Quickstart
- Create a bearer token as an administrator.
- Store it server-side or in your MCP client.
- Use
POST /mcpor the REST endpoints. - Use a real site ID for site-scoped data.
POST https://pocketpapi.com/mcp Authorization: Bearer YOUR_TOKEN
Authentication
Authorization: Bearer YOUR_SITE_COMMANDER_TOKEN
Discovery
/mcp · /llms.txt · /.well-known/ai-plugin.json · /openapi.json · /api/control-plane/guide.md
Public effects catalog
The public catalog contains 63 recipes and requires no bearer token. It includes dependency-free native recipes for advanced motion plus free MIT-licensed library starters. The Help Center page provides a working preview for every recipe.
GET /api/effects?q=scroll
GET /api/effects/{effect_id}
POST /api/effects/compose
{"effect_id":"scroll-scrub-scale","target_selector":".hero-art","reduced_motion":true}
Open the full effects library and previews →
Control-plane reads
GET /api/control-plane/status
GET /api/control-plane/projects
GET /api/control-plane/sites
GET /api/control-plane/easyapp
GET /api/control-plane/sync-health
GET /api/control-plane/tasks
GET /api/control-plane/activity?site_id=SITE_ID
GET /api/control-plane/site-search?site_id=SITE_ID&q=SEARCH&type=link
GET /api/control-plane/conversations?site_id=SITE_ID
GET /api/control-plane/messages?conversation_id=CONVERSATION_ID
GET /api/control-plane/tickets?site_id=SITE_ID
GET /api/control-plane/ticket-messages?ticket_id=TICKET_ID
GET /api/control-plane/galleries?site_id=SITE_ID&page=home
GET /api/control-plane/gallery-image?site_id=SITE_ID&asset_id=ASSET_ID
GET /api/control-plane/site-services?site_id=SITE_ID
POST /api/control-plane/site-services {"site_id":SITE_ID,"action":"save","title":"..."}
GET /api/control-plane/site-forms?site_id=SITE_ID
Site Studio search
New Site Studio starter sites index labeled links from public, indexable pages as a separate Links result category. Use the site-scoped REST route or sitecommander_site_search. Production reads the latest published index by default; pass environment=staging to search an authorized staging index. The public search page reads its local index and never receives a bearer token.
GET /api/control-plane/site-search?site_id=123&q=donate&type=link
Authorization: Bearer SC_TOKEN
MCP: sitecommander_site_search {"site_id":123,"q":"donate","type":"link"}
Site Studio links and social bar
sitecommander_site_studio_edit accepts per-link affiliate_provider, affiliate_tracking_id, and (for eBay) affiliate_custom_id on add_link_list, and the same tracking fields on insert_link. A supplied link ID takes priority; blank values use the selected site's Shop connection and then PocketPapi's central Shop connection. Amazon Partner Tags apply only to Amazon URLs. eBay item links use the official Browse API affiliate URL; use an eBay-generated Partner Network URL for other destinations. Affiliate anchors receive sponsored/nofollow attributes and an adjacent disclosure. Set social_bar:true with social_platform on a link item or inserted link to add its HTTPS profile to the social icon bar, or use operation:add_social_bar with social_links to manage the bar directly.
sitecommander_site_studio_edit {
"site_id":123,"confirm":true,"operation":"add_link_list","path":"index.html",
"heading":"Featured","links":[
{"label":"My Amazon pick","url":"https://www.amazon.com/dp/ASIN","affiliate_provider":"amazon","affiliate_tracking_id":"yourstore-20"},
{"label":"Facebook","url":"https://www.facebook.com/example","social_bar":true,"social_platform":"Facebook"}
]
}
Complete Site Studio MCP controls
The MCP contract includes the no-AI structural and visual controls exposed in Site Studio: sitecommander_site_studio_block_add supports the editor's block catalog; sitecommander_site_studio_media lists approved site images for sitecommander_site_studio_image_replace; sitecommander_site_studio_effect_apply applies compatible managed effects; sitecommander_site_studio_page_role assigns Home/team/customer routing; and sitecommander_site_studio_pagespeed audits one public page. File writes stage a change set and return a preview. PageSpeed sends only the public page URL to Google, refuses sign-in protected pages, and allows four audits per site per minute from one client. A throttled result contains no score.
