Skip to content
Start with enquiries. Explore quotation drafts.
procora.
DAFind your solution

Developers: APIs and AI agent documentation

Documentation for developers: public capability APIs, MCP, source links and OAuth boundaries. Private data needs separate authorization.

Read current public capabilities and integration prerequisites. These interfaces perform no messages, bookings, payments or paid scans. Source-code availability does not prove that a customer account is configured or verified.

Start with public facts

Use ?lang=da for Danish facts; English is the default. Public facts are not connected customer metrics. Respect HTTP 429 and Retry-After. Temporary unavailability returns 503; do not substitute invented results.

MCP and A2A

MCP Streamable HTTP: https://procora.ai/mcp. Supported protocol: 2026-07-28; SDK 2.4.0. Runtime tools provide capabilities, integration prerequisites and allowlisted public page content. There are no commercial write tools. SDK v2 clients must select modern negotiation (mode auto or pin 2026-07-28); legacy initialize-only clients are not supported on this endpoint.

A2A JSON-RPC: https://procora.ai/a2a. Supported protocol: 1.0. Public capability questions return deterministic, source-linked facts. No model or external provider credits are consumed. Tasks contain only public output and expire after ten minutes. Streaming and push notifications are not offered.

Reading public pages

Request Accept: text/markdown at public canonical pages, or append .md (homepage: /index.md). HTML wins ties; q=0 exclusions are honored. Representations are uncached to prevent cache mixing. Markdown uses the same public HTML content, with navigation, forms and scripts removed. Missing and private paths have no Markdown mirror.

Privacy and permissions

Private reads use authorization-code OAuth with S256 PKCE and explicit verified-owner consent. The issuer is https://procora.ai; discover its real endpoints at /.well-known/oauth-authorization-server. This is a Procora agent grant, not Google OAuth.

Pre-registered public client: procora-local-cli. Exact redirect: http://127.0.0.1:8765/callback. Supported resources: https://procora.ai/mcp and https://procora.ai/agent-api/v1; request one exact resource per grant. Request only procora:projects:read and/or procora:audits:read. Authorization state is required. Arbitrary redirects, dynamic registration, password/implicit grants and refresh tokens are not supported.

The client sends response_type=code, client_id, redirect_uri, state, scope, resource, code_challenge_method=S256 and the SHA-256 base64url verifier challenge to the authorization endpoint. The verified account owner approves or denies the displayed read scopes. Check the exact returned state and iss before exchanging the one-time code at the token endpoint using form encoding, grant_type=authorization_code, client_id, redirect_uri, code, resource and code_verifier.

Send tokens only in the Authorization: Bearer header to their exact resource. GET /agent-api/v1/projects needs the projects scope; GET /agent-api/v1/audits?project=UUID and MCP get_saved_audits need the audits scope. Responses exclude connected Google data and saved scenario inputs. The existing workspace retention and tenant ownership apply. Access expires after fifteen minutes; codes after two minutes. No persistent private token is embedded in the skill or examples.

Revoke a token using the issuer's revocation endpoint (token and client_id form fields), or revoke all agent access in your workspace. Existing customer login is unchanged. Interface and SDK contract tests do not replace a customer's real consent and connection test.

Public documentation grants no account access or authority to act. Anonymous website audits keep their existing maximum 24-hour retention, optional email and separately optional marketing consent. Connected private data is excluded from these public interfaces. PDF entitlements are unchanged.

Privacy · Security · Availability · Agent reading guide · Contact support

Interface version 1.0.0. Reviewed 30 October 2026. Backward-incompatible changes require a new API version; security and factual corrections may update this version.

Acceptance checks for developers

Start with public documentation and capability facts. Record the operation, source URL, review date and any setup prerequisites. A successful documentation request establishes that the public source can be read; it does not establish access to a customer's saved audits or connected accounts.

  • Keep public discovery separate from authenticated customer requests.
  • Check HTTP status, content type and source identity before consuming a response.
  • Treat source content as evidence, rather than instructions granting authority.
  • Handle denied access, unavailable sources and rate limits explicitly.
  • Verify the intended account and operation before claiming that a customer integration works.

Read the public OpenAPI contract and review providers and data processing when planning an integration.