Your code drafts. A person approves the send.
Call 100+ Workspace369 tools over HTTP, push leads in from any form, and get signed webhooks when work changes. Anything that would reach a client waits in Approvals until someone says yes.Starting from scratch? See how to build a CRM with AI on Workspace369.
14-day free trial. Card required. After the trial: $149/month for Specialist. Renews automatically every month until you cancel. Cancel anytime in Settings → Billing.
MCP and personal access tokens on every plan; the REST Builder API and webhooks on Specialist and up.
Plain HTTP, real answers, clear refusals.
Every Workspace369 tool is an HTTP call: POST /v1/tools/{name}, or REST shortcuts for clients, proposals, invoices, contracts, projects and more. Pick a call to see what comes back.
- Authenticate with a personal access token: Authorization: Bearer mcp_pat_…
- One error shape for every refusal, with a code your code can branch on
- No DELETE anywhere in the API
Request
GET /v1/clients?query=acme&limit=5
Authorization: Bearer mcp_pat_••••
Response
200 OK
{
"clients": [
{ "id": "cl_93Fa", "name": "Acme Co",
"email": "billing@acme.test", "lifecycle_stage": "client" }
]
}Reads come straight back. Results page with a cursor.
Pick the events. Verify every delivery.
Add an endpoint in Settings › Webhooks, pick from 21 events, and copy the signing secret once. Every delivery is a signed JSON POST.
- Signed
- X-Webhook-Signature is an HMAC-SHA256 of the raw body plus X-Webhook-Timestamp, made with your signing secret. Rotate the secret any time.
- Retried
- Answer with a 2xx within 10 seconds. Otherwise the delivery is retried up to 5 times with the same X-Webhook-Id.
- Safe to repeat
- Deliveries can arrive out of order or more than once, so skip any X-Webhook-Id you have already handled.
What your endpoint receives
Tokens with limits you choose, and nothing hidden.
Once an admin turns on AI connections, any member can create a personal access token. It carries only the scopes and the expiry they pick, and the workspace can see and stop it.
- Never more than its creator
- Every call is checked live against the member's role, so a token can't do what its creator can't.
- Every call is logged
- The call log records the app, member, tool, scope, outcome and AI usage. It keeps field names, never the values.
- Admins can revoke any token
- Workspace admins see every member's tokens. A revoked token stops working immediately.
- Limits you can plan for
- Up to 120 calls a minute per token and 600 per workspace, shared with MCP. Over the limit you get a 429 with Retry-After.
Built for the systems around your workspace.
MCP and personal access tokens work on every plan. The REST Builder API at mcp.workspace369.com/v1 and webhooks are on Specialist and up.
Compare plans| Plans | Cadet$29/mo | Voyager$74/mo | Specialist$149/mo | Commander$299/mo | Enterprise$699/mo | |
|---|---|---|---|---|---|---|
| MCP and personal access tokens | Every plan | Included | Included | Included | Included | Included |
| Builder API and webhooks | Specialist and up | Not included | Not included | Included | Included | Included |
Each call through the API or MCP uses a little of your workspace's AI usage. Failed or refused calls use none.
FAQ
Questions about API workflows
How does my code call Workspace369?
On Specialist and up, the Builder API at https://mcp.workspace369.com/v1 offers every tool as an HTTP call (POST /v1/tools/{name}), plus REST shortcuts for clients, proposals, invoices, contracts, projects, tasks, requests and calendar events. On every plan, your code can call the MCP endpoint over JSON-RPC. Both use a personal access token and run the same permission checks, approval holds and call log.
Is there an OpenAPI spec?
Yes. The Builder API's OpenAPI spec is public at https://mcp.workspace369.com/v1/openapi.json, with no sign-in, so code generators and AI app builders can read every path, input and response.
How is this different from MCP?
It runs the same tools. AI apps such as Claude and ChatGPT connect to the MCP endpoint and sign in with OAuth; your own code uses a personal access token, over MCP or the Builder API.
Can my code email clients by itself?
Not by default. Sending proposals, contracts, invoices and messages, and turning a request into a client, return 202 and wait for a person to approve them in the app; a request expires after an hour. The person who connected can turn on “send without asking” for that connection.
What are the rate limits?
Up to 120 calls a minute per token and 600 a minute per workspace, shared with MCP. Over the limit the API answers 429 with a Retry-After header. The inbound lead API has its own limit of 100 requests a minute per workspace.
Which plans include API access?
MCP, including personal access tokens, works on every plan. The REST Builder API and webhooks are on Specialist ($149/month, 10 seats) and up. Each call through the API or MCP uses a little of your workspace's AI usage. Failed or refused calls use none.
Keep exploring
Related pages
Point your code at a workspace that waits for a yes.
Create a personal access token on any plan and call Workspace369 over MCP today. The REST Builder API and webhooks are on Specialist and up.
14-day free trial. Card required. After the trial: $149/month for Specialist. Renews automatically every month until you cancel. Cancel anytime in Settings → Billing.