Steplane's APIs

Two ways in for software, both on the same domain functions as the web app (packages/domain), acting as a person with their permissions:

• MCP server at https://steplane.app/api/mcp, for AI assistants such as Claude. Sign-in is OAuth, or a personal API key in X-Api-Key. The tools are listed in MCP tools.
• REST API at https://steplane.app/api/v1, for scripts and integrations, with a personal API key in X-Api-Key. It's described by its OpenAPI file at steplane.app/api/v1/openapi.json.

Rules both follow:

• Keys: create them under Account → API keys. A read key can't change anything; organizations can refuse keys altogether (Settings → AI access).
• Versions: every change names the process version it's based on. A process changed since then is refused (REST: 409), so nothing overwrites newer work.
• AI change policy: under "drafts only", publishing and recording reviews through a key or an AI client is refused (REST: 403).
• Attribution: published revisions record the person and the client, such as "Anna Jensen via Claude (MCP)" or via API key "Weekly report" (REST).
• Errors (REST): { error, code } with 400 (invalid), 401 (no or bad key), 403 (not allowed), 404 (not found) or 409 (changed since).