Two surfaces, one set of credentials. Use REST for partner TMS/ERP integrations and Integration Hub connectors. Use MCP to wire AI agents (Zo, Claude Desktop, LangChain, Cursor) into facility operations.
Plain-JSON, read-only endpoints over the same data as MCP. Built for partner TMS/ERP integrations and Integration Hub connectors that don't speak JSON-RPC 2.0.
GET endpoints (scheduling + freight), OpenAPI 3 spec, Swagger UISingle JSON-RPC endpoint exposing 25 tenant + 9 platform resources, ~12 tools (auto-confirm and HITL). Built for AI agents that read state and propose actions.
tools/list, resources/list for live discovery/api/mcp/manifest.json| Use case | Recommended surface | Why |
|---|---|---|
| Partner TMS/ERP polling for appointments or facility state | REST | Predictable HTTP semantics, codegen-friendly OpenAPI spec, ETag/Link/If-None-Match for cheap polling |
| Integration Hub connector reading from Dock Optimizer | REST | Same auth as MCP, simpler client code, no JSON-RPC envelope |
| AI agent that reads state and creates appointments | MCP | Tool calling (tools/call) + resource reads (resources/read) in one protocol; idempotency keys for safe retries |
| AI agent that proposes risky actions (door blocks, flags, reports) | MCP | Built-in HITL queueing — actions wait for admin approval before executing |
| Inventory receipts / issues / cycle counts from a WMS agent | MCP | Audited transactions with agent attribution, real-time SignalR broadcast to org users |
| Reporting dashboard polling for org-wide metrics | REST + MCP | REST for stable JSON shapes; MCP resources/read for richer data-quality and operations summaries |
Both surfaces share one credential, one rate-limit bucket, one audit trail. A single API key works against both — you don't generate separate keys for REST and MCP.
| Concern | Where |
|---|---|
| Authentication & key types | Detailed on each surface page; same Bearer token model |
| Rate limits (60/min, 1000/day, optional per-hour write ceiling) | Shared bucket per key; documented on each surface page |
Audit logging (AgentAuditLogs) | Every authenticated call from either surface; REST entries prefixed REST_GET |
Key management (/api/agent-keys/*) | Admin-cookie endpoints for generate/rotate/revoke |
| Discovery | MCP manifest · OpenAPI spec · Swagger UI |
scopes: "read" first, set contactEmail, set expiresAt 90 days out, copy the do_live_… token (shown once).tools/list + resources/list.scopes: "read,write" and the minimum capabilities array your agent needs.