APIs
Componecat exposes two programmatic surfaces — a REST API for scripts and
integrations, and an MCP server for AI agents. They share the same
authorization model, so a token’s access means the same thing on either one. The
examples below use the hosted host, https://app.componecat.ai; substitute your
own instance’s host if you self-host.
The REST API at /api/rest/v1 is the programmatic surface for CI/CD pipelines,
scripts, and external systems. It’s authenticated with a personal access token and
covers the core catalog operations — browsing, search, and the mutations behind
everything you can create or change.
https://app.componecat.ai/api/rest/v1Catalog search takes the same query language
the UI does — pass the expression as q to GET /catalog/search:
/api/rest/v1/catalog/search?q=lifecycle:production AND NOT tag:deprecatedA machine-readable OpenAPI schema is published for tooling and SDK generation:
https://app.componecat.ai/api/rest/v1/openapi.jsonThe Model Context Protocol server at /api/mcp is the surface built for AI
agents — a tool catalog plus a browsable entity resource tree, with OAuth device
flow authorization. Its search_catalog tool takes the same
query language as the UI and the REST
API, so an agent can express an entire question in one call. See
Connect AI agents for the full walkthrough.
https://app.componecat.ai/api/mcpAuthentication
Section titled “Authentication”Catalogs are private and organization-scoped, so every surface requires authentication.
- Personal access tokens — bearer tokens you create in your access-token settings. Used by the REST API and by non-interactive MCP clients.
- OAuth device flow — the standard flow for interactive MCP agents, with dynamic client registration and automatic authorization-server discovery.
Tokens are scoped: you grant read or write access per resource category (catalog entities, teams, schema), and can scope a token to specific entities. Grant the least access that does the job.