REST API

The dashboard is a client of this API. Anything you can do by clicking, you can do from a pipeline with an API key.

Base URL and format

HTTP

https://api.meetext.xyz/v1
authorization: Bearer $MEETEXT_API_KEY
content-type: application/json

JSON in, JSON out. Timestamps are ISO 8601 with an offset. Identifiers are UUIDs. The complete generated specification is served at /openapi.json, which is the authority when this page and the API disagree.

API keys

Method and path	Does
GET /v1/auth/api-keys	List keys, by prefix and label.
POST /v1/auth/api-keys	Create a key. The plaintext value is returned once and never again.
DELETE /v1/auth/api-keys/{key_id}	Revoke a key immediately.
GET /v1/auth/me	The principal and organization a key resolves to.

Products and sources

Method and path	Does
GET /v1/products	List products.
POST /v1/products	Create a product with a name and slug.
GET /v1/products/{product_id}	One product with its sources and targets.
PATCH /v1/products/{product_id}	Rename or update metadata.
POST /v1/products/{product_id}/sources	Connect an MCP server, OpenAPI document or repository. Pass discover_now to run discovery inline.
POST /v1/products/{product_id}/sources/{source_id}/rediscover	Re-introspect and compare the fingerprint against the stored one.
POST /v1/products/{product_id}/sources/{source_id}/candidates	Promote repository scan candidates into capabilities.
POST /v1/products/{product_id}/sources/{source_id}/adapter	Generate an adapter pull request for the source.
DELETE /v1/products/{product_id}/sources/{source_id}	Disconnect a source.
PUT /v1/products/{product_id}/targets	Configure a destination and its app credentials.
GET /v1/products/{product_id}/preflight	Everything that would make an installation fail, before you send a link.
POST /v1/products/{product_id}/publish	Freeze the approved capability set into a versioned deployment package.
GET /v1/products/meta/source-types	The source types this deployment supports.

Capabilities

Enabling a capability that no longer exists in the source returns 409.
Method and path	Does
GET /v1/products/{product_id}/capabilities	Every discovered capability with its risk level, selection and approval state.
POST /v1/products/{product_id}/capabilities/{capability_id}/selection	Enable or disable. Enabling a read capability approves it.
POST /v1/products/{product_id}/capabilities/{capability_id}/approval	The second approval, required for write and destructive capabilities.

The rules behind the risk levels are on the Capabilities page.

Customers and environments

Method and path	Does
GET /v1/customers	List customers.
POST /v1/customers	Create a customer with a name and slug.
GET /v1/customers/{customer_id}	One customer and its environments.
POST /v1/customers/{customer_id}/environments	Create a customer environment for one product and one destination. Returns the installation link.
GET /v1/environments	List environments across customers.
GET /v1/environments/{environment_id}	One environment with its health layers and current deployment.
GET /v1/environments/{environment_id}/mcp-token	The bearer token for this environment's MCP access.
POST /v1/environments/{environment_id}/mcp-token/rotate	Issue a new token and invalidate the old one.
POST /v1/environments/{environment_id}/deployments	Redeploy the current published package into this environment.

Deployments

Method and path	Does
GET /v1/deployments	List deployments, filterable by state.
GET /v1/deployments/{deployment_id}	One deployment with its state, checks and evidence.
POST /v1/deployments/{deployment_id}/validate	Run the validation suite now and return the report.
DELETE /v1/deployments/{deployment_id}	Remove the installation from the customer's workspace.
GET /v1/meta/deployment-states	The state vocabulary, so a client never hardcodes it.

Shell

curl -X POST "$MEETEXT_API/v1/deployments/$DEPLOYMENT_ID/validate" \
  -H "authorization: Bearer $MEETEXT_API_KEY"

Returns the target state and every check outcome, each with its detail and remediation.

Fleet, incidents and audit

Method and path	Does
GET /v1/fleet	Every environment with its health layers, in one call.
GET /v1/fleet/metrics	Aggregate counts by state and health.
GET /v1/fleet/credentials	Credential expiry and rotation risk across the fleet.
GET /v1/incidents	Open and resolved incidents with detection and resolution method.
GET /v1/environments/{environment_id}/timeline	Milestones, phase, elapsed time and attribution.
GET /v1/environments/{environment_id}/changes	What changed on this environment and when.
GET /v1/logs	Execution and deployment log entries.
GET /v1/audit	The immutable audit history.
GET /v1/dashboard	The summary the dashboard home renders.

Security reviews and credentials

Method and path	Does
POST /v1/environments/{environment_id}/security-review	Open a review case for one customer environment.
GET /v1/environments/{environment_id}/security-review	The current review document.
POST /v1/security-reviews/{case_id}/snapshots	Capture a snapshot of what the deployment accesses right now.
POST /v1/security-reviews/{case_id}/shares	Issue a shareable link for one snapshot.
DELETE /v1/security-reviews/{case_id}/shares/{share_id}	Revoke a share.
GET /v1/security-reviews/renewals	Reviews whose snapshot no longer matches the deployment.
GET /v1/credentials	Credential families and their expiry.
POST /v1/credentials/{family_id}/rotations	Start a rotation, optionally validated by a canary before activation.
POST /v1/rotations/{rotation_id}/activate	Promote the new credential.

Errors and idempotency

Status	Means
400	The request body could not be read.
401	Missing or invalid API key.
403	Authenticated, but not permitted.
404	Not found, including anything belonging to another organization. Cross tenant reads never return 403.
409	A conflict with current state: enabling a removed capability, or an invalid deployment transition.
422	The body was valid JSON but the wrong shape.
429	Rate limited.

Installation and webhook handling are idempotent. A retried delivery or a repeated callback never creates a second installation, which is what makes it safe to run this API from a pipeline that retries on failure.

Errors carry a detail string written to be shown to a person. Where a failure has a remediation, the remediation is part of the payload rather than something to look up.