Skip to content
Developers
AvailableAPI 1.0 is live.

For developers

REST and MCP from one registry.

The REST routes, the MCP tools, the OpenAPI document and these docs come from the same definitions the server runs. Problem details on every error, safe retries, dry runs and human approvals are built in.

Read the quickstartAPI reference
Terminal
# The contract: public, no key needed
curl -s https://api.tobie.team/v1/openapi.json -o openapi.json

# Plan a write without running it
curl -s -X PATCH https://api.tobie.team/v1/tasks/$TASK_ID \
  -H "Authorization: Bearer $TOBIE_API_KEY" \
  -H "Prefer: dry-run" \
  -H "Content-Type: application/json" \
  -d '{"status":"in_progress"}'

What you get

The parts you would otherwise build yourself.

  • REST and MCP, one registry

    Every MCP tool is a REST operation with the same input schema, scope and annotations. They cannot drift apart.

  • OpenAPI 3.1, public

    Fetch /v1/openapi.json without a key and generate a client. llms.txt gives agents a map.

  • Problem details everywhere

    Every error is RFC 9457 application/problem+json with a stable code, a request ID and whether to retry.

  • Safe retries and dry runs

    Idempotency-Key makes retries safe. Prefer: dry-run returns the plan and writes nothing.

How it works

From key to first write.

The same four steps work for a script, a service or an agent.

  1. Step 1: Get a credential

    Operators create a key in the dashboard. Customer and partner developers get one from their Tobie contact.

  2. Step 2: Call /v1/meta first

    It returns your effective scopes and client scope, so your code knows what it may do.

  3. Step 3: Read, then plan writes

    Page through reads with cursors. Send writes with an Idempotency-Key, and dry-run them when unsure.

  4. Step 4: Let a person approve

    Some writes return 202 with an approval. Poll it; a person decides in Tobie.

Guarantees

A contract you can build on.

  • Additive inside /v1

    New fields and operations never break /v1. Breaking changes ship as /v2, and /v1 stays at least six months after.

  • Truthful results

    MCP annotations mark read-only, destructive and idempotent honestly, and every result says whether it ran, planned or waits for approval.

  • Keys built to be lost

    Hashed at rest, shown once, 90-day expiry, IP allowlists and instant revoke.

  • Every call on the record

    Who, which credential, which login method, which tool. Never bodies, never secrets.

Questions

Questions people ask.

Something else on your mind? Write to hello@tobie.team.

Is the OpenAPI document public?
Yes. https://api.tobie.team/v1/openapi.json is OpenAPI 3.1 and needs no key. Agents can also read llms.txt.
Should I use REST or MCP?
Both run the same operations with the same scopes. Use MCP when an AI app is the caller, and REST for scripts, services and HRIS syncs. See the MCP server guide.
How do I get an API key?
Tobie operators create one at dashboard.tobie.team, under Settings, then API keys. Everyone else gets one from their Tobie contact. A self-serve console is rolling out.
What happens when a write needs approval?
You get 202 Accepted with an approval you can poll. Nothing has happened yet. A person approves or rejects it in Tobie; there is no API to approve your own write. See Approvals.
How do errors and retries work?
Every error has a stable code and says whether it is retryable. Retry a write with the same Idempotency-Key and it will not run twice. See Errors and Idempotency.

Make your first call in five minutes.

The quickstart takes you from nothing to a first answer with curl. The reference has every operation, scope and error.

Read the quickstartAPI reference