API access and tokens in MyConstruct Studio

API access lets other software, such as automation tools, reporting dashboards, your own scripts and AI assistants, read and update your MyConstruct data securely, without anyone clicking through the screens. This article shows how to find the API Access tab, check your access, create and manage access tokens, and make your first API call. No coding experience is needed for the setup steps.

Before you start

API access, including AI assistant connections, is a Studio feature. Studio is MyConstruct's white-label product, and each Studio business has its own web address, for example https://<your-studio>.myconstruct.com.

Connecting ChatGPT, Claude or another AI assistant? See Connect ChatGPT, Claude or another AI assistant to MyConstruct.

You need:

• a Studio subscription with API access included (shown as Subscription API), and
• a user account with API access switched on (shown as User API). Admins have it automatically. For other staff, an admin sets API Access in their permissions under Staff (Manage Staff).

Who sees what on the tab:

You are…	You see
Admin	All four sub-tabs: Connect, Access tokens (all the company's tokens), Connected apps and AI activity, plus every other Business Details tab.
Manager	Connect, Access tokens, Connected apps and AI activity.
Other staff with API access	Only the API Access tab, with Connect and Access tokens (your own tokens). Other business settings are managed by your admin.

In the top-right corner of the tab you'll see API access is on (green) or API access is off (amber). If it's off, an admin can turn it on in Subscription and in your Manage Staff permissions, or contact MyConstruct support.

Some features depend on your company's setup. AI assistants making changes, the ready-made prompts and "sign in with MyConstruct" for AI apps are only available where your company has them switched on. Looking things up with an access token works for every Studio company with API access. If you're not sure what's switched on for you, contact MyConstruct support.

Your Studio addresses

Every Studio business has its own API server, based on its Studio web address. Here's the pattern, where <your-studio> stands for your Studio name:

What	Address pattern
Your MyConstruct app	https://<your-studio>.myconstruct.com
MCP address (for AI assistants)	https://api-<your-studio>.myconstruct.com/mcp
API base (for apps and scripts)	https://api-<your-studio>.myconstruct.com/api/v1/
Developer docs (overview)	https://api-<your-studio>.myconstruct.com/docs/overview.html
AI assistant set-up guides	https://api-<your-studio>.myconstruct.com/docs/connect/
API guide	https://api-<your-studio>.myconstruct.com/docs/guide
API reference (Swagger)	https://api-<your-studio>.myconstruct.com/docs/
MCP reference (every AI tool)	https://api-<your-studio>.myconstruct.com/docs/mcp.html
Postman collection	https://api-<your-studio>.myconstruct.com/docs/postman/myconstruct-api.postman_collection.json

Important: These are patterns, not real addresses. Always copy the address from your own API Access tab. It has a Copy button for the MCP address and buttons for every docs page.

Open the API Access tab

1. Sign in to your Studio site.
2. In the top-right header, click SETTINGS (the gear icon), then choose Business Details.
3. The Edit Business Details page opens. Across the top are the tabs Business Details | Business Settings | Business Defaults | API Access | Partner Integration | Accounting. Click API Access. (Staff who aren't admins see only the API Access tab.)
4. You're now in API & AI Connections: "Connect AI assistants, apps and automations to your MyConstruct data, and see what they do." Along the top are the sub-tabs Connect, Access tokens, Connected apps and AI activity. The small number on each shows how many items it has.

The Connect sub-tab has two cards:

• Connect an AI assistant: your MCP address with a Copy button, and step-by-step guides for Claude, ChatGPT, Claude Code, Cursor, VS Code or another assistant.
• Build an integration: the sign-in methods for developers, and buttons for Developer docs, Guide, Reference, Postman and Contact support.

Tip: Can't see the API Access tab? Your business may not be on Studio, or your user may not have API access. Ask your admin to check your API Access permission in Manage Staff, or contact MyConstruct support.

Check your access and connection

At the bottom of the Connect sub-tab is the Connection check. It confirms everything is ready before you connect anything.

1. Click Check access. You should see:
   • Subscription API: Enabled
   • User API: Enabled
   • Access Result: Ready
2. Click Test connection. It shows "Running checks..." for a few seconds, then:
   • API Base: your Studio API address (for example https://api-<your-studio>.myconstruct.com)
   • Ping: OK
   • Docs: OK

Not showing Ready?

