Build on Alrebro
The REST API for your drafts, threads, and plans — and the MCP server that brings the same data into your AI assistant.
How auth works — read this first
REST API: your signed-in session. Every endpoint under /api/* (except the public ones below) requires you to be signed in to Alrebro in the browser — the session cookie is the credential. There is no bearer-token auth on the REST API. Signed out, a call does NOT get a 401 JSON error — it is redirected to /login (an HTML page), because the routes use the same session guard as the dashboard pages.
Personal API keys (al_…) are for MCP only. A key created on the Connections page authenticates the MCP server (Authorization: Bearer al_…), not the REST endpoints above. Sending an al_ key to /api/drafts or /api/threads does not sign you in.
MCP: API key or OAuth. AI assistants connect to the MCP server at https://alrebro.com/api/mcp with either a personal API key (clients without a browser sign-in, such as Codex) or OAuth (Claude, ChatGPT, Cursor — you sign in once and approve the scopes). Full setup steps are on the MCP page.
Scopes are enforced. Every key and OAuth connection carries scopes (projects:read, drafts:write, usage:read), chosen when the key is created or the connection is approved — and the server enforces them on every call. A key without drafts:write cannot create drafts, and a connection approved without a scope cannot use it.
REST endpoints
Base URL: https://alrebro.com. All responses are JSON. Errors are { error: ... } with the HTTP status (403 not allowed, 404 not found or not yours, 429 rate limited) — a signed-out call is redirected to /login instead of getting a 401. Rate limit: 60 requests per minute per user on most endpoints; 10 per minute on the heavier ones (today's plan build). A project id you cannot open behaves as if it does not exist.
GET/api/threads?project=<id>
Scored buyer threads for a project, highest intent first, with pipeline status. No project means your current project.
Returns: { threads: [...] }
GET/api/drafts?project=<id>
Your drafts, newest first. A project filter scopes the list to that project.
Returns: { drafts: [...] }
POST/api/drafts
Generate rule-checked reply drafts for a project. Body: { projectId, subredditId?, threadId?, tones? }. Owners and editors only — viewers get 403. Each generated draft counts against your monthly draft limit.
Returns: { variants: [...] } (201)
PATCH/api/drafts/[id]
Edit a draft you can open — its text, status, and safety re-check.
Returns: The updated draft.
GET/api/plan/today?project=<id>
Today's action plan for a project. Builds it on first hit from already-scored threads, then returns the stored plan.
Returns: { plan } (the plan row, whose items field holds the tasks)
GET/api/subreddits?project=<id>
Tracked communities for a project, plus the shared Rule Book fields.
Returns: { subreddits: [...] }
POST/api/subreddits
Track a community: body { name }. Serves the shared catalog row when its rules are fresh, else fetches its profile from the Reddit provider.
Returns: The tracked subreddit.
GET/api/alerts
Your recent alerts, newest first.
Returns: { alerts: [...] }
GET/api/notifications
Your merged notification feed (notifications plus dashboard-channel alerts from the last 30 days), newest first. An empty inbox returns [].
Returns: { notifications: [...] }
GET/api/snippets
Your reusable draft snippets, per project.
Returns: { snippets: [...] }
MCP server
The MCP server speaks JSON-RPC 2.0 over HTTP at https://alrebro.com/api/mcp. GET returns server info with no auth (name, version, tool count). POST needs Authorization: Bearer <API key or OAuth access token> for every method: initialize, ping, tools/list, tools/call. The tools read your projects, plans, threads, mentions, and rules, and draft replies — read and draft only. No tool can post, comment, vote, message, or create accounts on Reddit. MCP rate limit: 60 calls per minute and 1000 per day per credential, per server instance — the counters live in memory on each instance and are not shared across instances, so they are an abuse brake, not a hard per-credential total. The OAuth token endpoint is POST /api/mcp/token (authorization_code and refresh_token grants; refresh rotates both tokens).
Webhooks
Register an HTTPS endpoint on the Connections page and pick its events: thread.new (a new scored thread), thread.buyer_intent (a thread scored as a likely buyer), draft.created (a reply draft is generated), and mention.new (a thread mentions your product). Each registration gets a signing secret, shown once — use it to verify payloads. Registration is live today; delivery to your endpoint is not wired yet.
Keys and rotation
Create, rotate, and revoke personal API keys on the Connections page. A key can have an expiry (30 days, 90 days, 1 year, or never) and its own scopes. Rotating a key issues a fresh token on the same row — same name, scopes, and expiry — and the old token stops working immediately. An expired key cannot be rotated (rotation keeps the same expiry, so the new token could never work) — create a new key instead. Revoking takes effect on the next call.