https://app.fortvision.com/api/v1
Every request needs a bearer token created in the app under Integrations → Programmatic access. Only the workspace owner can create, rotate or revoke tokens; the secret is shown exactly once at creation and stored server-side only as an HMAC-SHA256 hash.
Authorization: Bearer fvmcp_…
| Property | Value |
|---|---|
| Scopes | Chosen at creation; a request outside the token's scopes returns 403 forbidden. |
| Expiry | 90 days by default, up to 365 days. Expired or revoked tokens return 401 unauthorized with a WWW-Authenticate: Bearer header. |
| Active tokens | At most 25 per workspace. |
| Identity | The token acts as the user who created it and can never see more than they can. The workspace is resolved from the token — never from the request; ids from another workspace return 404. |
| Audit | Every call is logged (who, which operation, outcome), visible to the workspace admin under Integrations. |
LLM clients can use the same capabilities over the Model Context Protocol — OAuth 2.1 + PKCE — see the MCP connector docs.
| Limit | Default | On exceed |
|---|---|---|
| Per token | 120 requests / minute | 429 with {"ok":false,"error":{"code":"rate_limited","message":"…"}} |
| Per workspace (all tokens) | 600 requests / minute |
Every list operation takes page and pageSize (max 100) and returns a pagination object; there is no way to request an unbounded result set.
{ "ok": false, "error": { "code": "not_found", "message": "…" } }
Codes: invalid_input · unauthorized · forbidden · not_found · conflict · rate_limited · unavailable · timeout · internal — always with a matching HTTP status. Send an x-request-id header to correlate a call with its audit entry.
curl -H "Authorization: Bearer fvmcp_…" \
"https://app.fortvision.com/api/v1/workspace"
curl -H "Authorization: Bearer fvmcp_…" \
"https://app.fortvision.com/api/v1/leads?status=new&pageSize=50"
The exact paths and parameters for every operation are in the reference below (the OpenAPI document is the source of truth).