List the resources this API exposes

GEThttps://<your-url>/api/v2

MCP id discovery

Returns one entry per resource available to your organisation, with its collection URL, its templated item URL, its permission prefix, the OpenAPI schemas that describe it and the operations it registers.

Token scope: api:read
Without it: 403 insufficient-token-scope.
Permission: None. The record's own rules still apply.
Rate cost: 1 unit, read bucket.
Also: If-None-Match answers 304 when nothing changed. Cacheable: private, max-age=300. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: Discover the API

curl -X GET \
  'https://<your-url>/api/v2' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->get('https://<your-url>/api/v2');

import requests
response = requests.request(
    'GET',
    'https://<your-url>/api/v2',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

The shape of the response, with sample values.

{
  "data": [
    {
      "name": "…",
      "path": "…",
      "item_path": "…",
      "permission_prefix": "…",
      "summary_schema": "…",
      "detail_schema": "…",
      "operations": [
        "…"
      ]
    }
  ],
  "meta": {
    "page": {
      "per_page": 1,
      "next_cursor": "…",
      "prev_cursor": "…",
      "total": 1,
      "current_page": 1,
      "last_page": 1
    }
  },
  "links": {
    "self": "https://<your-url>/api/v2/work-items/1",
    "next": "https://<your-url>/api/v2/work-items/1",
    "prev": "https://<your-url>/api/v2/work-items/1"
  }
}

Resources belonging to a feature your organisation does not have are omitted. Not every entry is an endpoint you can call: the list does not depend on your token's scope or your permissions, so a listed operation can still answer 403, and a null path or item_path means the resource has no such URL. It needs a valid token but no permission.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

viewstring

Which field set to render.

summarydefaultdetail

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-None-Matchstring

The ETag a read is conditional on. A match is answered 304 with no body.

Response 200

Returns a DiscoveryEntry in the summary view.

Headers

ETag: A weak validator (W/"…") of the rendered page.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning