{"name":"CooperBuild","version":"2026-10-18.1","api_version":"1.0.0","version_note":"version is the manifest revision. api_version is the version string returned by GET /health.","base_url":"https://api.cooperbuild.ai","description":"CooperBuild is the operating system for a construction company. Agents sign in with OAuth and call the remote MCP server to browse and edit estimates, collect vendor bids, turn an approved proposal into project records, and hand work to named chat agents. A person creates the account at signup_url and connects the agent in the browser. An agent with no person in the loop uses auth.agent_bootstrap. Model calls run on the customer's own Anthropic, OpenAI, Gemini, or xAI key. There is no API key and no published per-call price.","tags":["construction","estimating","proposals","vendor-quotes","project-conversion","chat-agents","mcp","oauth"],"auth":{"scheme":"oauth2","flow":"authorization_code","pkce":"S256","header":"Authorization","token_type":"Bearer","key_prefix":null,"key_prefix_status":"not_applicable","scopes":["mcp:tools","mcp:read","mcp:write"],"scopes_endpoint":"https://api.cooperbuild.ai/.well-known/oauth-authorization-server","authorization_endpoint":"https://app.cooperbuild.ai/oauth/authorize","token_endpoint":"https://api.cooperbuild.ai/oauth/token","registration_endpoint":"https://api.cooperbuild.ai/oauth/register","resource":"https://api.cooperbuild.ai/mcp","signup_url":"https://app.cooperbuild.ai/auth/signup","signup_status":"published","signup_note":"Human browser signup for a Cooper account. This does not mint an API key. The person creates the account here, then connects the agent at authorization_endpoint. Unauthenticated calls to /mcp, /mcp/directory, /api/agent/spend, and /api/agent/audit return this URL with ?resource= plus an authorize_url, in the JSON body and on WWW-Authenticate. An agent with no person in the loop uses agent_bootstrap.","product_signup_url":"https://app.cooperbuild.ai/auth/signup","agent_bootstrap":{"start":"https://api.cooperbuild.ai/api/agent/bootstrap","verify":"https://api.cooperbuild.ai/api/agent/bootstrap/verify","token":"https://api.cooperbuild.ai/oauth/token"},"agent_bootstrap_status":"published","agent_bootstrap_note":"No person in the loop. Inbox access is required. The 8-digit code expires in 15 minutes (900 seconds) by default. 1. POST https://api.cooperbuild.ai/oauth/register with Content-Type application/json. For agent bootstrap, POST /oauth/register with Content-Type application/json, redirect_uris, and token_endpoint_auth_method none. Recommend redirect_uris [\"https://localhost/callback\"]. A public client does not receive a client_secret. Use client_id plus PKCE. Omitting token_endpoint_auth_method registers client_secret_post and returns a client_secret, which is not the bootstrap client. The default scope is mcp:tools. mcp:tools alone is enough for MCP tools and satisfies agent HTTP read/write checks. scopes_supported also advertises mcp:read and mcp:write. Sending scope \"mcp:tools mcp:read mcp:write\" stores that trio on the client. Register example: {\n  \"redirect_uris\": [\"https://localhost/callback\"],\n  \"token_endpoint_auth_method\": \"none\"\n} 2. POST https://api.cooperbuild.ai/api/agent/bootstrap with Content-Type application/json and email, company_name, client_id, code_challenge, and code_challenge_method S256. 3. Read the 8-digit code from that inbox before it expires. 4. POST https://api.cooperbuild.ai/api/agent/bootstrap/verify with Content-Type application/json and email, code, client_id, and code_verifier. The response includes an authorization_code and redirect_uri. 5. POST https://api.cooperbuild.ai/oauth/token with Content-Type application/x-www-form-urlencoded and grant_type authorization_code, code, client_id, code_verifier, and redirect_uri. redirect_uri must exactly match the redirect_uri returned by POST /api/agent/bootstrap/verify (e.g. https://localhost/callback). A public client has no client_secret. The response is a bearer token. curl -X POST https://api.cooperbuild.ai/oauth/token \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d grant_type=authorization_code \\\n  -d code=AUTHORIZATION_CODE \\\n  -d client_id=CLIENT_ID \\\n  -d code_verifier=CODE_VERIFIER \\\n  -d redirect_uri=https://localhost/callback 6. POST https://api.cooperbuild.ai/mcp with that bearer token. After MCP initialize, every subsequent MCP request must reuse the mcp-session-id (or Mcp-Session-Id) response header. A bare tools/list without that header returns 400. Human signup stays at signup_url. Browser Connect stays at authorization_endpoint."