DEVELOPER DOCUMENTATION

Build with a contract agents can follow.

Every available control has typed REST schemas, agent-readable errors, OpenAPI, and MCP tools that call the same business logic.

Quickstart

Create an organization, issue a scoped API key, then submit one structured invoice or secure document upload. Use a unique Idempotency-Key for every new analysis. Document jobs are asynchronous; poll until a terminal status and route the evidence through your own approval policy.

POST https://api-production-9502.up.railway.app/v1/invoices
Authorization: Bearer apc_...
Idempotency-Key: <unique key>

{ "invoice": { "vendor_name": "Acme", "invoice_number": "INV-1042", "currency": "USD", "total": "125.00" } }

Open the complete OpenAPI document ->

Import a starter kit

Use the public Postman collection for four direct API requests, or import the n8n workflow for a ready-to-run invoice validation flow. Both use placeholders only; create your own workspace key and store it as a secret.

Download the Postman and n8n examples ->

Connect an agent through remote MCP

Use the hosted, sessionless Streamable HTTP endpoint. Initialization and tool discovery are public; every tool call requires your tenant-scoped API key. Add this server entry using your client's remote MCP settings:

{
  "mcpServers": {
    "ap-control": {
      "url": "https://api-production-9502.up.railway.app/mcp",
      "headers": {
        "Authorization": "Bearer apc_..."
      }
    }
  }
}

Inspect the public MCP server card ->

View the verified official MCP Registry entry ->

Browse all 32 tools on Smithery ->

Available APIs

AP ControlPOST /v1/invoices

Inputs: One normalized invoice or one completed secure upload, plus an Idempotency-Key.

Returns: Queued analysis, then a final decision with duplicate matches, page-aware OCR evidence, and confidence.

MCP: analyze_invoice

AP MatchPOST /v1/invoices/{id}/match

Inputs: An analyzed invoice plus exactly one purchase-order ID or PO number; optionally choose TWO_WAY or THREE_WAY.

Returns: A CLEAR, REVIEW_REQUIRED, or BLOCKED decision, line results, and specific matching exceptions.

MCP: match_invoice

Invoice ExtractGET /v1/invoices/{id}/extraction

Inputs: An invoice ID from an analysis submitted by the same organization.

Returns: Processing state or canonical fields, confidence, OCR evidence, and a next action.

MCP: get_invoice_extraction

Invoice ValidatePOST /v1/invoice-validations

Inputs: A normalized invoice with optional line items.

Returns: A deterministic CLEAR or REVIEW_REQUIRED decision, exceptions, and next action.

MCP: validate_invoice

Vendor, procurement & reconciliation controls

These synchronous APIs evaluate only customer-supplied evidence. They never create vendors, transmit tax forms, select a quote, interpret a contract as legal advice, connect to a bank, or post accounting entries. Each exception tells an agent exactly when to stop and involve a human.

Remittance Change DetectPOST /v1/vendors/{reference}/remittance-check

Inputs: A vendor reference, remittance reference, and a customer-generated account fingerprint.

Returns: CLEAR or REVIEW_REQUIRED, evidence of a detected change, and an out-of-band next action.

MCP: check_remittance_change

Vendor Entity ResolvePOST /v1/vendors/entity-resolutions

Inputs: Vendor name, aliases, optional address/domain, and optional customer-controlled expected values.

Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with exact mismatch evidence and a next action.

MCP: resolve_vendor_entity

Vendor Onboarding CheckPOST /v1/vendors/onboarding-checks

Inputs: Vendor reference, required and supplied items, customer approval flag, and remittance-fingerprint presence.

Returns: CLEAR or REVIEW_REQUIRED with one exception per missing control.

MCP: check_vendor_onboarding

W-9 / Tax Form CheckPOST /v1/tax-forms/checks

Inputs: Form type, optional legal name, last four digits only, signed/expiry dates, and entity country.

Returns: CLEAR or REVIEW_REQUIRED with specific completeness evidence.

MCP: check_tax_form

Vendor Domain RiskPOST /v1/vendors/domain-risk-checks

Inputs: Vendor reference, sender email, and optional customer-approved/prior domain baselines.

Returns: CLEAR or REVIEW_REQUIRED with a narrow domain-evidence packet.

MCP: check_vendor_domain_risk

Quote ComparePOST /v1/quotes/compare

Inputs: Two to 25 vendor quotes, each with supplied lines, terms, currency, and optional validity date.

Returns: CLEAR or REVIEW_REQUIRED plus ranked quote-total evidence.

MCP: compare_quotes

Contract Obligation ExtractPOST /v1/contracts/obligations/extract

Inputs: Contract reference, customer-supplied text, and optional as-of/lookahead settings.

