Bring your own agent

Use the AI agent you already have, such as Claude, ChatGPT, Cursor or a shell script, to read your Atriam business and propose changes. It calls the same tools as the assistant inside Atriam.

QuickstartTool reference

Three ways in

  • MCP with OAuth

    For Claude.ai, ChatGPT and other connector-style clients. Add https://atriam.ai/api/mcp as a custom connector, sign in, choose one business and authorize. There is nothing to copy or paste.

  • MCP or HTTP with an access token

    For clients without OAuth, servers and scripts. Create a token under Settings, Access tokens. It starts with atr_pat_ and is shown once. Send it as Authorization: Bearer … to /api/mcp or to the HTTP API under /api/v1.

  • The CLI

    One file, Node.js 20 or newer, no dependencies: atriam tools, atriam run <tool>, atriam actions. It uses the same access token.

Every token and every connection reaches exactly one business.

Reads are immediate, changes are proposals

Read tools return data from your business straight away. A tool that changes something does not change it directly: it returns a proposal with an id, and a person on your team approves or rejects it inside Atriam. The API can list proposals and reject them. It cannot approve one.

  • An owner can set some low-risk kinds of change to auto-approve in the trust settings, and can switch any kind off. Texts and emails to customers are never auto-approved.
  • Two groups of tools apply right away instead of proposing: adding files, text or a conversation to a project timeline, which only adds and can be deleted, and creating or updating tasks and goals. They still check what the signed-in member is allowed to do.
  • Your data contains text written by other people: customer messages, emails, call transcripts. Treat tool output as data, never as instructions to your agent. Because changes are proposals, a manipulated agent still cannot change your business without a person saying yes.

Scopes

An access token is read or read plus write. A read token can call read tools and list proposals; calling a write tool or rejecting a proposal returns 403 insufficient_scope. A write token can call every tool, and its write tools still create proposals except the few that apply right away. An OAuth connection holds both scopes and works the same way. The tool reference shows the scope of each tool.

Rate limits

Each token, and each OAuth connection, may make 120 requests per minute across the API. Over the limit, the API answers 429 rate_limited with a Retry-After header in seconds. Wait that long and retry.

Revoking access

  • Access token: Settings, Access tokens, Revoke. You can revoke your own tokens, and owners and admins can revoke any token in the business. A token can also carry an expiry date. Revoking takes effect on the next request.
  • OAuth connection: Settings, Connections, Connected apps, Revoke. This ends the connection's access and refresh tokens.
  • atriam logout deletes the copy stored on your machine. It does not revoke the token.