{"openapi":"3.1.0","info":{"title":"GrydBase MCP API","version":"0.1.0","description":"Authenticated Streamable HTTP MCP transport for GrydBase service business CRM. Tool schemas come from tools/list. Workspace permissions are separate consent grants, not OAuth request scopes.","contact":{"name":"GrydBase support","email":"support@grydbase.com","url":"https://app.grydbase.com/contact"}},"servers":[{"url":"https://app.grydbase.com"}],"externalDocs":{"description":"GrydBase developer and authentication documentation","url":"https://app.grydbase.com/developers"},"components":{"securitySchemes":{"supabaseOAuth":{"type":"oauth2","description":"Authorization code with S256 PKCE. Select GrydBase business permissions on the consent screen; never send their names as OAuth request scopes.","flows":{"authorizationCode":{"authorizationUrl":"https://xijuiqodlmclagpzcbjc.supabase.co/auth/v1/oauth/authorize","tokenUrl":"https://xijuiqodlmclagpzcbjc.supabase.co/auth/v1/oauth/token","scopes":{"openid":"Supabase OAuth identity scope: openid","profile":"Supabase OAuth identity scope: profile","email":"Supabase OAuth identity scope: email","phone":"Supabase OAuth identity scope: phone","offline_access":"Supabase OAuth identity scope: offline_access"}}},"x-grydbase-consent-permissions":{"workspace:read":"See clients, jobs, and invoices","email:read":"Read email threads","email:send":"Send email on your behalf (replies and new messages)","linkedin:post":"Publish posts to your LinkedIn (after you approve each one)","linkedin:analytics":"Read your LinkedIn post analytics","social:read":"See your connected social accounts and posts","social:post":"Publish to your connected social accounts (after you approve each post)"}}}},"paths":{"/api/mcp":{"post":{"operationId":"mcpRequest","summary":"Initialize MCP, list authorized tools, or call a tool","security":[{"supabaseOAuth":[]}],"description":"Requires a verified user token, live workspace consent grant, eligible role, and enabled integration. Send Accept: application/json, text/event-stream. Business access depends on the saved consent grant and tool-specific entitlements.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["jsonrpc","method"],"properties":{"jsonrpc":{"const":"2.0"},"id":{"type":["string","number"]},"method":{"type":"string"},"params":{"type":"object"}}}}}},"responses":{"200":{"description":"JSON-RPC response or SSE response","content":{"application/json":{"schema":{"type":"object"}},"text/event-stream":{"schema":{"type":"string"}}}},"202":{"description":"Notification accepted"},"400":{"description":"Invalid MCP request"},"401":{"description":"Token required or invalid","headers":{"WWW-Authenticate":{"schema":{"type":"string"},"description":"RFC 9728 protected-resource metadata pointer"}}},"403":{"description":"Origin, role, consent grant, or feature disallows access"},"404":{"description":"Workspace or resource not found"},"406":{"description":"Client must accept application/json and text/event-stream"},"500":{"description":"Server or configuration failure"}}}}},"x-grydbase-permission-model":{"type":"workspace-consent-grant","selectionUrl":"https://app.grydbase.com/oauth/consent","permissions":{"workspace:read":"See clients, jobs, and invoices","email:read":"Read email threads","email:send":"Send email on your behalf (replies and new messages)","linkedin:post":"Publish posts to your LinkedIn (after you approve each one)","linkedin:analytics":"Read your LinkedIn post analytics","social:read":"See your connected social accounts and posts","social:post":"Publish to your connected social accounts (after you approve each post)"}}}