sitecommander_site_studio_blocks {}
sitecommander_site_studio_block_add {"site_id":123,"confirm":true,"path":"index.html","block_key":"link_list","heading":"Featured links","link_items":[{"label":"Capital One Shopping","url":"https://i.capitalone.com/JEcMjImOz"}]}
sitecommander_site_studio_media {"site_id":123}
sitecommander_site_studio_pagespeed {"site_id":123,"path":"/","strategy":"mobile"}
Site Studio galleries are project/site-scoped and reuse approved central media. Saving with POST /api/control-plane/galleries creates a staged revision and returns its exact saved_gallery_id and preview; generated sites read only the published gallery snapshot through a server-side bridge, so bearer tokens and storage paths never reach the browser.
Service management is site-scoped through sitecommander_services, sitecommander_service_save, and sitecommander_service_delete or GET/POST /api/control-plane/site-services. Writes attach the current catalog to an exact staged revision. Add the Site Studio service_catalog block to imported Home or Services pages; its server-side runtime renders only the published snapshot, uses same-site approved media, and shows a clear empty state. Publishing remains separate and requires the exact revision approval.
Site Studio forms are project/site-scoped. Saving a field set, CTA, or helper note with POST /api/control-plane/site-forms returns a staged change-set ID and preview. The generated site keeps its published form until that exact revision is explicitly published; public runtime reads never expose drafts.
GET /api/control-plane/site-protection?site_id=SITE_ID POST /api/control-plane/site-protection
Copyright protection is site-scoped and supports off, light, balanced, and strict modes with page, Shop, and Gallery areas. The restrictions.disable_print option omits protected images from browser print/PDF output with a notice. These are deterrence controls, not DRM; they cannot prevent screenshots, cameras, or determined browser inspection.
Sender photos and BIMI
Manage site-scoped sender profiles and domain-level BIMI from the authenticated site page or the bearer API. Hosted sender photos are available to systems that support public avatar assets; they cannot override recipient-managed Gmail, Microsoft 365, or Outlook contact photos.
GET /api/control-plane/mail/profiles?site_id=SITE_ID POST /api/control-plane/mail/profiles GET /api/control-plane/bimi/status?site_id=SITE_ID POST /api/control-plane/bimi/prepare POST /api/control-plane/bimi/verify GET /api/control-plane/bimi/record?site_id=SITE_ID
Use photo_base64 for a PNG, JPEG, or WebP up to 4 MB. Use svg_base64 for a validated SVG Tiny PS logo and certificate_pem_base64 for an optional VMC/CMC chain. The prepare response gives the DNS name and TXT record; PocketPapi never changes DNS.
{"site_id":123,"sender_email":"hello@example.com","sender_name":"Example Company","photo_base64":"data:image/png;base64,..."}
{"site_id":123,"selector":"default","dkim_selector":"resend","avatar_preference":"brand","svg_base64":"data:image/svg+xml;base64,..."}
The verify response distinguishes `ready`, `yahoo_eligible`, and `not_ready`. Gmail generally needs a VMC or CMC for BIMI display; Yahoo also considers volume, reputation, and engagement; Outlook profile photos are normally controlled by the Microsoft account, Exchange directory, or contact.
Activity and custom fields
Send messages, subscriptions, contacts, and leads with your own taxonomy:
POST /api/control-plane/events
{"site_id":123,"type":"message","external_id":"crm-8842","category":"support","subcategory":"billing","folder":"vip","source":"contact-widget","status":"open","priority":"high","tags":["enterprise"],"custom_fields":{"plan":"pro"},"message":"I need help."}
Additional keys are preserved as metadata. Duplicate external IDs for the same site are ignored.
Site-scoped server connection
Open a site's details in the authenticated command center and choose Connect site to command center. The owner receives a site-scoped scc_... bearer token exactly once. Store it in the site's server environment and rotate it from the same page if it is lost or exposed. It cannot access another site or the protected internal Current Site workspace.
COMMAND_CENTER_URL=https://YOUR-COMMAND-CENTER.example.com
SITE_COMMANDER_SITE_ID=123
SITE_COMMANDER_TOKEN=scc_...
POST /api/control-plane/events
Authorization: Bearer SITE_COMMANDER_TOKEN
{"site_id":123,"type":"lead","source":"website-form","email":"jordan@example.com","message":"Please call me."}
Use this credential for site-scoped REST reads, approved chat replies, and POST /mcp. The command center records the interface, action, site, result, duration, and safe error text in Audit Logs.