},"endpoints":[{"id":"health","path":"/health","method":"GET","summary":"Public health check. No auth. Observed JSON has status ok, version, signup_url, agent_bootstrap (start, verify, token), and tools_after_auth (estimate_browse, estimate_manage, vq_browse, proposal_browse, search_projects, chat_agent_message). That list is not the full MCP catalog. signup_url stays the human browser signup. Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset.","input_schema":null,"output_schema":null,"cost":null,"idempotent":true,"side_effects":"none","timeout_ms":null,"auth":"none"},{"id":"mcp","path":"/mcp","method":"POST","summary":"MCP JSON-RPC for the CooperBuild workspace. Bearer token required. After initialize, every subsequent request must reuse the mcp-session-id (or Mcp-Session-Id) response header. A bare tools/list without that header returns 400. Unauthenticated calls return JSON-RPC error -32000 with error.data.signup_url and error.data.authorize_url (resource https://api.cooperbuild.ai/mcp), plus the same URLs on WWW-Authenticate.","input_schema":"https://cooperbuild.ai/schemas/mcp-jsonrpc.input.json","output_schema":null,"cost":null,"idempotent":null,"side_effects":"write","timeout_ms":null,"auth":"bearer"},{"id":"mcp-directory","path":"/mcp/directory","method":"POST","summary":"MCP JSON-RPC surface used by the ChatGPT directory plugin. Same bearer scheme. After initialize, every subsequent request must reuse the mcp-session-id (or Mcp-Session-Id) response header. A bare tools/list without that header returns 400. Resource metadata is at /.well-known/oauth-protected-resource/mcp/directory. Unauthenticated calls return JSON-RPC error -32000 with signup_url and authorize_url for resource https://api.cooperbuild.ai/mcp/directory. WWW-Authenticate uses resource_metadata for that protected resource.","input_schema":"https://cooperbuild.ai/schemas/mcp-jsonrpc.input.json","output_schema":null,"cost":null,"idempotent":null,"side_effects":"write","timeout_ms":null,"auth":"bearer"},{"id":"estimates-browse","path":"/mcp","method":"POST","tool":"estimate_browse","summary":"Read estimates, templates, deliverable classes, and task types.","input_schema":"https://cooperbuild.ai/schemas/estimate_browse.input.json","output_schema":null,"cost":null,"idempotent":true,"side_effects":"read","timeout_ms":null,"auth":"bearer"},{"id":"estimates-manage","path":"/mcp","method":"POST","tool":"estimate_manage","summary":"Create, update, duplicate, import templates into, or soft-delete estimate worksheets.","input_schema":"https://cooperbuild.ai/schemas/estimate_manage.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"write","timeout_ms":null,"auth":"bearer"},{"id":"bids-browse","path":"/mcp","method":"POST","tool":"vq_browse","summary":"Find trade scopes and read vendor quotes (bids) on a project or estimate.","input_schema":"https://cooperbuild.ai/schemas/vq_browse.input.json","output_schema":null,"cost":null,"idempotent":true,"side_effects":"read","timeout_ms":null,"auth":"bearer"},{"id":"bids-quote","path":"/mcp","method":"POST","tool":"vq_quote","summary":"Preview or record a vendor quote on a trade scope. confirm defaults to false and does not save.","input_schema":"https://cooperbuild.ai/schemas/vq_quote.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"write","timeout_ms":null,"dry_run":true,"auth":"bearer"},{"id":"proposal-create","path":"/mcp","method":"POST","tool":"proposal_manage","summary":"List proposal templates or create a client proposal from an estimate worksheet.","input_schema":"https://cooperbuild.ai/schemas/proposal_manage.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"write","timeout_ms":null,"auth":"bearer"},{"id":"project-conversion","path":"/mcp","method":"POST","tool":"proposal_approve","summary":"Approve a proposal and copy its estimate onto the project. confirmApproval false previews; true performs the conversion.","input_schema":"https://cooperbuild.ai/schemas/proposal_approve.