API & endpoints
Endpoint reference
Every HTTP endpoint Actuant serves: the MCP transport, the OAuth flow, the public documents, and the dashboard routes that will reject an API key.
Last updated 2026-08-08
Base URL: https://www.actuant.dev. The apex redirects to www, and redirects are not followed by webhook senders or some HTTP clients — always use the www form in configuration.
MCP transport
| Method | Path | Auth | Notes |
|---|---|---|---|
POST | /api/mcp | Bearer | JSON-RPC 2.0. The whole API. |
GET | /api/mcp | Bearer | Server-sent events for a resumed session. |
OPTIONS | /api/mcp | None | CORS preflight. Returns 204. |
OAuth
| Method | Path | Purpose |
|---|---|---|
GET | /.well-known/oauth-authorization-server | RFC 8414 metadata — issuer and endpoints. |
GET | /.well-known/oauth-protected-resource | RFC 9728 — which authorization server guards this resource. |
GET | /.well-known/oauth-protected-resource/api/mcp | The same, scoped to the MCP resource. |
POST | /oauth/register | RFC 7591 dynamic client registration. |
GET | /oauth/authorize | Consent screen. Authorization code + PKCE S256. |
POST | /oauth/token | Exchange a code for an mca_ token. |
Public — no auth
| Path | Returns | Notes |
|---|---|---|
/llms.txt | text/plain | What Actuant is, for models. The file the audit checks other sites for. |
/api/skills.md | text/markdown | The agent skill: how to use Actuant while building. Cached 1h. |
/agent-prompt | text/plain | A ready-to-paste brief for a coding agent. |
/llms-full.txt | text/plain | Every documentation page as one markdown document. |
/api/status/active | { incidents: [] } | Live incidents. Never throws — an error reads as no incidents. |
/api/benchmark | { avg, count } | Mean score across all completed scans. |
/r/{slug}/badge | image/svg+xml | Score badge for a shared report. 404 unless the report is public. |
All four documents send access-control-allow-origin: *, so an agent or a browser can fetch them cross-origin.
Dashboard only — session cookie
These power the web app's polling. They authenticate with a Clerk session and return 401 to a bearer token. Listed so you stop looking for a way in.
| Path | Equivalent MCP tool |
|---|---|
GET /api/scans/{id} | get_scan |
GET /api/audits/{id} | get_audit |
GET /api/patches/{id} | — (watch the run in the dashboard) |
GET /api/directory-runs/{id} | — (watch the run in the dashboard) |
Internal routes
/api/webhooks/stripe and /api/cron/* also exist. They verify a Stripe signature and a shared secret respectively, are not part of the public API, and are documented here only so nobody mistakes them for an integration point.
Keep reading
Calling it with curl
The Actuant MCP endpoint is JSON-RPC 2.0 over HTTP POST. Initialize, list tools, call a tool — with the exact headers and payloads, and the header everyone forgets.
Errors & limits
Status codes, plan rejections, rate limits, and how audits draw on your weekly allowance and credits — including when a failed run is refunded.
For agents
If you are an AI agent reading this: here is every machine-readable document Actuant serves, what each is for, and the shortest path from zero to a scored audit.