API & MCP

One layer for custom integrations and AI

MitoOps normalises orders, products, stock, shipments, analytics and reports across all of your stores. The same layer is open to your program over a REST API, to AI applications over the open Model Context Protocol (MCP), and it notifies your systems of events through signed webhooks. Reading only with the permissions you choose yourself.

Try for free Connect Claude.ai Documentation

What can you read over API & MCP?

Everything MitoOps keeps normalised across your stores — and nothing that would expose credentials.

Orders

Orders for a period or just today, per store, with items and the delivery country. Totals only with the reports permission; the customer's name, e-mail and address only with the sensitive personal-data permission.

Products and categories

Search by name, code, EAN or PLU, a product detail with the list price and categories with product counts.

Stock and movements

Stock level of one or several items including the source of the value, and the stock movement history: when, what, how many, why and from where.

Shipping

Shipments with carrier, country and handover and delivery times, a detail with tracking events and statistics: delivery rate, median and p90.

Analytics

Sessions, orders, revenue and conversion from GA4, channels including ChatGPT and AI sources, Search Console queries and order coverage.

Documents and reports

Invoices with lines and credit notes, a financial summary for a period, sales by product and performance per order. Totals always cover the whole period. Purchase prices and margins only with the sensitive permission.

Customers

A customer directory with shops, country, language, counts and revenue per currency; purchase activity for a period alongside lifetime figures. Name, company, e-mail and phone only with the sensitive personal-data permission, revenue and LTV only with the reports permission. Customer analytics stays in pseudonyms.

Suppliers and claims

Suppliers with offers and cost components; claims and returns linked to the order, credit note and return shipment.

The interface returns operational data only. Credentials for your store, carriers or analytics can never be read through it. Customers' personal data leaves only with an explicitly granted sensitive scope.

How it works

Normalise first, connect AI second

Neither AI nor your program gets database access. They ask a business layer that already understands stores, permissions and what the data means.

Stores send data to MitoOps
Orders, products and documents arrive live from the connected platforms over webhooks and sync.
MitoOps normalises it
One data model for all markets, stores and currencies, bound to the model of customer spaces, stores and permissions.
You decide what may be read
An access key or an OAuth consent carries scopes and a list of stores. Sensitive data is never granted by default.
Your program or AI reads through one layer
REST API for your code, MCP for an assistant. Both paths call the same capabilities and return the same business data.

REST API, MCP or webhooks?

They are not three products. REST and MCP are two ways to ask for the same data; webhooks are the way to learn about an event without asking.

REST API for your program

For a reporting tool, Power BI, your own script or a system that calls a server.

/api/v1 on your application domain
Access key in the Authorization header
Machine-readable OpenAPI description
Cursor pagination and from–to periods
Uniform error shape with a request identifier

MCP for AI applications

For AI applications that support remote MCP with OAuth — Claude.ai is the production-verified example.

/api/mcp on your application domain
OAuth 2.1 with PKCE — no keys to copy
The assistant sees only the tools its scopes allow
Summary tools: delivery statistics, financial summary, channels
Works with an access key too, for your own agent

Webhooks for your systems

For accounting, warehouse, CRM or an automation platform that needs to learn about an event right away.

New order, payment, status change, shipment, delivery, stock, invoice, claim
HMAC-SHA256 signature with timestamp and event ID
Thin envelope with identifiers — read the detail over the REST API
Delivery retries with increasing back-off and a log of attempts
Events and stores selected per endpoint

The MCP tool list is generated from the same catalogue as REST: whatever is in one is in the other. Webhooks carry events from the same business layer.

Claude.ai

How do you connect Claude.ai to MitoOps?

No key, no Client ID, no secret. Claude.ai discovers everything from the interface address and you decide on the consent screen.

In Claude.ai open Settings → Connectors and add a custom connector.
Paste the MCP address from Settings → API & MCP in MitoOps.
Press Connect. Your MitoOps login opens, second factor included.
On the consent screen choose what Claude may read and which stores it applies to.
Allow. Claude returns to its page and the connector is connected.
Ask a question about your stores.

An OAuth consent is not an access key: it does not take a slot in your plan’s key limit. A Start customer with one key connects Claude.ai without revoking it.

Step-by-step guide for Claude.ai Case study

What you can ask

„What was the carrier split in August and what was each carrier’s median delivery time?“
„How many orders and how much revenue came from ChatGPT and other AI sources?“
„Which Search Console queries had the highest CTR?“
„What is the margin on product X over the last month?“
„Here is the carrier invoice — compare it with the shipments for that month.“

Security

Is MCP safe for an ecommerce business?