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"irreversible","timeout_ms":null,"dry_run":true,"auth":"bearer"},{"id":"chat-agents-route","path":"/mcp","method":"POST","tool":"talk_to_agent","summary":"Route a /slash, @mention, or #role message to one of the workspace's named chat agents and return that agent's instructions.","input_schema":"https://cooperbuild.ai/schemas/talk_to_agent.input.json","output_schema":null,"cost":null,"idempotent":true,"side_effects":"read","timeout_ms":null,"auth":"bearer"},{"id":"chat-agents-message","path":"/mcp","method":"POST","tool":"chat_agent_message","summary":"Have a Cooper agent message a tenant user. confirm defaults to false and sends nothing. clientMessageId dedupes a real send.","input_schema":"https://cooperbuild.ai/schemas/chat_agent_message.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"external_message","timeout_ms":null,"dry_run":true,"auth":"bearer"},{"id":"oauth-protected-resource","path":"/.well-known/oauth-protected-resource","method":"GET","summary":"OAuth protected-resource metadata for https://api.cooperbuild.ai/mcp.","input_schema":null,"output_schema":null,"cost":null,"idempotent":true,"side_effects":"none","timeout_ms":null,"auth":"none"},{"id":"oauth-authorization-server","path":"/.well-known/oauth-authorization-server","method":"GET","summary":"OAuth authorization-server metadata, including scopes_supported, signup_url, agent_bootstrap_endpoint, and agent_bootstrap_verify_endpoint.","input_schema":null,"output_schema":null,"cost":null,"idempotent":true,"side_effects":"none","timeout_ms":null,"auth":"none"},{"id":"oauth-token","path":"/oauth/token","method":"POST","summary":"Exchange an authorization code or refresh token. Content-Type application/x-www-form-urlencoded. Grants: authorization_code, refresh_token. The authorization_code grant requires grant_type, code, client_id, code_verifier, and redirect_uri. redirect_uri must exactly match the redirect_uri returned by POST /api/agent/bootstrap/verify (e.g. https://localhost/callback). A public client has no client_secret. The response is a bearer token.","input_schema":"https://cooperbuild.ai/schemas/oauth-token.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"none","timeout_ms":null,"auth":"none"},{"id":"oauth-register","path":"/oauth/register","method":"POST","summary":"Dynamic client registration. Content-Type application/json. redirect_uris is required. Recommend redirect_uris [\"https://localhost/callback\"]. This does not mint an API key. For agent bootstrap, send token_endpoint_auth_method none and use the returned client_id with PKCE. A public client does not receive a client_secret. Omitting the auth method registers client_secret_post and returns a client_secret. Default scope is mcp:tools, which is enough for MCP tools and satisfies agent HTTP read/write checks. Sending scope \"mcp:tools mcp:read mcp:write\" stores that trio on the client.","input_schema":"https://cooperbuild.ai/schemas/oauth-register.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"write","timeout_ms":null,"auth":"none"},{"id":"agent-bootstrap","path":"/api/agent/bootstrap","method":"POST","summary":"Start agent signup with no person in the loop. No bearer token. Content-Type application/json. JSON requires email, company_name, client_id, code_challenge, and code_challenge_method S256. Cooper emails an 8-digit code to that address. Inbox access is required. The code expires in 15 minutes (900 seconds) by default. GET returns 404. POST {} returns 400 invalid_request, email is required. An unknown client_id returns 400 invalid_client and points at POST /oauth/register.","input_schema":"https://cooperbuild.ai/schemas/agent-bootstrap.