Every tool and endpoint

MCP tools

Account and approvals

Domains and DNS

People and handovers

Sites and files

Mail forwarding

Forms

Web shop

Building blocks

HTTP API

Most of Spaicely is reached over MCP, but a few things are plain HTTP: domain search without an account, the forms on customer sites, uploading a site as one archive, and the OAuth endpoints every MCP client uses. Some examples first; the full list follows.

Is a domain free?

No account and no key. Names go in the path, comma-separated; extensions are optional.

curl https://app.spaicely.com/api/domains/search/bakkerijjansen/nl,com

{
  "results": [
    {
      "domain": "bakkerijjansen.nl",
      "extension": "nl",
      "status": "likely_available",
      "checked_via": "dns",
      "reason": "dns_only",
      "register_url": "https://app.spaicely.com/domains/new?name=bakkerijjansen.nl"
    },
    …
  ],
  "verify_url": "https://app.spaicely.com/api/domains/verify/bakkerijjansen.nl,bakkerijjansen.com",
  "statuses": { … },
  "reasons": { … }
}

The quick check only asks DNS. For the names someone likes, follow verify_url: it asks the registry (at most 10 domains) and gives available or taken, and a price for premium names. /api/domains/extensions lists every extension with its price.

curl https://app.spaicely.com/api/domains/verify/bakkerijjansen.nl,bakkerijjansen.com
curl https://app.spaicely.com/api/domains/extensions

From JavaScript in a browser (CORS is open):

const answer = await fetch("https://app.spaicely.com/api/domains/search/bakkerijjansen/nl,com").then((r) => r.json());
const free = answer.results.filter((r) => r.status !== "taken").map((r) => r.domain);

Sending a form from JavaScript

A form made with scripts.enable works as plain HTML. To stay on the page, send it with fetch and ask for JSON:

form.addEventListener("submit", async (event) => {
  event.preventDefault();
  const response = await fetch(form.action, {
    method: "POST",
    headers: { Accept: "application/json" },
    body: new URLSearchParams(new FormData(form)),
  });
  const answer = await response.json();   // {"ok": true} or {"ok": false, "error": "rate_limited"}
  form.replaceWith(answer.ok ? "Thank you, we will get back to you." : "That did not work, please try again later.");
});

Only the site's own connected domain may post; from anywhere else, curl included, the answer is 403 origin_not_allowed.

Uploading a site in one go

sites.upload_url gives a one-time address, valid for ten minutes. Send the site as a tar.gz to it; the answer is the new version, which sites.publish then puts live.

tar -czf site.tar.gz -C _site .
curl -T site.tar.gz "https://app.spaicely.com/uploads/<token from sites.upload_url>"

Calling MCP without a client library

The server is stateless, so one POST is one call. The public server needs no sign-in:

curl https://mcp.spaicely.com/mcp/public \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
       "params": {"name": "domains.search", "arguments": {"names": ["bakkerijjansen"], "extensions": ["nl"]}}}'

The signed-in server at https://mcp.spaicely.com/mcp takes the same requests with Authorization: Bearer <access token>. Without one it answers 401 with a WWW-Authenticate header that points to the protected resource metadata, where an MCP client finds everything it needs to sign in:

1. Read /.well-known/oauth-protected-resource/mcp on mcp.spaicely.com, then /.well-known/oauth-authorization-server on app.spaicely.com.
2. Register with POST /oauth/register (dynamic client registration; public clients, no secret), or skip this step and pass the https URL of your client ID metadata document as client_id.
3. Send the person to /oauth/authorize with PKCE S256 and resource=https://mcp.spaicely.com/mcp; they choose the account, sites and scopes. A client that only needs some files adds paths=blog/**,sitemap.xml; its tokens then change files only there.
4. Swap the code at POST /oauth/token. An access token lasts an hour; the refresh token is replaced at every use and lapses after 30 days unused.

All endpoints

Scopes

Rights a client asks for; on the consent screen they are all ticked and the person unticks what the AI may not do. A purchase always needs a second, confirmed call.