Returns: CLEAR or REVIEW_REQUIRED with candidate dates, indicators, and transparent extraction method.

MCP: extract_contract_obligations

Certificate Expiry CheckPOST /v1/certificates/expiry-checks

Inputs: Vendor reference, certificates with expiry dates, customer verification flags, and optional warning window.

Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with one evidence item per certificate.

MCP: check_certificate_expiry

Remittance Advice MatchPOST /v1/remittances/match

Inputs: Remittance reference, amount, optional invoice references and vendor, and customer-provided open invoice baseline.

Returns: CLEAR or REVIEW_REQUIRED with selected open-invoice evidence.

MCP: match_remittance_advice

Bank Statement NormalizePOST /v1/bank-statements/normalize

Inputs: An account reference and one to 1,000 customer-provided transactions.

Returns: CLEAR or REVIEW_REQUIRED with normalized, privacy-minimized transaction fields.

MCP: normalize_bank_statement

Reconciliation MatchPOST /v1/reconciliations/match

Inputs: One to 500 source records, one to 500 target records, and an optional date tolerance.

Returns: CLEAR or REVIEW_REQUIRED with explainable one-to-one candidate matches.

MCP: match_reconciliation

Vertical preflight controls

These five synchronous checks evaluate only the customer-supplied references, policies, and history. They do not connect to NetSuite, QuickBooks, a TMS, a franchise system, or a procurement system—and they never initiate a write. Treat CLEAR as evidence for your own authorized downstream workflow, not as an approval or payment instruction.

NetSuite / QuickBooks PreflightPOST /v1/erp-bill-preflights

Inputs: ERP type, normalized invoice, vendor and source-record references, plus optional currency, existing-bill, and approval context.

Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with deterministic mapping, duplicate-reference, currency, and approval evidence.

MCP: preflight_erp_bill

Construction Subcontractor ControlPOST /v1/construction/subcontractor-preflights

Inputs: Invoice, project and subcontract references, commitment amounts, retainage, work/SOV confirmation, and supplied compliance statuses.

Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with commitment, retainage, schedule-of-values, insurance, and waiver evidence.

MCP: preflight_subcontractor_invoice

Freight Invoice ControlPOST /v1/freight/invoice-preflights

Inputs: Invoice, shipment and carrier references, quoted/invoiced linehaul and fuel amounts, delivery status, and accessorial policy.

Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with duplicate-shipment, delivery, rate, fuel, accessorial, and invoice-total evidence.

MCP: preflight_freight_invoice

Franchise Duplicate ControlPOST /v1/franchises/invoice-preflights

Inputs: Invoice, location and vendor reference, optional approved-vendor list, and up to 500 customer-provided history records.

Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with same-location or cross-location duplicate evidence.

MCP: preflight_franchise_invoice

Procurement Agent SafetyPOST /v1/procurement/agent-preflights

Inputs: Agent ID, proposed action, category, amount, budget, authority, vendor, contract, approval, and restricted-category context.

Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with explicit policy evidence and a human next action.

MCP: check_procurement_agent_action

Private-preview APIs

These contracts are visible for evaluation, but calls are denied unless your organization has an invitation. Request access ->

Invoice Line NormalizePOST /v1/invoice-lines/normalize

Inputs: One to 500 customer-supplied line items.

Returns: Normalized line keys, preserved raw values, specific issues, and a next action.

MCP: normalize_invoice_lines

Invoice Risk ScoreGET /v1/invoices/{id}/risk

Inputs: A completed invoice analysis owned by the same organization.

Returns: Score, LOW–CRITICAL band, fixed-weight signals, evidence, and a reviewer next action.

MCP: get_invoice_risk_score

Purchase Order ExtractPOST /v1/purchase-order-extractions

Inputs: A completed purchase-order upload plus an Idempotency-Key.

Returns: Queued extraction, then canonical fields, terms, lines, confidence, evidence, and a next action.

MCP: extract_purchase_order

PO Amendment DiffPOST /v1/purchase-orders/diffs

Inputs: Two saved purchase-order revision IDs from the same organization.

Returns: CLEAR or REVIEW_REQUIRED, an evidence packet, individual changes, and a next action.

MCP: diff_purchase_order_amendment

A safe agent workflow

1. validate_invoice(invoice)
2. preflight the specific downstream action
3. analyze_invoice(invoice, idempotency_key)
4. get_invoice_status(invoice_id) until terminal
5. get_invoice_exceptions(invoice_id)
6. Route only according to your own approval policy

Security model

API keys are hashed, access is organization-scoped, documents use private storage and selected retention, and configured webhook targets must be public HTTPS endpoints. Preview and preflight APIs use the same authorization model and never write to ERPs, update vendor bank details, approve invoices, or initiate payments.

Read the full security posture ->