Developer Platform
Developer platform overview
One permission-aware developer surface for records, connectors, events, AI, logs, MCP, and installed services.
BuildWithHQ is designed so that an application is not only a visual SaaS product — it is also a programmable backend. The current v1 contract contains 283 operations across 218 paths for every promoted first-class module plus app identity, records, connectors, inbound endpoints, webhooks, installed services, AI, logs, and contract discovery.
| Surface | Use it for | Security boundary |
|---|---|---|
| REST APIs | Read data, perform approved mutations, inspect schemas, and start operations from external software. | Authenticated identity + application scope + DataRole/location/permission checks. |
| Webhooks | Push application events to another system without polling. | Per-endpoint configuration, signed deliveries, retry/idempotency rules. |
| Connectors | Configure REST, GraphQL, OAuth, payment, inbound, and installed-service integrations. | Registered connector types, secret references, public HTTPS endpoints, and app-derived identity. |
| AI and logs | Ingest/search permitted records, manage rebuilds, and diagnose work by correlation ID. | Explicit scopes plus the same DataRole, location, and AI-read envelope as the app. |
| MCP tools | Let compatible AI clients discover and invoke approved application capabilities. | The same identity and permission envelope used by the API — MCP never bypasses it. |
| Container services | Add custom code when the visual platform or built-in actions are not enough. | Declared endpoints, input/output schemas, permission keys, egress policy, and invocation audit. |
Documentation and executable contract
support.buildwithhq.com explains architecture, security rules, examples, troubleshooting, and recommended patterns. The generated OpenAPI document is the executable source for exact v1 paths, request schemas, response types, and operation IDs.
The production origin is https://api.buildwithhq.com. Before rollout, use the environment origin supplied by your BuildWithHQ administrator.
An operation appearing in the generated v1 contract means the software contract exists. Availability at a particular origin still depends on that environment's deployment and your API client's scopes.
The rule that matters most
Every surface passes through the same authorization boundary. A REST call, workflow step, MCP tool, or container endpoint cannot use its transport as a shortcut around application permissions. The server derives identity and application context, evaluates the requested capability, filters data, executes the approved operation, and records the action where required.
That is the central advantage of the BuildWithHQ developer model: extend the application without building a parallel backend beside it.
Capability review: 2026-09-14. For exact current technical availability, use the generated API Map and first-class module inventory.