• Subscription API: Disabled: API access needs to be included in your Studio subscription. Contact MyConstruct support.
• User API: Disabled: your user needs the API Access permission. Ask your admin.
• Ping or Docs: Failed (with an HTTP code or error): try again in a minute. If it keeps failing, contact support and mention what it says.

Access tokens

An access token (also called a Personal Access Token, or PAT) is a named, expiring key for your own scripts, automations and token-based AI tools. Like a sign-in connection, it works as you, with your permissions.

Create a token

1. Open the Access tokens sub-tab.

2. Under Create an access token, fill in:

   • Name: what it's for, e.g. Power BI dashboard or Claude Code – Jane's laptop.
   • Access:
     • Read only: can look but can't change anything. Best for reports, dashboards, backups and assistants that answer questions.
     • Read/write: can create and update data. Use it only for trusted systems that really need it. You'll see a warning: "Read/write tokens are high trust. They can change data. Keep the expiry short and rotate them often."
   • Expires: the date the token stops working. Read/write tokens must expire within 90 days. Read-only tokens may have no expiry, but setting one is still good practice.

3. Click Create.

   

4. A box appears: "Copy this token now. It is only shown once." Click Copy and paste it straight into a safe place, such as a password manager or the secure credentials field of the tool you're connecting.

   

Heads up: Once you leave or refresh the page, the full token can't be shown again. If you lose it, revoke it and create a new one.

Your token list

Below the form is Company tokens (admins) or Your tokens (other staff), with:

• Name
• Access: Read only or Read/write
• Token: a masked preview so you can tell tokens apart
• Expires: a date, or Never
• Last used: or Not used yet. Handy for spotting tokens nobody needs, or activity you didn't expect.
• a Revoke button

Revoke a token

Revoke a token when an integration is retired, a staff member leaves, or you think a token may have leaked.

1. Click Revoke next to the token.

2. Confirm: "Revoke this personal access token? It will stop working immediately." Click Yes.

   

3. You'll see "Token revoked." and the token disappears from the list. Anything using it stops working straight away.

Build an integration

This part is for anyone connecting a script, automation tool (Zapier, Make, n8n), reporting tool or custom app.

Choose how to sign in

Method	Use it when…	How it works
Access token	You're connecting your own scripts, automations, reports or tools. The most common choice.	Create one on the Access tokens sub-tab.
OAuth 2.0 (with PKCE)	You're building an app that other people sign in to with their MyConstruct login.	/oauth/authorize and /oauth/token, scopes read and write.
Login token	Your own app needs a short-lived session for a user.	POST /api/v1/auth/login returns a short-lived token; POST /api/v1/auth/refresh renews it.

Not sure? Start with a read-only access token.

Your first API call

Every request to /api/v1/ needs your token in an Authorization header:

Authorization: Bearer YOUR_TOKEN

With curl (a command-line tool on most computers):

curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api-<your-studio>.myconstruct.com/api/v1/me

If it works, you'll get back details of the user the token belongs to.

What responses look like

Records come back in data, and paging details in meta:

{
  "data": [ { "id": 123, "name": "Smith Residence – Extension" } ],
  "meta": { "page": 1, "per_page": 25, "total": 87 }
}

Errors have a standard shape. Include the request_id if you contact support:

{
  "error": {
    "code": "invalid_token",
    "message": "The access token is invalid, expired or revoked.",
    "request_id": "req_abc123"
  }
}

The API allows 120 requests per minute. Go over and you'll get 429 Too Many Requests. Wait a moment and try again.

Docs and tools

The Build an integration card has a button for each:

• Developer docs: the overview of everything (AI assistants, the API and OAuth).
• Guide: how the API behaves, covering authentication, errors, paging, filtering, dates and time zones, and rate limits.
• Reference: the interactive Swagger reference. Click Authorize, paste your token under bearerAuth, then Try it out on any endpoint.
• Postman: the Postman collection (JSON). Save it, then Import it into Postman and set baseUrl and your token.
• Contact support: opens the MyConstruct help centre request form.

Webhooks: to have MyConstruct push changes to your system as they happen, see Webhooks in the developer docs.

