Owlbound
Browse the docs

Reference · 3 operations

Meta

Discovery and health. No key needed.

Last updated from API version 2026-10-06 at (live spec, refreshed hourly). openapi.json

meta.health

Check API availability.

get/api/v1/health
Scope
No key needed
Credits
Free
Idempotency-Key
Not used

Responses

200
The API is up. Not enveloped, so load balancers can read it.
Show schema

HealthStatus

  • statusstringrequired
    0
  • timestampstringrequired

    ISO 8601 server time.

    0
  • versionstringrequired
    0
curl "https://app.owlbound.ai/api/v1/health"

meta.openapi

This OpenAPI document.

get/api/v1/openapi.json
Scope
No key needed
Credits
Free
Idempotency-Key
Not used

Responses

200
The OpenAPI 3.1 document, not enveloped.
Show schema

OpenApiDocument

  • openapistringrequired
    0
  • infoobjectrequired
    0
  • pathsobjectrequired
    0
curl "https://app.owlbound.ai/api/v1/openapi.json"

meta.mcp

The Owlbound MCP server (Streamable HTTP).

post/api/v1/mcp
Scope
Any valid key
Credits
Free
Idempotency-Key
none

A remote Model Context Protocol server for AI agents (claude.ai, Claude Desktop, Claude Code, any MCP client). JSON-RPC 2.0 over Streamable HTTP with JSON responses: initialize returns an Mcp-Session-Id, which every later request sends.

Authenticate in Authorization: Bearer with either a v1 API key or an OAuth 2.1 access token (MCP authorization spec 2025-11-25). In claude.ai: Settings > Connectors > Add custom connector, URL https://app.owlbound.ai/api/v1/mcp, then sign in to Owlbound and pick the workspace and scopes (read, enrich, write, act). Without a valid credential the answer is 401 with WWW-Authenticate: Bearer resource_metadata="https://app.owlbound.ai/.well-known/oauth-protected-resource/api/v1/mcp", from which clients discover the authorization server (/.well-known/oauth-authorization-server: dynamic client registration at /oauth/register, PKCE with a SHA-256 challenge, /oauth/token, /oauth/revoke). An OAuth token acts as the member who signed in, in that workspace, with the granted scopes capped by their role; it is accepted here only, not by the REST endpoints. Access tokens last 1 hour, refresh tokens 30 days (rotated). Disconnect an app in Settings > Connected apps.

Tools: one per action of GET /action-types, plus reads of contacts, companies, tables, credits, events, approvals and action runs, limited to the key's or the connection's scopes. Every tool calls this API with that credential, so rate limits, caps, idempotency and the request log apply. Action tools run as the agent principal: every call is a dry run unless apply: true comes with the planId of a dry run of the same session, and send and external-write actions always wait for a person to approve them in the app (the tool returns the approval link). No tool approves, rejects or changes key settings. GET and DELETE are not offered (405).

Parameters

  • Mcp-Session-Idheaderstring

    The session id from initialize (every other request).

  • MCP-Protocol-Versionheaderstring

    The negotiated MCP protocol version.

Request body (required) · application/json

one of

One of

with jsonrpc

  • jsonrpc"2.0"required
    0
  • idstring | integer | null
    0
  • methodstring
    0
  • paramsobject
    0
  • resultany
    0
  • errorobject
    0

array

array of object

Responses

200
The JSON-RPC response (not enveloped).
Show schema

one of

One of

with jsonrpc

  • jsonrpc"2.0"required
    0
  • idstring | integer | null
    0
  • methodstring
    0
  • paramsobject
    0
  • resultany
    0
  • errorobject
    0

array

array of object

202
Notifications only, accepted (no body).
Show schema

Errors

400 Not a JSON-RPC message, a missing session id, or an unsupported protocol version · 401 No credential, or an invalid, expired or revoked key or access token. Carries `WWW-Authenticate: Bearer resource_metadata="...", scope="read enrich write act"` (with `error="invalid_token"` when a credential was sent): sign in again or refresh the token. · 404 Unknown or expired session; initialize again. Every error is {error: {type, code, message, requestId, docUrl}}; see error codes.

curl -X POST "https://app.owlbound.ai/api/v1/mcp" \
  -H "Authorization: Bearer $OWLBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "jsonrpc": "2.0"
}'

← All operations