Build with AtlaSynq

Stable public REST at https://staging.api.atlasynq.com/api/public/v1. The workspace always comes from the API key. Do not pass organization_id.

Public OpenAPI — https://staging.api.atlasynq.com/api/public/v1/openapi.json

• Authentication
• Scopes
• Errors
• Pagination
• Idempotency
• Automation API
• Webhook guide
• Event types
• Verify signatures
• Retry behavior

Authentication

Send an API key as a Bearer token. Keys look like atq_live_•••••••• in deployed environments and atq_test_•••••••• locally.

Authorization: Bearer $ATLASYNQ_API_KEY

Scopes

Grant access scopes on the API key (leads:read, automations:execute, and the rest of the public catalog). Missing scopes return insufficient_scope. Publishing an automation requires both automations:write and automations:execute.

Errors

Public errors use { "error": { "code", "message", "request_id" } }. Unknown or cross-workspace ids return resource_not_found.

Pagination

Lists return data, next_cursor, and has_more. There is no fake global total.

Idempotency

Creates and high-impact writes require an Idempotency-Key UUID. Retrying the same key and body does not duplicate the write.

Automation API

Draft → validate → test → publish. Test is a side-effect-free simulation. Publish changes live behavior. Trigger runs an already-active automation and may perform real configured actions.

AtlaSynq MCP is a remote HTTPS server. Cursor, ChatGPT, and Claude all call the same URL with a Bearer API key. MCP uses the same access scopes as the public API. The workspace is taken from the authenticated principal — never from a client-supplied organization id.

API-key auth is the supported path today. There is no generic HTTP, SQL, or eval tool. Directory or app-store Connect for Cursor, ChatGPT, and Claude is not verified here.

• Business
• Leads
• Appointments
• Conversations
• Automations
• Developer docs
• Webhooks

MCP URL: https://staging.api.atlasynq.com/mcp

For compatible OAuth-enabled clients, AtlaSynq can authorize access using your existing account and workspace permissions.

That is not the same as every agent host shipping an AtlaSynq connector. Cursor, ChatGPT, Claude, and Codex are documented with the API-key MCP path. Directory or app-store Connect for those clients is not verified here.

An API key is the supported way to call MCP and REST today. Do not assume a client can skip the API key.

Receive signed business events from AtlaSynq in real time. Delivery is at-least-once. Consumers should deduplicate by event ID.

Create an HTTPS endpoint in Settings → Developers or with the public API. Signing secrets are shown once. AtlaSynq POSTs asynchronously — lead and appointment writes do not wait on your server.

Event types

• lead.created
• lead.updated
• appointment.created
• appointment.updated
• conversation.message.received
• lead.email.unanswered
• automation.completed
• automation.failed

Verify signatures

Each POST is signed with HMAC-SHA256. Canonical payload is timestamp.raw_body. Header X-AtlaSynq-Signature is v1=<hex>. Reject timestamps older than 300 seconds.

Retry behavior

Up to 8 attempts with exponential backoff. Timeouts, 408, 429, and 5xx are retried. Most 4xx responses are not. Retries keep the same event ID.

Manage developer access

Settings → Developers is the control plane. Create and revoke API keys, choose access scopes, and copy the MCP URL, REST API base, and public OpenAPI URL for this environment.