Path: /docs/api

Orchestrator exposes same-origin HTTP APIs from the Next.js app. Browser sessions use Auth.js cookies. Agents and CLIs use Bearer tokens.

Base URL

Production: https://getorchestrator.app

Local: http://127.0.0.1:7000 (or your configured port)

Authentication

Browser (humans)

Sign in at /login. Session cookies are issued by Auth.js (next-auth v5). Protected HTML routes redirect to login. Protected /api/* routes return JSON 401 with { "error": "Unauthorized" } (not an HTML redirect).

Bearer token (agents / CLI)

http
Authorization: Bearer <ApiToken>

Create tokens in the product UI. Never commit tokens to git or tickets.

Session check

bash
curl -sS https://getorchestrator.app/api/auth/session \
  -H "Cookie: <session-cookie>"

MCP HTTP

Preferred agent surface. See MCP Server.

Method	Path	Purpose
GET	/api/mcp/health	Liveness
GET	/api/mcp/tools	Tool list + schemas
POST	/api/mcp	Streamable MCP transport

Always send Authorization: Bearer … in production.

Example:

bash
curl -sS https://getorchestrator.app/api/mcp/tools \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Account and projects (session)

These routes expect a signed-in browser session (or equivalent cookie).

Method	Path	Purpose
GET	/api/teams	List teams (org accounts) for the user
POST	/api/account/switch	Set active team cookie
GET	/api/admin/account/members?accountId=	List members for a team
PATCH	/api/admin/account/members	Update member roles
GET	/api/projects/{code}/board	Board payload for a project code or id
GET	/api/projects/access?projectId=&accountId=	Check team access to a project

Project {code} may be a human code (ORC) or a legacy cuid. Prefer codes in clients.

Errors

Status	Meaning
401	Not authenticated
403	Authenticated but not allowed
404	Resource missing for this team
409	Ambiguous project code across teams

Related

• Getting Started
• CLI Reference
• MCP Server