What you can connect

• Ask an AI assistant about your business: "What jobs are behind schedule this week?", "Summarise the notes on the Harper new home job", or a ready-made Job status update for a client. Start read-only.
• Let an assistant do the busywork (where changes are switched on): turn rough site notes into a job note, tick off checklist tasks, log time, or load a supplier's price rise, always previewed and approved by you.
• Automations with Zapier, Make or n8n: new job created → post to the site team's Slack or Teams channel; quote accepted → create a task in your project tool.
• Reporting dashboards in Power BI or Google Sheets: work in progress, quote win rate, revenue by month, overdue invoices. A read-only token is all you need.
• Syncing with other systems: keep your CRM, accounting and scheduling tools in step with MyConstruct.
• Nightly backups and exports: a small script that exports key records to secure storage every night.
• Website forms: new enquiries land in MyConstruct as opportunities automatically.
• Bulk updates: load a new supplier price list into inventory in one go. This needs Read/write access, so keep the expiry short.

Keeping tokens safe

A token or connected app is a key to your business data, so treat it like one.

• Read only first. Only use Read/write, or allow changes, when you really need the tool to change data.
• Check before you agree. When an assistant says what it's about to change, read it before you approve.
• Short expiries. Set the shortest sensible expiry and put a reminder in your calendar to rotate it.
• One token per integration, with a clear name, so revoking one doesn't break anything else.
• Never paste tokens into chats, shared docs, emails or tickets, including AI chat windows. Use the tool's secure credentials field or a password manager.
• Revoke or disconnect straight away if something leaks or someone leaves.
• Review regularly: check Last used on Access tokens, and (admins and managers) Connected apps and AI activity. Revoke or disconnect anything you don't recognise.
• Keep change access for people and assistants you trust. Notes and emails from clients and suppliers can contain text that tries to give an assistant instructions. MyConstruct tells assistants to ignore it, but it's another reason to stay careful.

Troubleshooting

API access is off, or Access Result isn't "Ready"

• Subscription API disabled: your Studio subscription needs API access. Contact MyConstruct support.
• User API disabled: ask your admin to switch on API Access in your staff permissions.
• Click Check access again after any change.

401 Unauthorized or "token expired"

• Check the header is exactly Authorization: Bearer YOUR_TOKEN, with no quotes or extra spaces, and that you copied the whole token.
• Check the token hasn't expired or been revoked on the Access tokens sub-tab.
• Login tokens are short-lived. Call /api/v1/auth/refresh or sign in again.

403 Forbidden

• The token may be Read only while you're trying to change something, or your user may not have access to that feature.

429 Too Many Requests

• You've passed 120 requests per minute. Pause, then retry with a short back-off, and fetch bigger pages instead of many small requests.

Wrong address (nothing connects, 404s or "not found")

• Use your own API address, https://api-<your-studio>.myconstruct.com, not your normal app address, and check the path (/api/v1/ for the API, /mcp for assistants).
• Use the API Base shown by Test connection and the links on your own API Access tab.

FAQ

Do I need to be a developer? No. Connecting Claude or ChatGPT takes a few clicks, and tools like Zapier, Make, Power BI and Google Sheets need little or no code. Developers will find everything else in the developer docs.

Is this available on every MyConstruct plan? No. API access and AI assistant connections are part of Studio.

What can the assistant see? Exactly what you can see in MyConstruct, and nothing more. It works as you, with your permissions.

Can the assistant change things without asking? MyConstruct tells assistants to confirm with you before making a change, and most assistants ask before using any tool that changes data. Changes are only possible where your company has them switched on and the connection has change access. Every change and every refused attempt is logged in AI activity.

Should I sign in or use a token for my assistant? Sign in for chat apps like Claude and ChatGPT (where your company has it switched on). Use a token for developer tools like Claude Code, Cursor and VS Code, or if sign-in isn't available.

I lost my token. Can I see it again? No. For security, tokens are only shown once. Revoke it and create a new one.

How long can a token last? Read/write tokens must expire within 90 days. Read-only tokens can have no expiry, but we recommend setting one anyway.

How do I cut off an assistant? For a sign-in connection, remove it in the assistant, or an admin or manager can click Disconnect under Connected apps. For a token connection, Revoke the token. Either way it stops working straight away.

Where do I see what assistants have done? Admins and managers: AI activity. It lists every change and every refused attempt.

We're a franchisor. Do tokens work in our franchise businesses? Yes. A token created while you're switched into a franchise business (Settings › Switch Business) works in that franchise, with your own permissions.

Where do I go for help? Click Contact support on the Connect sub-tab. If you're reporting an API error, include the request_id from the error.

Related

• Connect an AI assistant to MyConstruct: connect Claude, ChatGPT, Claude Code, Cursor or VS Code, and see what assistants can do.