# KeepInTracks

> Business operations platform for Canadian SMBs — jobs, invoices, POS, customers, and more.

KeepInTracks exposes a **read-only** public API and an MCP server so assistants and integrators can query tenant data with a scoped API key. Staff UI routes (`/api/*`) are not the partner contract.

## Docs

- [Public OpenAPI (v1)](https://keepintracks.com/openapi/public-v1.json): machine contract for `GET /v1/*`
- [Website](https://keepintracks.com): product and pricing
- [Security contact](https://keepintracks.com/.well-known/security.txt)

## Public read API

- Base URL: `https://{slug}.keepintracks.com/v1` (or the tenant's custom business hostname)
- Auth: `Authorization: Bearer ak_live_…` — create keys in Settings → API keys (owner)
- Scopes (additive): `contacts.read`, `invoices.read`, `quotes.read`, `sales.read`, `jobs.read`, `products.read`, `expenses.read`, `payments.read`, `vendors.read`
- Entities: contacts, invoices, quotes, sales, jobs, products, expenses, payments, vendors (list + get)
- Rate limits: per-IP and per-key platform caps
- Metering: successful `/v1` reads and MCP tool calls share a monthly per-tenant credit allowance (hard cap; Settings → API keys shows usage)

## MCP (agents)

- Endpoint: `https://{slug}.keepintracks.com/mcp` (Streamable HTTP)
- Auth: same Bearer tenant API key as `/v1`
- Tools (read-only):
  - `list_records` — `entity` + optional cursor/limit/filters
  - `get_record` — `entity` + `id` (uuid)
- Scope gate: each call requires the matching `{entity}.read` scope
- No write tools in v1

## Optional

- [Store API OpenAPI](https://github.com/Keepin-Tracks/keepin-app/blob/develop/openapi/store-v1.json): headless storefront (`/store/v1`), separate store API keys