postevi
Try it free

Developers

Run postevi from your own code or automation tool with the REST API, the MCP server and outgoing webhooks. The dashboard, REST and MCP all call the same service layer, so permissions, tenant checks and the activity log work the same in all three.

MCP URL
https://postevi.app/api/mcp
REST base URL
https://postevi.app/api/v1
OpenAPI document
https://postevi.app/api/v1/openapi.json

REST API

The base URL is https://postevi.app/api/v1. Resources: posts, accounts, media, inbox, automations and analytics.

The example request lists the workspace's scheduled posts.

  • Errors come back with code and message inside an error object. The code matches the dashboard; the message is in English.
  • Lists are paginated with a cursor: pass the cursor from the response to get the next page.
  • An Idempotency-Key header on POST requests keeps the same job from running twice.
curl "https://postevi.app/api/v1/posts?status=scheduled&limit=20" \
  -H "Authorization: Bearer $POSTEVI_API_KEY"

Authentication

Every request carries an API key as a Bearer token in the Authorization header. Create keys on the AI page of the dashboard; each key is shown once and only its hash is stored.

A key belongs to one workspace. What it can do is the overlap of the creating member's role and the permissions picked for the key.

  • Keys start with postevi_sk_, and the dashboard only ever shows the prefix.
  • Requests with a revoked key are rejected.
  • REST and MCP ignore cookies and read only the Bearer header.
Authorization: Bearer postevi_sk_...

MCP server

The server lives at https://postevi.app/api/mcp and speaks stateless Streamable HTTP.

Clients sign in with OAuth 2.1: PKCE with S256, dynamic client registration and rotating refresh tokens. On the consent screen the person picks a workspace and the permissions; publishing, sending messages and turning on automations start unticked. Clients without OAuth can use the same API key as a Bearer token.

  • The tool list follows the granted permissions. With the defaults a client sees 22 tools, and none of them publishes or sends a message.
  • Every tool has a title and sets readOnlyHint, destructiveHint, idempotentHint and openWorldHint.
  • Read-only search and fetch tools for ChatGPT find posts, automations and accounts.
  • When the workspace has approvals on, posts drafted by editors and by the AI wait for approval.
  • Every action the AI takes is written to the activity log with the client's name.
https://postevi.app/api/mcp
Scopes
ScopeDescription
accounts:readRead connected accounts, their health and the workspace.
posts:readRead and search posts, the queue and the change feed.
posts:writeCreate and edit drafts, send them for approval and import media. Never publishes.
posts:publishSchedule posts, publish right away, unschedule and retry failed posts. Starts unticked on the consent screen.
analytics:readRead account and post analytics and the best times to post.
inbox:readRead DM conversations and comments.
inbox:writeSend DMs and reply to comments. Starts unticked on the consent screen.
automations:readRead comment-to-DM automations and their run logs.
automations:writeCreate and edit automations that start paused, and pause automations.
automations:activateTurn automations on and edit active ones. Starts unticked on the consent screen.
offline_accessGet a refresh token, so the connection survives when the access token expires.

Outgoing webhooks

Add an endpoint and pick its events in the Webhook tab on the AI page of the dashboard. The signing secret starts with whsec_ and is shown once.

Signatures follow the Standard Webhooks spec. Each request carries webhook-id, webhook-timestamp and webhook-signature headers. The signature is a base64 HMAC-SHA256 of the id, timestamp and body joined with dots, prefixed with the v1 version tag.

  • Reject requests whose timestamp is more than 5 minutes old.
  • The Standard Webhooks libraries verify signatures for you.
  • Failed deliveries are retried 6 times with exponential backoff; the dashboard shows each delivery and lets you resend it.
  • Send test event checks an endpoint without waiting for a real event.
POST /webhook/postevi HTTP/1.1
Host: n8n.example.com
Content-Type: application/json
webhook-id: msg_2pWzqf8Lr1Tn4Vb7Kx9Yc3Ad
webhook-timestamp: 1794301200
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

{
  "type": "post.published",
  "timestamp": "2026-11-10T09:00:00Z",
  "data": {
    "postId": "post_01JCX4M8Q2R7T9V3W5Y6Z8A1B2",
    "status": "published"
  }
}
Webhook events
EventDescription
post.publishedA post went out on every platform.
post.failedA post failed to publish.
post.partialA post went out on some platforms and failed on others.
post.status_changedA post's status changed, for example it went to approval or was scheduled.
comment.receivedA connected account got a comment on a post.
message.receivedA connected account got a DM.
account.connectedAn account was connected.
account.disconnectedAn account was disconnected.
account.needs_reconnectAn account's connection dropped and it needs to be reconnected.

OpenAPI

The schema is at https://postevi.app/api/v1/openapi.json. It's generated from the service layer's validation schemas, so it changes together with the REST API.

Use it to generate client code or import the requests into your API tool of choice.

curl -o postevi-openapi.json https://postevi.app/api/v1/openapi.json

Limits

Each workspace and each connected client has a request budget. Requests over it get a 429.

  • An MCP request body can be up to 256 KiB.
  • Your plan's limits on connected accounts and members apply through REST and MCP too.
  • X posts count toward the workspace's monthly X cap; past the cap the request returns limit_reached.
  • X analytics are billed per read, so they're off by default; turn them on in the workspace settings.

Plan your week on one screen.

Try it free for 7 days. Card required, cancel any time.

Start 7-day free trialSee pricing