Beta / Maviter Developer Platform

Read broadly. Write narrowly.

API keys can retrieve governed checkpoints and perform four bounded intake writes. OAuth MCP remains read-only. Signed webhooks announce new immutable versions.

Manage connections

Versioned

Every response identifies the immutable prompt checkpoint it represents.

Owner-scoped

A key can never read or change more than the account that created it.

Replay-safe writes

Every POST requires a credential-bound Idempotency-Key; MCP, publishing, generation and repositories remain read-only.

Authentication

Bearer credentials.

Create a key in your account and send it through the Authorization header. The complete secret is displayed once and is never stored by Maviter.

curl https://maviter.com/api/v1/prompts \
  -H "Authorization: Bearer mav_live_..."

REST contract

Available endpoints.

GET/api/v1/library/prompts

Search approved Public and Premium prompt metadata.

GET/api/v1/library/prompts/{id}

Retrieve an unlocked published prompt.

GET/api/v1/prompts

List prompt systems owned by the key's account.

POST/api/v1/prompts

Create a Private prompt and immutable version 1. Requires prompts:write and Idempotency-Key.

GET/api/v1/prompts/{id}

Retrieve the latest immutable owned version.

GET/api/v1/prompts/{id}/versions

List immutable version checkpoints.

POST/api/v1/prompts/{id}/versions

Append an immutable owned version. Requires prompts:write and Idempotency-Key.

GET/api/v1/prompts/{id}/versions/{version}

Retrieve one exact immutable version.

GET/api/v1/recovery/projects

List Recovery projects owned by the key's account.

POST/api/v1/recovery/projects

Create an owned Recovery project. Requires recovery:write and Idempotency-Key.

GET/api/v1/recovery/projects/{id}

Retrieve owner-scoped status and artifact counts.

GET/api/v1/recovery/projects/{id}/handovers

List frozen handover checkpoints.

GET/api/v1/recovery/projects/{id}/handovers/{handoverId}

Pull deterministic handover or execution-prompt content.

POST/api/v1/recovery/projects/{id}/evidence

Add locator or notes metadata only. No source fetch or upload.

Mutation contract

Retry without duplication.

Use a unique key for one logical operation and reuse it only when retrying the identical body. Keys expire after 24 hours. A reused key with different input returns 409.

curl -X POST https://maviter.com/api/v1/recovery/projects \
  -H "Authorization: Bearer mav_live_..." \
  -H "Idempotency-Key: recovery-intake-2026-08-28-001" \
  -H "Content-Type: application/json" \
  -d '{"title":"My project","objective":"Recover the verified production application."}'

AI client connection

OAuth MCP.

Point an MCP-compatible client to the canonical endpoint. It discovers Maviter OAuth, opens a signed consent flow, obtains a short-lived token bound only to this server, and receives the read surface below.

MCP endpoint: https://maviter.com/mcp
Transport: Streamable HTTP
Authorization: OAuth 2.1 + PKCE
Scopes: library:read prompts:read recovery:read usage:read

MCP surface

Read tools and resources.

TOOLsearch_prompt_library

Search approved Public and Premium entries.

TOOLget_prompt

Retrieve an owned or accessible published prompt.

TOOLlist_my_prompts

List prompt systems owned by the connected account.

TOOLget_prompt_version

Retrieve one exact owned immutable version.

TOOLget_account_usage

Read plan and current credit balance.

TOOLlist_recovery_projects

List owner-scoped Recovery projects.

TOOLget_recovery_project

Read project status and artifact counts.

TOOLlist_recovery_handovers

List frozen handover checkpoints.

TOOLget_recovery_handover

Pull handover Markdown or its execution prompt.

RESOURCEmaviter://account/usage

Account usage as structured JSON.

RESOURCEmaviter://prompts/{id}/versions/{version}

An owned immutable version as structured JSON.

Outbound events

Verify the raw body.

Webhooks carry IDs and version numbers—not prompt content or Recovery source material. Store the endpoint secret when it is shown, reject stale timestamps, verify the exact body, and deduplicate on the event ID.

Events: prompt.version.created
        recovery.handover.created
Headers: Maviter-Id
         Maviter-Timestamp
         Maviter-Signature: v1,<base64url HMAC-SHA256>
Signed input: <event-id>.<timestamp>.<raw-body>

Machine-readable contract

OpenAPI 3.1.

Import the specification into development tools, API clients or documentation generators.

Open specification