← Back to portal

API & MCP Documentation

Programmatic access to the RidgePoint Customer Portal. Use the REST API for direct HTTP calls, or connect any MCP-compatible AI client to the MCP server.

Base URL

https://customer.ridgepoint.me
  • REST: /api/v1/*
  • MCP (Streamable HTTP): /api/mcp

Authentication

All requests require an API key. Keys are minted by a Super Admin from the API Keys page. Send the key via the Authorization header (preferred) or x-api-key.

Authorization: Bearer rpk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# or
x-api-key: rpk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Scopes & Permissions

Every key is bound to one scope and one or more permissions. Responses are automatically filtered to the key's scope — there is no way to read data outside it.

platform

Full read across all vendors, tenants, customers, and subscriptions. Staff use only.

vendor

Scoped to a single ISV vendor. Sees only its own subscribers and subscriptions.

tenant

Scoped to a single tenant workspace. Sees its own subscriptions, entitlements, and members.

Permissions: read, write, admin, invitations:send, catalogue:read, catalogue:write, catalogue:promote.

REST Endpoints

GET/api/v1/mescope: any

Returns the calling key's id, name, scope, and permissions.

GET/api/v1/statsscope: platform

Counts of vendors, tenants, and active subscriptions.

GET/api/v1/vendorsscope: any

List ISV vendors visible to the key.

GET/api/v1/tenantsscope: any

List tenant workspaces visible to the key.

GET/api/v1/tenants/:id/membersscope: any

List user memberships of a tenant. 404 if not accessible.

GET/api/v1/customersscope: any

List customer organizations visible to the key.

GET/api/v1/subscriptionsscope: any

List subscriptions. Optional query: ?tenant_id=&vendor_id=

GET/api/v1/subscriptions/:idscope: any

Fetch a single subscription by id.

GET/api/v1/subscriptions/:id/entitlementsscope: any

List entitlements attached to a subscription.

POST/api/v1/tenants/:tenant_code/invitations/send-pendingscope: invitations:send

Send pending member invitations. Optional 'emails' array targets specific recipients; omitting it sends all pending invitations up to 'max'.

Example: curl

# List vendors
curl -H "Authorization: Bearer $RIDGEPOINT_KEY"   https://customer.ridgepoint.me/api/v1/vendors

# Subscriptions for a tenant
curl -H "Authorization: Bearer $RIDGEPOINT_KEY"   "https://customer.ridgepoint.me/api/v1/subscriptions?tenant_id=<uuid>"

# Target a single pending invitation
# (requires an API key with the invitations:send permission)
curl -X POST -H "Authorization: Bearer $RIDGEPOINT_KEY"   -H "Content-Type: application/json"   -d '{"confirm": true, "emails": ["kraja@qdb.qa"]}'   "https://customer.ridgepoint.me/api/v1/tenants/QDB/invitations/send-pending"

Example: JavaScript

const res = await fetch("https://customer.ridgepoint.me/api/v1/me", {
  headers: { Authorization: `Bearer ${process.env.RIDGEPOINT_KEY}` },
});
const data = await res.json();
console.log(data); // { key_id, name, scope_type, scope_id, permissions }

Response Shape

List endpoints return { data: [...] }. Errors return:

{ "error": { "status": 401, "message": "Invalid API key." } }

Standard codes: 401 unauthenticated, 403 insufficient permission, 404 not found / not in scope, 500 server error.

MCP Server

Connect any MCP-compatible client (Claude Desktop, IDE plugins, custom agents) using the Streamable HTTP transport. Auth is the same API key.

Endpoint

POST https://customer.ridgepoint.me/api/mcp
Authorization: Bearer rpk_live...
Accept: application/json, text/event-stream
Content-Type: application/json

Claude Desktop config example

{
  "mcpServers": {
    "ridgepoint": {
      "transport": "http",
      "url": "https://customer.ridgepoint.me/api/mcp",
      "headers": {
        "Authorization": "Bearer rpk_live..."
      }
    }
  }
}

Available tools

  • whoami — current key scope & permissions
  • list_vendors
  • list_tenants
  • list_customers
  • list_subscriptions — args: tenant_id?, vendor_id?
  • get_subscription — args: id
  • list_subscription_entitlements — args: subscription_id
  • list_tenant_members — args: tenant_id
  • platform_stats — platform scope only

Rate limits & key hygiene

  • Keys are shown once at creation. Store them in a secret manager.
  • Rotate keys on staff turnover or suspected leak. Revoke from the API Keys page.
  • Use the narrowest scope and permission set that works.
  • Last-used timestamp and IP are tracked per key for audit.