API Reference

Summand exposes its API through a hosted Model Context Protocol server. Any MCP-aware client — claude.ai, ChatGPT, or your own — can sign in with OAuth and query your datasets, computed-context components, and surprise findings without writing a line of glue code. With your consent, it can also create views, share resources, train models and run other actions. MCP is the documented integration surface.

​

The Summand MCP server

• Endpoint: https://mcp.summand.com/mcp
• Transport: streamable-HTTP
• Auth: OAuth 2.1
• Access model: scoped to whatever the signed-in user can already see in the dashboard — owned datasets plus anything explicitly shared with them

​

What about a REST API?

You can create API keys in Settings → Developer, up to five active keys per user. A key is shown once when you create it and can be revoked at any time. Requests made with a key act as you, with your current role and email, and go through the same OpenFGA authorization as the dashboard. The HTTP API behind them is the one the Summand web app uses and isn’t documented as a public, versioned API. If you have a concrete use case for it, email support@intelligible.ai. Send the key as a bearer token: Authorization: Bearer sk_summand_.... Permissions. A key gets every permission, read-only access, or a set you choose. The permissions use the same names as the MCP server’s scopes: A key can never manage other keys, billing, organization settings or account deletion, whatever its permissions. Those need a signed-in session. Keys created before permissions existed have all of them. Expiry. New keys expire after 90 days unless you pick another period (up to a year) or no expiry. Rate limit. Each key can make 600 requests a minute on average, with bursts of up to 60 at once. Errors. A missing permission, an expired or revoked key, and a key over its rate limit all return 403. The API gateway can’t return a more specific status for a rejected credential. Leaked keys. Keys follow the format sk_summand_ plus 38 characters, the last six of which are a checksum. If a key turns up in a public GitHub repository, GitHub’s secret scanning reports it to us. We revoke it and email you.