The public REST API is the same tool registry that powers Otto and the MCP server, exposed as one uniform endpoint: POST /api/v1/tools/{tool}. One shape for every call means anything new in the registry is immediately callable — no waiting for a bespoke endpoint.
Minting a key
- 1Open Settings → Developers and create a key. Keys are prefixed mag_sk_live_ and shown once — store it in your secrets manager, not your code.
- 2Pick the key's scopes at creation. Start from the read bundle unless you know you need writes.
- 3The Developers page also shows the full tool catalog, each tool tagged read, write, or write-approval — so you can see what a scope actually unlocks before granting it.
Calling a tool
curl -X POST https://app.magistry.io/api/v1/tools/get_store_overview \
-H "Authorization: Bearer mag_sk_live_..." \
-H "Content-Type: application/json" \
-d '{}'The machine-readable spec lives at /api/v1/openapi.json — point your client generator or your agent at it and the whole surface is typed.
Scopes
Scopes are fine-grained per resource and action — ads:read, catalog:write, and so on — with read, write, and admin bundles when you want the broad grant. A key holds exactly the scopes you gave it: a reporting integration with ads:read cannot touch your catalog, no matter what code sits behind it. Tools tagged write-approval behave like propose_write everywhere else: the call creates an approval card in the dashboard rather than executing directly.
Limits
Rate limit is 120 requests per minute per credential. That's generous for operational integrations and deliberately tight for anything trying to use the tools API as a bulk-export firehose — for heavy analytical reads, sync into your own store of record instead of hammering the tool surface.