Remote MCP endpoint (Streamable HTTP)

POST

/mcp

curl --request POST \
  --url https://api.sloose.com/mcp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'

• Production

A Model Context Protocol server, so an agent can read your schema and write templates under the same rules the widget follows — a gate the widget honours and this does not would not be a gate.

Stateless: each request builds a server scoped to the bearer’s organisation and tears it down again.

Getting a token. This API is an OAuth 2.1 authorisation server for MCP clients: point a client at this URL with no token and the 401 carries the RFC 9728 challenge naming /.well-known/oauth-protected-resource/mcp, from which the client discovers /.well-known/oauth-authorization-server, its authorisation and token endpoints, and that it may register by Client ID Metadata Document (its client id is the HTTPS URL of a JSON document describing it — no manual registration, no dynamic registration). The person signs in on the account app, chooses which organisation the client may use, and consents; the access token is a JWT bound to this resource and to that organisation, and works here at the role the person holds in the organisation for as long as they hold it. A session token or an organisation API token still work as bearers too.

Tools

• list_modules — the organisation’s enabled modules and their vocabulary
• get_fields — a module’s fields and annotations; long picklists sampled, searchable by option
• propose_matching — how an existing record is recognised, per module: one validated rule each
• propose_mapping — a validated mapping proposal for a set of columns; takes the keys as context
• test_expression — compile and run an expression against sample rows (one that reads records is compiled only)
• validate_template — check a template configuration without saving it
• list_templates — templates visible to the caller
• get_template — one template, migrated to the current schema
• save_template — create or update a template
• list_imports — the imports that write through a connection, newest activity first
• get_import — one import as it stands: its version, files, columns, mappings, match rules and value maps
• apply_import_mapping — set or clear one field’s mapping on one file of an import, under its version
• apply_import_match — set how one file’s rows meet a module’s existing records, under the import’s version
• apply_import_value_map — set or remove one value map entry of an import, under its version
• check_import_recipe — check an import’s recipe against its connection and its files’ columns (not its rows)
• validate_import — check an import’s rows as the page’s Validate step does, within a stated size limit; read-only, and a clear result is not a promise the run will succeed

The request and response bodies are JSON-RPC envelopes defined by the MCP specification, not by this document. The specification also uses GET (to open a stream) and DELETE (to end a session) on this same path; both are served, but only POST is described here, because OpenAPI 3.1 cannot say “any method” and a GET operation carrying a JSON-RPC body would not be true.

Authorizations

• sessionAuth
• apiTokenAuth

Request Body^required

A JSON-RPC request.

Media typeapplication/json

A JSON-RPC request, per the MCP specification.

object

Example^generated

{}

Responses

200

The tool result.

Media typeapplication/json

A JSON-RPC response, per the MCP specification.

object

Example^generated

{}

401

No bearer, or one that is expired, revoked or no longer resolves to a member. Carries WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp", the RFC 9728 challenge an MCP client starts its authorisation from.

403

A good bearer that may not act here: an OAuth token not granted the mcp scope (INSUFFICIENT_SCOPE), no longer a member of the organisation (NOT_A_MEMBER), or suspended (BANNED) — or any bearer whose organisation’s plan does not include MCP (FEATURE_MCP: Business and Enterprise, and a trial).

503

The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed value: MAINTENANCE

Example

{
  "code": "MAINTENANCE"
}

Headers

Retry-After

integer

Seconds until asking again is worth it (300 while the switch is on).