> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traxy.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Preview current account permissions in selected workspaces.

> Read-only authenticated preview. The request token stays in the body. Each workspace must pass current membership and MCP availability checks.



## OpenAPI

````yaml /api-reference/customer-api-mcp-v1.openapi.yaml post /mcp/oauth/authorize/permissions
openapi: 3.0.3
info:
  title: traxy Customer API and MCP V1
  version: 1.0.0
  description: >
    Public customer-facing read API, Ordinal Audience Analytics endpoints, and

    remote MCP Streamable HTTP endpoint. Customer REST and Ordinal requests use

    bearer API keys. MCP uses OAuth access tokens issued for the traxy MCP

    resource; Customer API keys are never accepted by MCP. Public REST clients
    must

    not send organizationId. Default API keys cover the general read API.

    Ordinal Audience Analytics is self-serve for paid workspaces and requires

    explicitly selected audience_analytics scopes on the key.

    The MCP surface exposes scope-gated tools through tools/list, including

    agent:read tools for safe automated lead-finding agent visibility. Latest

    MCP protocol version is 2025-11-25.
servers:
  - url: https://api.traxy.ai/api/v1
    description: Production
security:
  - CustomerApiKey: []
tags:
  - name: Customer REST
  - name: Ordinal Audience Analytics
  - name: MCP OAuth
  - name: MCP
paths:
  /mcp/oauth/authorize/permissions:
    post:
      tags:
        - MCP OAuth
      summary: Preview current account permissions in selected workspaces.
      description: >-
        Read-only authenticated preview. The request token stays in the body.
        Each workspace must pass current membership and MCP availability checks.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/McpOAuthAuthorizationPermissionsRequest'
      responses:
        '200':
          description: >-
            Available scope ceiling and per-workspace scopes. Response is not
            cacheable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/McpOAuthAuthorizationPermissions'
        '400':
          $ref: '#/components/responses/ValidationFailed'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/InsufficientCapability'
      security:
        - SupabaseUserJwt: []
components:
  schemas:
    McpOAuthAuthorizationPermissionsRequest:
      type: object
      additionalProperties: false
      required:
        - requestToken
        - organizationIds
      properties:
        requestToken:
          type: string
          minLength: 32
          maxLength: 256
        organizationIds:
          type: array
          minItems: 1
          maxItems: 50
          items:
            type: string
            format: uuid
    McpOAuthAuthorizationPermissions:
      type: object
      required:
        - scopes
        - workspaces
      properties:
        scopes:
          $ref: '#/components/schemas/McpConsentScopes'
        workspaces:
          type: array
          minItems: 1
          maxItems: 50
          items:
            type: object
            required:
              - organizationId
              - scopes
            properties:
              organizationId:
                type: string
                format: uuid
              scopes:
                $ref: '#/components/schemas/McpConsentScopes'
    McpConsentScopes:
      type: array
      maxItems: 20
      items:
        type: string
        enum:
          - leads:read
          - leads:contact_read
          - leads:contact_enrich
          - leads:manage
          - analytics:read
          - icp:read
          - icp:manage
          - watchlist:read
          - watchlist:manage
          - content:read
          - integrations:read
          - integrations:manage
          - integrations:deliver
          - sync:read
          - agent:read
          - agent:run
          - workspace:read
          - audience_analytics:read
          - audience_analytics:request
          - post_qualification:manage
    ErrorEnvelope:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - status
            - request_id
          properties:
            code:
              type: string
              example: invalid_api_key
            message:
              type: string
              example: Invalid API key.
            status:
              type: integer
              example: 401
            request_id:
              type: string
  responses:
    ValidationFailed:
      description: Request failed boundary validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Unauthorized:
      description: Invalid, expired, or revoked API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    InsufficientCapability:
      description: Key or OAuth grant lacks the required scope.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
  securitySchemes:
    CustomerApiKey:
      type: http
      scheme: bearer
      bearerFormat: trxy_live_<public_id>_<secret>
      description: >-
        API key created from Integrations > API & MCP > API keys. Used for
        Customer REST and Ordinal Audience Analytics, not MCP OAuth.
    SupabaseUserJwt:
      type: http
      scheme: bearer
      bearerFormat: Supabase JWT
      description: Authenticated traxy app session token used by the consent screen.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.