REST API

Base URL: http://localhost:8787/v1/<projectId>. That is the project id (a UUID from Settings), not the slug. Browser apps send the publishable key as Authorization: Bearer crafio_pk_… and, after sign-in, X-Crafio-User. Collection access decides what that key can read and write. It sees new collections immediately, and the last published snapshot of collections you have already published. Payments, email, and CRM need the secret key or an agent token. Add the app origin in Settings or the browser is blocked.

Records

Collection slug in the path. Optional q is a case-insensitive substring over the record JSON.

GET    /v1/:projectId/data/:collection?q=
POST   /v1/:projectId/data/:collection
       { ...fields } or { "data": { ...fields } }

GET    /v1/:projectId/records/:recordId
PATCH  /v1/:projectId/records/:recordId
       { ...fields } or { "data": { ...fields } }
DELETE /v1/:projectId/records/:recordId

List also works as GET /v1/:projectId/records/:collection when the segment is not a UUID. Deletes return 409 while other records still reference the target. See Data.

Auth

POST /v1/:projectId/auth/sign-up
POST /v1/:projectId/auth/sign-in
POST /v1/:projectId/auth/magic
GET  /v1/:projectId/auth/me

Magic links and session headers are on People & auth.

Files

GET    /v1/:projectId/files
POST   /v1/:projectId/files          multipart field "file", or JSON { name, mime, base64 }
GET    /v1/:projectId/files/:fileId  bytes
DELETE /v1/:projectId/files/:fileId

File URLs are not a public dump. Details on Files.

Payments, CRM, email

POST /v1/:projectId/payments/:action
GET  /v1/:projectId/payments
POST /v1/:projectId/crm/:action
POST /v1/:projectId/email/send

:action matches the tool suffix: create_checkout, get_customer, list, refund, or CRM search, upsert_contact, list_deals, upsert_deal, sync. Bodies match the MCP tools. See Payments and Email & CRM.

Webhooks

Providers post to /webhooks/:connector/:projectId on the plane. Configure that URL in Stripe (or the connected provider). Requests must be signed. Crafio does not expose a webhook UI yet.

For agents

Prefer MCP. The plane also exposes /mcp, /llms.txt, and /api/setup so a client can bootstrap from one URL.