MJS Developer Portal

Developer portal

Automation APIs with default-deny access

Integrate with MJS using scoped tenant keys, interactive sessions, and a curated set of REST endpoints under /api/v1. Module APIs require a valid tenant entitlement for the relevant module.

Start with authentication Browse API reference

Base URL and versioning

All documented routes are prefixed with /api/v1. Use HTTPS only. Requests must target your tenant’s deployed platform hostname (provided during onboarding).

https://<your-tenant-host>/api/v1/automation/health

Two ways to call the API

Interactive browser session

Sign in with passkeys/WebAuthn or optional Kerberos/SPNEGO (when enabled). The platform sets an httpOnly session cookie (mjs_access). Unsafe HTTP methods require a CSRF double-submit token (X-CSRF-Token).

Session details

Tenant automation keys

Server-side scripts and CI use Authorization: Bearer mjt_… keys with least-privilege scopes (moduleKey + READER, OPERATOR, or ADMIN). Keys are created in-product; the secret is shown once.

Key management

Do not embed long-lived automation keys in browsers, mobile apps, or public repositories. Use short-lived server-side credentials and rotate on schedule.

Wave-1 automation surfaces

Tenant keys work only on explicitly allowlisted routes. The first wave focuses on health checks, capability discovery, integration hub visibility, and integration connection lifecycle.

  • GET /api/v1/automation/health — liveness for automation clients
  • GET /api/v1/automation/capabilities — scopes and paths your key may call
  • Integration hub overview and credential readiness (READER)
  • Integration connections: list, create, revoke, and event history

Platform operators may use separate mjs_ platform keys for monitoring and alerting configuration; these are not issued to customers for tenant automation.

Next steps

  1. Read Security for tenant isolation, rate limits, and audit expectations.
  2. Provision a tenant automation key via an interactive session (API key management).
  3. Call /automation/capabilities to confirm allowlisted paths for your scopes.
  4. Implement integrations using the API reference and Webhooks guide.

Need module-specific APIs?

Beyond wave-1 automation, each licensed module exposes its own API surface under tenant entitlement. Contact your platform administrator to confirm module activation and scope requirements.