API Access

MCP API tools forward requests to the public API. The client cannot override that upstream. See the public endpoints.

Connecting to MCP uses OAuth by default. API-token URLs with api_key remain available for clients that cannot complete OAuth. Team scope is required only when an API tool call needs to operate inside a team.

Reads

Use vrt_api_read for GET requests.

Team discovery reads can omit team scope:

• GET /teams
• GET /teams/lookup
• GET /teams/issues
• GET /teams/{teamId}
• GET /teams/{teamId}/issues

Every other read requires either:

• URL-level team_id as the default team
• tool-level teamId

The worker forwards that value as x-team-id.

Mutations

Use vrt_api_mutation for POST, PATCH, PUT, or DELETE.

Mutations can change data. They require all of the following:

• method set to POST, PATCH, PUT, or DELETE
• a team scope from default URL-level team_id or tool-level teamId
• confirm: true

A tool-level teamId can switch teams per call, even when the MCP URL has no team_id.

For read-only assistant workflows, disable vrt_api_mutation in the client when the client supports tool deny lists.

API Shape Discovery

Before calling an endpoint, ask the client to read:

• vrplatform://api/openapi-context
• vrplatform://api/path/<encoded-path>
• vrplatform://api/path/<encoded-path>/<method>

For example:

vrplatform://api/path/%2Freservations
vrplatform://api/path/%2Freservations/GET