Skip to main content
The Enfors Data API serves read access to your workspace. It accepts two kinds of credentials, both presented as a bearer token.

​
Base URL

REST endpoints are versioned under /v1. The MCP server is mounted at /mcp (see MCP overview).
These credentials authenticate the Data API on data.enfors.ai — the read side. Interactive clients sign in via SSO: this is how both the watcher and the Ask Enfors MCP server (data.enfors.ai/mcp) connect. Scripts and services use a Personal Access Token instead. All of this is separate from the LLM Gateway Key, which authenticates model calls routed through the gateway (llm.enfors.ai) and is provisioned automatically at signup.

​
Token types

Personal Access Token (enf_live_…)

Opaque, long-lived tokens for programmatic access to the Data API. Validated inline by Enfors. Create one under Admin → API Keys → Personal Access Tokens; the plaintext is shown once. Best for scripts, services, and non-OAuth clients.

SSO (OAuth / JWT)

The default for interactive use — the watcher and OAuth-capable MCP clients run the SSO flow, and the web app uses short-lived JWTs verified via the API Gateway authorizer.

​
Making a request

Every request is scoped to your tenant, workspace, and user by Row-Level Security. You can only read data you’re entitled to — there is no cross-tenant access. See Tenancy, Privacy & PII.

​
Which surface should I use?

  • Asking questions / building agents → use the MCP server. It exposes safe, high-level tools and is what Claude Code / Cursor / Claude Desktop talk to.
  • Direct integration / data export → use the REST endpoints.