Archive-issued, validated in process — no JWT to decode, no introspection endpoint.
    • A bearer token has write parity with /api/v2. An OAuth 2.1 connection is per-person, and write access exists only if the person granted the write scope at consent.
    • OAuth discovery follows RFC 9728 and RFC 8414, with RFC 7591 Dynamic Client Registration and mandatory S256 PKCE.

    Uniform error responses

    Every authentication failure returns the same message, whether the token is missing, malformed, revoked, or disabled. Workspace-authorization misses are likewise uniform — identical for an unknown UUID, a workspace you’re not a member of, and one outside your grant — so responses can’t be used to probe which credentials or workspaces exist.

    Workspace isolation

    Every tool call resolves exactly one workspace and executes the same resolvers, validation, and workspace scoping as /api/v2. There is no second data path and no second permission model.

    Auditing

    Every write emits exactly one structured audit event, whatever the outcome, carrying the principal identity, the auth strategy, the MCP client name, the result, and any userErrors.

    What a connected agent can read

    Within its granted workspaces: captured content and media, engagement metrics, creator profiles including contact details, and saved views. Read tools return only the fields their schema declares; nothing outside the requested workspace is reachable, and the server does not read your conversation history, files, or memory.

    Collection, use, retention, and third-party sharing are governed by the Archive privacy policy and the terms of service.

    Report a vulnerability

    Email [email protected] with SECURITY in the subject line, a description of the issue, steps to reproduce, and the affected endpoint. We acknowledge reports within two business days. Please don’t test against workspaces you don’t own or access data that isn’t yours.