Google reviews
GET /api/control-plane/reviews?site_id=SITE_ID GET /api/control-plane/zernio/reviews?site_id=SITE_ID POST /api/control-plane/reviews/reply
Conversations and support tickets
Website conversations and their messages are shared across the visitor widget, Support Inbox, MCP, API, and PocketPapi mobile app. Support tickets created from the site are available through the tickets and ticket-messages reads.
POST /api/control-plane/messages/reply
{"conversation_id":456,"message":"Thanks — we will follow up.","metadata":{"category":"support","folder":"vip"}}
PocketPapi mobile client
Pocket Papi is the shared iOS and Android client for connected sites. Every project receives Pocket Papi; public sites appear automatically, while private sites are added with a one-time configuration code generated from Project Setup. Discovery is not data access: users still sign in with an existing Pocket Papi workspace account before the app can load leads or reply to live chats. The older /api/easyapp/* paths remain only as compatibility routes.
GET /api/easyapp/sites
POST /api/easyapp/configure
{"configuration_code":"EA-..."}
POST /api/easyapp/auth/login
{"site_key":"...","email":"owner@example.com","password":"..."}
Authorization: Bearer EA_TOKEN
GET /api/easyapp/me
GET /api/easyapp/leads
POST /api/easyapp/leads/status
GET /api/easyapp/conversations
GET /api/easyapp/messages?conversation_id=456
POST /api/easyapp/messages/reply
PocketPapi sessions expire after 30 days and are stored only as hashes. Never put an MCP token in a mobile bundle. Replies are written to the same conversation records used by the website widget and Support Inbox.
Authorized MCP/API clients can idempotently prepare the connected app workspace from the builder without receiving private configuration codes or signing credentials:
POST /api/control-plane/easyapp
Authorization: Bearer SC_TOKEN
{"site_id":123,"app_name":"PocketPapi","enabled":true,"visibility":"private"}
MCP: sitecommander_easyapp_ensure
Optional PocketPapi command-center app
The native source contract also supports an optional standalone PocketPapi iOS/Android command-center shell for users who want the portal in a native client. It uses the existing account, returns only accessible projects, sites, tasks, activity, and business-growth inventory, and does not include the protected internal Current Site workspace. Source export remains an internal compatibility workflow; there is no separate Apps destination in the portal.
POST /api/command-center/auth/login
{"email":"owner@example.com","password":"..."}
Authorization: Bearer SCM_TOKEN
GET /api/command-center/summary
GET /api/command-center/projects
GET /api/command-center/sites
GET /api/command-center/marketing
GET /api/command-center/tasks
GET /api/command-center/activity
GET /api/command-center/integration-logs
The integration-log endpoint is permission-gated for administrator troubleshooting and never returns bearer tokens or request bodies.
Central Zernio gateway
GET /api/control-plane/zernio/accounts?site_id=SITE_ID GET /api/control-plane/zernio/reviews?site_id=SITE_ID POST /api/control-plane/zernio/posts?site_id=SITE_ID
The gateway uses encrypted central Zernio credentials, enforces site scope, and audit logs operations. One shared PocketPapi social profile serves authorized projects; PocketPapi assigns individual connected accounts to projects from the social account cards, and site IDs select only the assigned accounts. This does not create separate provider profiles or forward arbitrary Zernio URLs.
MCP
Connect to https://pocketpapi.com/mcp. Use sitecommander_api_guide to read the complete Markdown contract. Read tools include the token creator’s accessible projects/sites, enabled agents, status, tasks, activity, conversations, chat messages, support tickets, ticket messages, reviews, and the shared Zernio account pool. sitecommander_site_search searches public Site Studio content, including the Links category. Site Studio MCP exposes page content/SEO, navigation, page roles, all supported no-AI blocks, approved-media image replacement, managed effects, forms, galleries, protection, and public-page PageSpeed audits. Link controls support per-link affiliate IDs and social bar links. Use sitecommander_agents before linking an agent to a scheduled Site or Local task. sitecommander_send_message replies to live website chats and appears in the site widget and Support Inbox.
Security
- Bearer tokens are private credentials.
- Site-scoped requests require a site ID.
- The internal Current Site workspace is never exposed.
- Zernio keys are never returned.
- Gateway actions are audit logged.