Developers
Build on docivault — API and AI access
Does docivault have an API?
What it covers
The same things you do in the app, as requests
Each area below has its own section in the reference, with the method, path, who may call it, the parameters, the body and the responses.
MCP
Let an AI assistant read your workspace
The MCP server wraps the read endpoints of this API. It runs with the same personal API token and the same permissions, so an assistant never sees more than you do.
Server URL: https://docivault.com/mcp. Authenticate with a Bearer token. Claude Code:
claude mcp add --transport http docivault https://docivault.com/mcp --header "Authorization: Bearer $DOCIVAULT_TOKEN"Claude.ai and Claude Desktop connectors need OAuth sign-in, which is not available yet.
list_documents: List documents. Needs the documents:read scope.get_dashboard: Get the workspace dashboard. Needs the documents:read scope.list_requests: List document requests. Needs the requests:read scope.get_request: Get one document request. Needs the requests:read scope.list_clients: List clients. Needs the clients:read scope.list_categories: List categories. Needs the categories:read scope.get_activity: Get workspace activity. Needs the activity:read scope.
Access and safety
Your permissions travel with every request
- A request acts as one person and sees only the contacts, spaces and documents that person may open in the app.
- Downloading a document stays a separate, admin-granted permission, and every download is logged.
- Writes from a browser must come from docivault itself; the API checks the request origin.
- Limits apply per person and per workspace. Responses use standard status codes: 400 invalid input, 401 not signed in, 403 not allowed, 404 not found, 409 conflict, 429 too many requests.
Questions
Common questions about the API
How do I authenticate API requests?
Create a personal API token in your workspace under Developers and send it as a Bearer token. A token acts as you, with at most the access you have in the app, and you can revoke it at any time.
Can a token see more than I can?
No, by design. Every request is checked against the same access rules as the app: your role, the contacts you are assigned to, and the spaces you may open. The API is another way to reach the same data, not a wider one.
Is there an MCP server for AI assistants?
Yes. The docivault MCP server at https://docivault.com/mcp exposes the same permissions as the API, under the same tokens. It is read-only today.
Where is the machine-readable description?
At /openapi.json, an OpenAPI 3.1 document of the endpoints listed in the reference. It is generated from the same source as the reference page.
Build on your own documents
Start a free workspace, then read the reference to see what you can automate.
- No credit card
- Free plan, no expiry
- The people you exchange with are free