Safety does not come from the protocol but from how the server handles access, permissions and the tools it exposes. In MitoOps, six layers apply to every connector.

Reading and narrow writes

REST has no operation that changes anything. MCP writes only behind sensitive scopes you tick: a disabled automation draft (a person has to enable it), a discount coupon with a preview and confirmation, and affiliate programme management without commissions or payouts. Not a request to the model — a property of the server, enforced at three levels.

The person’s permissions

The consent screen offers only the scopes the signed-in person has. Whoever cannot see purchase prices cannot hand them to AI.

Tenant and store isolation

Every customer has its own space and database. Access covers only the ticked stores and a new store never joins on its own.

Scopes and sensitive data

20 scopes, 6 of them sensitive (reports, purchase prices, personal data, purchasing, automation drafts, coupons, affiliate programme management) — never pre-selected.

OAuth 2.1 and keys

PKCE, resource binding, one-time key reveal, rotation and instant revocation. Only a hash is stored, never the secret.

Audit and limits

Every call is logged with an identifier. Technical rate limits protect against key guessing and overload.

Which plan includes API & MCP?

From the Start plan. Plans differ by the number of active access keys, not by what you can read.

Plan	API & MCP	Active access keys
Free trial	—	—
Beginner	—	—
Start	yes	1
Growth	yes	2
Pro	yes	5
Custom	yes	by agreement

Connecting an AI assistant over OAuth does not use a key. A downgrade never revokes existing keys; a new one can be created once a slot is free.

Full pricing

Frequently asked questions about API & MCP

What is an ecommerce MCP server?

MCP (Model Context Protocol) is an open standard that lets an AI application discover and call tools of another system. The ecommerce MCP server in MitoOps exposes business data — orders, products, stock, shipments, analytics and reports — as tools over a normalised layer that already joins several stores — 84 tools across 20 permission scopes today.

Do I need an API key for Claude.ai?

No. Claude.ai connects over OAuth: you give it the MCP address, sign in to MitoOps and choose scopes and stores on the consent screen. A key is only needed by your own program or an agent that calls the server.

Can AI change anything over MCP?

Not orders, stock, products, prices or documents — no tools exist for that. Writes concern three things and all sit behind sensitive scopes that are never pre-selected on the consent screen: a disabled automation draft, which only a person in the app can enable; a discount coupon from the parameters you give it — creation never overwrites an existing coupon, explicit update and deletion have a preview and confirmation, deletion also has its own scope, and a coupon with a live dependency is not deleted; and affiliate programme management — approving or suspending a partner account, portal texts and help articles, templates, campaigns and document policy, while commission approval and payouts stay in the app only. The capability kernel, a closed catalogue and the adapters hold the line, and the REST API has no write at all.

Will AI see purchase prices and margins?

Only if a person who has that right allows it explicitly: the scopes for reports and purchase prices are sensitive and not pre-selected on the consent screen. Without them, purchase price, gross profit and margin never appear in a response.

Does it work across several stores at once?

Yes. MitoOps is built for several stores, markets and currencies. One connection reads from every store you ticked at consent or when issuing the key.

From which plan is API & MCP available?

From the Start plan with one active access key. Growth has two, Pro five, Custom by agreement. The free trial and Beginner do not include the interface.

How does the REST API differ from MCP?

REST is called by your program, which decides what to read and when. With MCP, the AI model discovers and calls tools. Both paths sit on the same capabilities and return the same business data.

Does every AI model support MCP?

MCP has to be supported by the application the model runs in (the client), not by the model itself. MitoOps provides a standard remote MCP server with OAuth; Claude.ai is the production-verified client. Any other application that supports remote MCP with OAuth connects the same way.

What are outbound webhooks for?

So that your system learns about an event immediately, without polling: a new order, a payment, a status change, a created or delivered shipment, a stock movement, an invoice or a claim. You pick the events and stores per endpoint; failed deliveries are retried and every attempt is visible in the log.

What is the difference between the REST API, MCP and webhooks?

The REST API and MCP are reads on request: your program or AI application asks and gets an answer. A webhook goes the other way: MitoOps sends your system a short signed message that something happened, with identifiers. Your system then reads the detail over the REST API.

How are webhooks signed?

Every delivery carries an HMAC-SHA256 signature over the timestamp and body, plus the event ID and timestamp in headers. The endpoint secret is shown once and can be rotated at any time. The receiver verifies the signature with a constant-time comparison and rejects messages older than five minutes — the exact procedure and code samples are in the documentation.