Developer APIs

Applications and scripts reach MetaFabric with an API key or OAuth client, under the workspace's roles, object permissions and scopes.

Use the Data API for applications and scripts. For AI assistants, use MCP.

Connectivity#

The Connectivity page is where admins create and manage everything that connects to MetaFabric from outside.

View	What it is for
Credentials	Every API key and OAuth client in one list, with its workspace, role, scopes and grants. Rotate or revoke from here.
Issue	Create a credential for an application (REST) or an AI agent (MCP). The page shows the base URL and settings to copy.
Activity	Recent calls made with each credential.
Assistants	AI assistants people have connected, and which are allowed to sign in.

Only admins create, rotate and revoke credentials. A secret is shown once, then stored as a hash, so keep it somewhere safe.

Credentials and scopes#

API key (mfk_…)

One key per application. Simplest to use: send it with every request.

OAuth client (mfc_… and a secret)

Exchanges its ID and secret for a short-lived token. Use it where your security policy requires OAuth.

Each credential belongs to one workspace, has one of the five roles, and carries scopes that narrow what it can do.

Scope	Allows
Records	Read or write records
Live updates	Subscribe to change events
Knowledge base	Search, read and add documents, and read the document graph
Mappings	Read or run data migrations
Operations	Read or run console operations

Credentials cannot read classes protected by record owner rules. See Application data foundation.

Quick start#

Every endpoint lives under one base URL for your workspace:

code

https://<your-host>/api/v1/tenants/<workspace-id>

With an API key#

Send the key in the X-API-Key header, or as Authorization: Bearer mfk_….

code

curl -H "X-API-Key: $MF_KEY" \
  https://<your-host>/api/v1/tenants/<workspace-id>/objects

This lists the classes you can read, with record counts. Then query one class:

code

curl -X POST -H "X-API-Key: $MF_KEY" -H "Content-Type: application/json" \
  https://<your-host>/api/v1/tenants/<workspace-id>/objects/Account/mongo/find \
  -d '{"filter": {"Industry": "Banking"}, "limit": 10}'

With an OAuth client#

code

curl -X POST https://<your-host>/api/oauth2/token \
  -d grant_type=client_credentials -d client_id=$MF_CLIENT_ID -d client_secret=$MF_CLIENT_SECRET

Send the returned token as Authorization: Bearer <token>.

Endpoint reference#

The main endpoints, relative to the base URL above. The full reference is in Swagger.

Writes that change more than 20 records, and spreadsheet imports, wait for a person to confirm.

Trying it and limits#

Swagger documents the records and KPI APIs.
The console's Developer API page lets you browse records by class, write queries and copy them as curl, JavaScript or Python, explore related records, and review duplicates.
By default, each credential can make 600 reads and 120 writes per minute. The server can change these limits.