Skip to content
Componecat Docs

APIs

Componecat exposes two programmatic surfaces — a REST API for scripts and integrations, and an MCP server for AI agents. They share the same authorization model, so a token’s access means the same thing on either one. The examples below use the hosted host, https://app.componecat.ai; substitute your own instance’s host if you self-host.

REST

Section titled “REST”

The REST API at /api/rest/v1 is the programmatic surface for CI/CD pipelines, scripts, and external systems. It’s authenticated with a personal access token and covers the core catalog operations — browsing, search, and the mutations behind everything you can create or change.

https://app.componecat.ai/api/rest/v1

Catalog search takes the same query language the UI does — pass the expression as q to GET /catalog/search:

/api/rest/v1/catalog/search?q=lifecycle:production AND NOT tag:deprecated

An entity’s current scorecard results — score, attained level, and a per-rule pass/fail breakdown — are available alongside its other sub-resources:

GET /api/rest/v1/catalog/{id}/scorecards

Scorecards themselves — the standards, not just the results — are a resource too: list them, read one’s definition (scope, rules, weights), or pull its rollup report (distribution, breakdown by team/kind/ladder level, per-rule failure counts, and the score trend, matching the app’s Report tab):

GET /api/rest/v1/scorecards
GET /api/rest/v1/scorecards/{id}
GET /api/rest/v1/scorecards/{id}/report

This surface is read-only, the same as the MCP scorecard tools — defining a standard is done from the organization-settings UI.

A machine-readable OpenAPI schema is published for tooling and SDK generation:

https://app.componecat.ai/api/rest/v1/openapi.json

MCP

Section titled “MCP”

The Model Context Protocol server at /api/mcp is the surface built for AI agents — a tool catalog plus a browsable entity resource tree, with OAuth device flow authorization. Its search_catalog tool takes the same query language as the UI and the REST API, so an agent can express an entire question in one call. See Connect AI agents for the full walkthrough.

https://app.componecat.ai/api/mcp

Authentication

Section titled “Authentication”

Catalogs are private and organization-scoped, so every surface requires authentication.

  • Personal access tokens — bearer tokens you create in your access-token settings. Used by the REST API and by non-interactive MCP clients.
  • OAuth device flow — the standard flow for interactive MCP agents, with dynamic client registration and automatic authorization-server discovery.

Tokens are scoped: you grant read or write access per resource category (catalog entities, teams, schema), and can scope a token to specific entities. Grant the least access that does the job.

Section titled “Related”