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"external_message","timeout_ms":null,"auth":"none"},{"id":"agent-bootstrap-verify","path":"/api/agent/bootstrap/verify","method":"POST","summary":"Redeem the emailed 8-digit code before it expires (15 minutes / 900 seconds by default). Inbox access is required. No bearer token. Content-Type application/json. JSON requires email, code, client_id, and code_verifier. The response includes an authorization_code and redirect_uri. POST /oauth/token uses Content-Type application/x-www-form-urlencoded. The authorization_code grant must send that redirect_uri unchanged (e.g. https://localhost/callback). GET returns 404. POST {} returns 400 invalid_request, email is required.","input_schema":"https://cooperbuild.ai/schemas/agent-bootstrap-verify.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"write","timeout_ms":null,"auth":"none"},{"id":"graphql","path":"/graphql","method":"POST","summary":"GraphQL endpoint used by the web and mobile apps. Unauthenticated calls are rejected. No public schema is published.","input_schema":"https://cooperbuild.ai/schemas/graphql.input.json","output_schema":null,"cost":null,"idempotent":null,"side_effects":"write","timeout_ms":null,"auth":"session"},{"id":"agent-spend","path":"/api/agent/spend","method":"GET","summary":"Spend cap. Bearer token required. GET without a token returns 401 with signup_url and authorize_url. POST returns 404. The authenticated response body is not published.","input_schema":null,"output_schema":null,"cost":null,"idempotent":true,"side_effects":"read","timeout_ms":null,"auth":"bearer"},{"id":"agent-audit","path":"/api/agent/audit","method":"GET","summary":"Audit log. Bearer token required. GET without a token returns 401 with signup_url and authorize_url. POST returns 404. The authenticated response body is not published.","input_schema":null,"output_schema":null,"cost":null,"idempotent":true,"side_effects":"read","timeout_ms":null,"auth":"bearer"},{"id":"landing-lead","path":"/api/landing-leads","method":"POST","summary":"Public demo-request intake. No auth. name is required. Not part of the workspace MCP.","input_schema":"https://cooperbuild.ai/schemas/landing-lead.input.json","output_schema":null,"cost":null,"idempotent":false,"side_effects":"write","timeout_ms":null,"auth":"none"}],"side_effects_enum":["none","read","write","irreversible","external_message"],"rate_limits":{"default_rpm":120,"burst":40,"headers":{"X-RateLimit-Limit":"160","X-RateLimit-Remaining":"integer, per response","X-RateLimit-Reset":"unix seconds, per response","Retry-After":null},"status":"published","note":"X-RateLimit-Limit is 160 because default_rpm 120 plus burst 40. Remaining and Reset are sent on each response and change per request. Observed Reset values were unix seconds within a couple of seconds of the request time. Retry-After is not sent."},"pricing":{"model":"bring_your_own_provider_key","summary":"Cooper meters model usage. The customer pays Anthropic, OpenAI, Google, or xAI on their own key. No Cooper per-call API price is published.","free_tier":null,"per_call":null,"spend_cap_endpoint":"https://api.cooperbuild.ai/api/agent/spend","spend_cap_status":"published","spend_cap_note":"GET requires a bearer token. Unauthenticated GET returns 401 with signup_url and authorize_url. The authenticated response body is not published."},"safety":{"confirmation_required":["proposal_approve","vq_quote","chat_agent_message"],"dry_run":true,"dry_run_note":"Those three tools preview when their confirm flag is false. There is no global dry-run header or query parameter.","audit_log_endpoint":"https://api.cooperbuild.ai/api/agent/audit","audit_log_status":"published","audit_log_note":"GET requires a bearer token. Unauthenticated GET returns 401 with signup_url and authorize_url. The authenticated response body is not published."},"discovery":{"directories":[{"name":"MetaMuse","listed":null},{"name":"Grokbot","listed":null}],"health_path":"/health","health_status":"published","llms_txt":"https://www.cooperbuild.ai/llms.txt","openapi":"https://cooperbuild.ai/openapi.json","docs":"https://cooperbuild.ai/developers#agent-bootstrap","claude":"https://cooperbuild.ai/claude","chatgpt":"https://cooperbuild.ai/chatgpt"},"not_published":["self-serve API key signup and any key prefix","per-call price and API free-tier quota","Retry-After header","authenticated response bodies for GET /api/agent/spend and GET /api/agent/audit","GraphQL schema","MCP tool output JSON Schemas","request timeout_ms"]}