API, webhooks and MCP

API keys

Create keys under API keys. A key is shown once and stored only as a hash, so save it when you create it. Keys carry scopes — read, write, run, catalog, mcp — so a key that only starts workflows can't edit them.

curl https://yakpipes.com/api/v1/workflows \
  -H 'X-API-Key: ypk_your_key_here'

REST

The full specification is at /openapi.yaml. In short:

• GET /api/v1/workflows — list; POST to create
• POST /api/v1/workflows/:id/publish — publish the current draft
• POST /api/v1/workflows/:id/run — start a run
• GET /api/v1/workflows/:id/export and POST /api/v1/workflows/import — move workflows between accounts, or keep them in version control
• GET /api/v1/runs and GET /api/v1/runs/:id — run history and detail
• POST /api/v1/runs/:id/replay and /cancel

Inbound webhooks

Each workflow with a webhook trigger has its own URL, optionally signed and deduplicated — see Triggers.

MCP: workflows as tools for AI agents

YakPipes speaks the Model Context Protocol at POST /mcp, authenticated with an API key carrying the mcp scope. Point an MCP-capable assistant at it and your workflows become tools it can list, inspect and run — under your account's quotas, with every call recorded as an ordinary run you can audit.

What an assistant sees at that endpoint:

• Your workflows, individually. Tick Use from an AI assistant on a workflow and it becomes its own tool, described by the fields its trigger actually expects. Exposure is per workflow and off by default, so connecting an assistant never opens the whole account. A call can optionally wait a few seconds and return the workflow's outputs directly.
• Your connected apps. search_operations, describe_operation and invoke_operation let an assistant find and call any operation on an app you've connected, using your stored credentials. Operations are searched rather than listed, because one OpenAPI import can carry thousands and listing them would swamp the assistant.
• Workflow management — list, inspect, run and import workflows, and read run history.

Runs started this way are metered as mcp traffic, so agent activity is separable from a person pressing Run, and every tool call is written to your audit log. Combined with approval steps, this gives you agents that can act while a human still gates anything consequential.