API Access

MCP API tools forward requests to the public API. The client cannot override that upstream. See the public endpoints.

Connecting to MCP uses OAuth by default. API-token URLs with api_key remain available for clients that cannot complete OAuth. Team scope is required only when an API tool call needs to operate inside a team.

Reads

Use vrt_api_read for GET requests.

Team discovery reads and all /partner reads omit team scope. Discovery reads include:

• GET /teams
• GET /teams/lookup
• GET /teams/issues
• GET /teams/{teamId}
• GET /teams/{teamId}/issues

Every other read requires either:

• URL-level team_id as the default team
• tool-level teamId

The worker forwards that value as x-team-id.

Partner Routes

Routes at /partner and /partner/* preserve the partner identity of an API token. The MCP worker does not forward x-team-id for these routes, even when the connection URL has a default team_id or the tool call supplies teamId.

Pass source, target, or filter team ids through the route's documented query or body fields. For example, VRI statement migration uses sourceTeamId and targetTeamId on the /partner/vri-to-vrt/statements/* routes.

Mutations

Use vrt_api_mutation for POST, PATCH, PUT, or DELETE.

Mutations can change data. They require all of the following:

• method set to POST, PATCH, PUT, or DELETE
• a team scope from default URL-level team_id or tool-level teamId, unless the path starts with /partner
• confirm: true

A tool-level teamId can switch teams per call, even when the MCP URL has no team_id.

For read-only assistant workflows, disable vrt_api_mutation in the client when the client supports tool deny lists.

API Shape Discovery

Before calling an endpoint, ask the client to read:

• vrplatform://api/openapi-context
• vrplatform://api/path/<encoded-path>
• vrplatform://api/path/<encoded-path>/<method>

For example:

vrplatform://api/path/%2Freservations
vrplatform://api/path/%2Freservations/GET