API & endpoints
The Actuant API
What Actuant exposes over HTTP: an MCP server for programmatic use, a set of public endpoints that need no auth, and dashboard-only routes that will reject an API key.
Last updated 2026-08-08
Everything programmatic lives at https://www.actuant.dev. There are three tiers, and knowing which one you are talking to saves the most common hour lost here.
The three tiers
| Tier | Auth | What it is |
|---|---|---|
MCP — /api/mcp | act_ key or OAuth token | The programmatic API. JSON-RPC 2.0 over Streamable HTTP. Every audit, report and fix runs through here. |
| Public | None | Badge SVG, status, benchmark, and the machine-readable documents agents fetch. |
| Dashboard | Clerk session cookie | Poll endpoints the web app uses. Not reachable with an API key. |
There is no REST API for audits
This is the thing worth reading twice. /api/scans/{id} and /api/audits/{id} exist, return clean JSON, and appear in your network tab — so they look like the API. They authenticate with a Clerk session cookie. An act_ bearer key gets 401 Unauthorized from them and always will.
Use MCP, not the poll routes
If you want to run an audit from a script, a CI job, or another service, you want the MCP endpoint. It is a normal HTTP POST with a JSON body — you do not need an MCP client library to call it.
Why MCP is the whole API
Rather than maintain a REST surface and an MCP surface that drift apart, there is one. The 52 checks, the crawl, the metering, the plan gates and the reports are all reached the same way whether the caller is Claude Code, a cron job, or curl.
The practical consequence: anything an agent can do, a script can do, with the same credentials and the same responses.
Keep reading
Authentication
Two credentials reach the MCP endpoint: a manual act_ API key for scripts and CI, or an OAuth token your agent obtains itself. Both are bearer tokens on the same endpoint.
Calling it with curl
The Actuant MCP endpoint is JSON-RPC 2.0 over HTTP POST. Initialize, list tools, call a tool — with the exact headers and payloads, and the header everyone forgets.
Endpoint reference
Every HTTP endpoint Actuant serves: the MCP transport, the OAuth flow, the public documents, and the dashboard routes that will reject an API key.