MCP

Base URL https://api.flam.fashion. Send Authorization: Bearer flam_sk_… on every call; a handful of routes are session-only and say so. How keys and roles work.

POST /api/mcp

MCP server (Streamable HTTP, JSON responses)

Model Context Protocol endpoint. Send JSON-RPC 2.0: initialize, tools/list, tools/call, ping. Authenticate with an organisation API key (Authorization: Bearer flam_sk_…) or a session cookie — scope, role and 403s are identical either way. Notifications (no id) are answered 202 with an empty body. No SSE: a develop is started here and watched with the get_develop tool or the existing jobs WebSocket.

Request body — application/json

{
  "jsonrpc": "2.0",
  "id": "string",
  "method": "string",
  "params": {}
}

Responses

200 returns:

{
  "jsonrpc": "2.0",
  "id": "string",
  "result": null,
  "error": {
    "code": 0,
    "message": "string"
  }
}

Call it

curl -X POST "https://api.flam.fashion/api/mcp" \
  -H "Authorization: Bearer $FLAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":"string","method":"string","params":{}}'