Skip to main content

​
Authentication

  • Humans: session cookie
  • Dev header mode: X-Coco-User
  • Agents: Authorization: Bearer <key|token>
All page/space routes are ACL-checked.

​
MCP door

POST /mcp exposes the same operations as context_* tools (context_get_shared_page, context_set_page_metadata, context_query_pages_by_metadata, context_list_metadata_keys, …) with identical ACL outcomes.

​
Route summary

Pages

Read, create, update, versions, links, metadata.

Spaces

List, pages, export/import, broken links.

Search

Full-text and metadata queries.

Admin

Webhooks, templates, org space templates.