Agent access

SaaS Pro Max exposes 238 Management API operations and 239 shared commands through the HTTPS API and both MCP transports. The 44 MCP tools include live discovery, so an agent can find new features without waiting for a dedicated tool to be added to its client.

Use get_api_capabilities to find reads and direct writes. Search list_commands for settings, workflows and protected actions. Always inspect the returned schema before calling an operation. A catalog entry describes a capability; your token, current membership and role determine whether you can use it.

Coverage#

Commands execute the console's existing business handlers. This preserves validation, audit events, revision checks, protected resources and any two-person approval requirements. A build check rejects console actions that are missing from the command catalog.

Routine commands#

Commands whose execution is direct in list_commands and get_command_schema run at once: call execute_command (or POST /commands/{id}/execute) with the target, fields and reason, and no authorizationId. They need a member's personal or OAuth token with write or admin scope, run under the member's current permissions, and are audited with the token that ran them. A command is routine only when it creates, edits, toggles or re-runs something another routine action can put back. Deletions, credentials, reveals, external delivery, membership, identity, billing and anything that needs a fresh passkey are never routine. These are routine today:

• saving a funnel or a conversion goal;
• creating, editing and hiding chart notes;
• saving, archiving and restoring saved reports and dashboards;
• saving a feature flag, turning it on or off in one environment, and previewing its evaluation;
• error triage: setting an issue's status, snoozing, assigning, undoing your own recent change, and setting the status of up to 100 issues at once;
• saving and pausing uptime monitors and alert rules;
• creating evaluation datasets, adding cases, changing their status, and re-syncing connector prompts;
• editing a person, saving and refreshing a segment, and previewing a segment's matches;
• previewing a destination's payload or a transformation, and saving a transformation template;
• drafting, previewing and submitting a campaign for approval, and pausing one;
• drafting this period's partner payout batch;
• re-syncing an enabled revenue connector;
• asking the assistant, rating, pinning or sending its answers for review, restoring a conversation deleted in the last ten minutes, and withdrawing your own standing allowances;
• checking the connector's health;
• saving cross-domain journey origins and telemetry sampling and limits;
• renaming an application or changing its address, platform or timezone, showing or hiding sidebar entries, and re-checking a model provider credential.

These stay behind approval:

• removing a note, note sources (GitHub and social), and crawler and replay settings;
• archiving or restoring a flag;
• source map uploads;
• acknowledging or resolving an incident, because either stops on-call paging;
• notification channels and test sends;
• infrastructure and profile queries;
• evaluation runs and human reviews;
• person notes, bulk person edits and CSV exports;
• creating, editing, enabling, mapping, testing or retrying a destination;
• data integrations and data sources;
• scheduling, sending, resuming or cancelling a campaign, retrying a delivery, and lifecycle journeys;
• the partner program's terms, deciding on partners, and cancelling or paying a payout batch;
• enabling, disabling or changing a revenue connector;
• deciding on the assistant's proposed actions, assistant policy, and deleting a conversation;
• acquisition, search, data imports, SLOs, logs and the connector's keys, URL and account controls;
• browser checks, experiments, feedback, flag delivery, groups, investigations, load tests, on-call, RUM, surveys and operations;
• public shares, the organization's model catalog, and your notifications;
• retention, allowed origins and enabled modules;
• workspace identity;
• every delete.

More modules follow as each is reviewed.

Protected actions#

Ordinary API writes continue to use their documented scopes. A console-only API operation lists the command that performs it as command in get_api_capabilities (x-saaspro-command in OpenAPI). Every other command is protected. A protected command uses a member's personal or OAuth token with write or admin scope and a one-time passkey approval. Service tokens and the internal assistant's temporary credentials cannot use a member's approval. Account and platform commands require an unbound personal admin token; an organization-bound OAuth connection cannot manage global account settings.

1. Call list_commands with a feature search, following nextOffset until it is null when you need the whole catalog.
2. Call get_command_schema with the exact command ID.
3. Call prepare_command with the target, fields and reason. Preparation returns authorizationId and approvalUrl; it does not execute anything.
4. The member opens that URL, authenticates with a fresh passkey and reviews the action. This is a focused approval page; the member need not navigate the application dashboard.
5. Poll get_command_authorization. When it is approved, call execute_command with the unchanged input and authorizationId.

Approval expires ten minutes after preparation. It is bound to the exact member, token, command, organization, application, environment and input digest. Execution rechecks the token, current permissions and active passkey session. A grant is claimed once, including when two calls race. Changing a field or reason requires a new approval. Domain approvals, such as a second operator's campaign approval, remain separate requirements.

The corresponding HTTP endpoints are:

For example, after inspecting apps.general, prepare this body:

{
  "org": "acme",
  "app": "acme/site",
  "environment": "production",
  "fields": {
    "name": "Acme site",
    "platform": "web",
    "url": "https://example.com",
    "timezone": "UTC"
  },
  "reason": "Update the application display name and canonical URL"
}

After approval, send the same body to the execute endpoint with the returned authorizationId added. For MCP calls, also include commandId: "apps.general". Results retain the existing action's JSON, including any one-time reveal value. Store a revealed credential securely; it cannot be retrieved again.

Input and result formats#

fieldsSchema describes form inputs; fields are strings or repeated arrays of strings. jsonFields describes the JSON that must be serialized into the corresponding string field. repeatedFields, fileFields and supplemental contracts describe inputs outside the main form validator. Omit org, app and _csrf from fields: verified target values are supplied by the server.

Files use files[fieldName] = { name, contentType, base64 }, with a maximum of 4 MiB per file and the command's own total body limit. Credentials are redacted from approval previews, large content is represented by a digest and files by metadata plus a digest. Review the original content in the client as well.

Downloads return JSON with their content type and text or base64 data. Streaming command responses are consumed into structured events with bounded size and duration. A slow or interrupted external action may have taken effect: inspect its status and target before preparing another action. Mutations are never automatically retried.

Identity and security boundaries#

Google sign-in, initial OAuth consent and enrolling or verifying a physical passkey require the person. Browser appearance and command-palette navigation are browser-local conveniences. These are not remotely executable commands. All tenant reads still enforce module access and PII permissions. Vault secrets are not readable, raw IP addresses are not exposed, and protected deletions keep their confirmation and approval rules.

Cookieless reporting has no on/off setting. Use get_cookieless_status and get_cookieless_install_instructions: Analytics must be enabled and the application's server must send events to the dedicated endpoint. Installing that server integration requires a deployment of the application being tracked.

Adding a feature#

Register reads in the shared API route table with their permissions and schemas. Use the console form helpers for actions, then add a command catalog entry and route loader. Add JSON, repeated-field or file contracts when needed. scripts/check-agent-coverage.ts runs before every web build and detects unregistered console routes and intents. API and MCP discovery use these live registries, so feature access cannot depend on a second hand-written tool list.