Developer reference

Zaprep MCP developer reference

Endpoint, OAuth, API keys, write behaviour and errors for anyone building an MCP client or debugging a connection.

Endpoint and transport

URL: https://www.zaprep.com/api/mcp
Transport: Streamable HTTP, stateless. One JSON-RPC request per POST. GET returns 405: there is no standalone server-to-client stream.
Scope of a session: Every request is authenticated on its own and bound to one Zaprep workspace. Team members act on the workspace they belong to.
Logging: Every tool call is logged against the workspace (tool, arguments, result, duration).

Protected resource metadata: https://www.zaprep.com/.well-known/oauth-protected-resource (also served at /.well-known/oauth-protected-resource/api/mcp), RFC 9728.
Authorization server metadata: https://www.zaprep.com/.well-known/oauth-authorization-server, RFC 8414.
Unauthenticated call: 401 with WWW-Authenticate: Bearer resource_metadata="…" pointing at the resource metadata.
Client registration: Dynamic client registration (RFC 7591) at /api/oauth/register. Public clients, no secret.
Authorization: Authorization code with PKCE (S256) at /oauth/authorize. The user signs in to Zaprep and approves the app. Codes expire after 10 minutes.
Tokens: Token endpoint /api/oauth/token. Access tokens last 60 minutes, refresh tokens 30 days and rotate on every refresh. Both are stored hashed.
Scope: automations. One scope covers every tool; plan limits still apply per tool.
Revocation: /api/oauth/revoke (RFC 7009), or Disconnect in Zaprep under Settings, then AI tools.

Header: Authorization: Bearer zap_…
Where: Create and delete keys in Zaprep under Settings, then API keys. The key is shown once.
When to use: CLIs, CI, servers and workflow tools that cannot open a browser for OAuth. Keys do not expire; delete them when you stop using them.

New automations: create_automation saves rules paused unless the call passes activate: true. Turn one on with toggle_automation.
Copies: duplicate_automation always creates a paused copy.
Edits: Edits to a rule that is already on apply immediately.
Plan limits: The same checks as the dashboard: automation count, Follow Gate and email collection on paid plans only, AI analysis quota.
Not exposed: Billing and checkout, referral payouts, connecting or removing social accounts, file uploads, team and API key management, and sending comment replies or inbox DMs directly.

401: Missing, expired or revoked token. Refresh, or sign in again.
Tool errors: Returned as a normal MCP result with isError: true and a plain-English message, for example a plan limit, an unknown accountId or a comment keyword that clashes with another live rule.
needsReconnect: Account and post tools return needsReconnect: true when Meta invalidated an account token. The user has to reconnect that account in Zaprep.

Full tool list: /mcp/tools.

Last updated 3 November 2026.

Included on every plan, Free included. Claude connects in one click from its connector directory.