---
title: "Developer platform overview"
section: "Developer Platform"
canonical_url: "https://support.buildwithhq.com/api/overview.html"
reviewed_at: "2026-09-14"
authority: Official
---

# Developer platform overview

One permission-aware developer surface for records, connectors, events, AI, logs, MCP, and installed services.

## In brief

- **API origin:** https://api.buildwithhq.com
- **Current contract:** v1 · 422 operations
- **Core model:** One app-scoped security context

BuildWithHQ is designed so that an application is not only a visual SaaS product — it is also a **programmable backend**. The current v1 contract contains 422 operations across 340 paths for its published module and platform operations, including app identity, records, connectors, inbound endpoints, webhooks, installed services, AI, logs, and contract discovery.

| Surface | Use it for | Security boundary |
| --- | --- | --- |
| **REST APIs** | Read data, perform approved mutations, inspect schemas, and start operations from external software. | Authenticated identity + application scope + DataRole/location/permission checks. |
| **Webhooks** | Push application events to another system without polling. | Per-endpoint configuration, signed deliveries, retry/idempotency rules. |
| **Connectors** | Configure REST, GraphQL, OAuth, payment, inbound, and installed-service integrations. | Registered connector types, secret references, public HTTPS endpoints, and app-derived identity. |
| **AI and logs** | Ingest/search permitted records, manage rebuilds, and diagnose work by correlation ID. | Explicit scopes plus the same DataRole, location, and AI-read envelope as the app. |
| **MCP tools** | Let compatible AI clients discover and invoke approved application capabilities. | The same identity and permission envelope used by the API — MCP never bypasses it. |
| **Container services** | Add custom code when the visual platform or built-in actions are not enough. | Declared endpoints, input/output schemas, permission keys, egress policy, and invocation audit. |

## Documentation and executable contract

**support.buildwithhq.com** explains architecture, security rules, examples, troubleshooting, and recommended patterns. The generated OpenAPI document is the executable source for exact v1 paths, request schemas, response types, and operation IDs.

The production origin is **`https://api.buildwithhq.com`**. Before rollout, use the environment origin supplied by your BuildWithHQ administrator.

**Current Kit 1.20.70:** [fast rows, progressive loading and independently authorized exact counts](progressive-loading-and-counts.html)  let Contacts and Global Search browse up to 5,000 matches while a separate count reports every authorized match. This release also adds governed, exact-version [Skills discovery and GoClaw assignment](mcp-tools.html). See the [enterprise integration checklist](go-live-checklist.html)  for release, recovery and operational evidence requirements.

Note

An operation appearing in the generated v1 contract means the software contract exists. Availability at a particular origin still depends on that environment's deployment and your API client's scopes.

## The rule that matters most

Every surface passes through the same authorization boundary. A REST call, workflow step, MCP tool, or container endpoint cannot use its transport as a shortcut around application permissions. The server derives identity and application context, evaluates the requested capability, filters data, executes the approved operation, and records the action where required.

That is the central advantage of the BuildWithHQ developer model: **extend the application without building a parallel backend beside it.**

---

Capability review: 2026-09-14. [View the canonical guide](https://support.buildwithhq.com/api/overview.html).