Skip to main content

API Reference

The Plugged.in API provides programmatic access to manage MCP servers, documents, and platform features. All API endpoints are available in both the cloud platform and self-hosted installations.

Base URLs

Authentication

Important: All API endpoints require authentication unless explicitly marked as public. Always include your API key in the Authorization header for every request.
See the Authentication Guide for detailed information on obtaining and managing API keys.

Quick Start

Include your API key in the request headers for all API calls:

Public Endpoints

Only the following endpoints are accessible without authentication:
  • GET /api/search - Public search (with rate limiting)
  • GET /api/servers/{uuid} - Public server information (if server is public)
  • GET /api/users/{username} - Public user profiles

Rate Limiting

API endpoints have different rate limits based on the operation type:

API Endpoints

Search & Discovery

Search MCP Servers

This endpoint is public but has stricter rate limiting for unauthenticated requests. Authenticated requests get higher rate limits.
Search for MCP servers in the registry and community.
Query Parameters:
  • q (string, required) - Search query
  • source (string) - Filter by source: registry, community, all
  • package (string) - Filter by package type: npm, docker, pypi
  • repository (string) - Filter by repository source
  • sort (string) - Sort results: relevance, recent, popular
  • limit (integer) - Results per page (default: 20, max: 100)
  • offset (integer) - Pagination offset
Response:

MCP Servers

Get Server Details

Retrieve detailed information about a specific MCP server.
Response:

Create MCP Server

Add a new MCP server to your profile.
Request Body:

Documents API

List Documents

Get documents from your library.
Query Parameters:
  • profileUuid (string, required) - Profile UUID
  • limit (integer) - Results per page (default: 20)
  • offset (integer) - Pagination offset
  • search (string) - Search query
  • source (string) - Filter by source: upload, ai_generated, api

Upload Document

Upload a document to your library.

Search Documents

Semantic search across your document library.
Request Body:

Collections API

Get Collections

Retrieve collections for a profile.

Create Collection

Create a new collection of MCP servers.
Request Body:

Update Collection

Update an existing collection’s metadata and server list.
Request Body:

Delete Collection

Remove a collection and its associations.

Registry API

Submit to Registry

Submit an MCP server to the official registry.
Request Body:
Requirements:
  • Must be authenticated with GitHub
  • Must have repository ownership
  • Valid package.json/Dockerfile/setup.py

Get Server Statistics

Get detailed statistics for a server.
Response:

Registry Health Check

Check the status of the MCP registry.
Response:

Registry API

Submit to Registry

Submit an MCP server to the official registry.
Request Body:
Requirements:
  • Must be authenticated with GitHub
  • Must have repository ownership
  • Valid package.json/Dockerfile/setup.py

Get Server Statistics

Get detailed statistics for a server.
Response:

OAuth API

OAuth Sessions

Get all OAuth sessions for the authenticated user.
Response:

Create OAuth Session

Initiate a new OAuth session for MCP server authentication.
Request Body:
Response:

OAuth Callback

Handle OAuth provider callback with authorization code.
Request Body:
Response:

Get OAuth Session

Retrieve details for a specific OAuth session.
Response:

Delete OAuth Session

Revoke an OAuth session and associated tokens.
Response:

User Management

Check Username Availability

Check if a username is available.
Response:

Get User Profile

Get public user profile information.
Response:

Update User Profile

Update the authenticated user’s profile information.
Request Body:

Notifications API

All notification endpoints require authentication. Include your API key in the Authorization header.

Get Notifications

Retrieve notifications for the authenticated user.
Query Parameters:
  • unread (boolean) - Filter unread only
  • limit (integer) - Results per page (default: 20, max: 100)
  • offset (integer) - Pagination offset
Response:

Mark as Read

Mark a notification as read.
Response:

Delete Notification

Delete a notification permanently.
Response:

Send Custom Notification (MCP Tool)

This is typically called via MCP tools, but can also be used via API.
Request Body:

Embedded Chat API

Create Chat Session

Initialize a new embedded chat session.
Request Body:

Send Message

Send a message in a chat session.
Request Body:

Error Handling

All API endpoints return consistent error responses:

Common Error Codes

Webhooks

Authentication Required: Webhook configuration and management requires authentication. Webhook payloads include a signature for verification.
Configure webhooks to receive real-time notifications about events in your Plugged.in account.

Setting Up Webhooks

Register a Webhook Endpoint

Response:

List Webhooks

Update Webhook

Delete Webhook

Webhook Security

Signature Verification

All webhook payloads include a signature in the X-Pluggedin-Signature header for verification:

Supported Events

Webhook Payload Format

Webhook Retry Policy

Failed webhook deliveries are retried with exponential backoff:
  • 1st retry: After 1 minute
  • 2nd retry: After 5 minutes
  • 3rd retry: After 30 minutes
  • 4th retry: After 2 hours
  • 5th retry: After 12 hours
After 5 failed attempts, the webhook is marked as failed and no further retries are attempted.

Testing Webhooks

Test Webhook Endpoint

Send a test event to your webhook:

Analytics API

Retrieve trending MCP servers based on activity and popularity.
Query Parameters:
  • limit (integer) - Number of results (default: 20, max: 100)
  • timeframe (string) - Time period: day, week, month (default: week)
  • category (string) - Filter by category
Response:

Get Service Search Statistics

Get search analytics for service discovery.
Query Parameters:
  • q (string) - Search query to analyze
  • timeframe (string) - Analysis period: day, week, month
Response:

Maintenance & Cron Jobs

OAuth PKCE State Cleanup

This endpoint is designed for external cron jobs to periodically clean up expired OAuth PKCE states. The cleanup also runs automatically in-process, so external cron is optional but recommended for production.
Clean up expired OAuth PKCE states to prevent database bloat and ensure security. Endpoint: POST /api/oauth/cleanup-pkce Authentication: Requires CRON_SECRET in Authorization header Recommended Schedule: Every 10-15 minutes
Response:
Development Testing: In development, you can use GET without authentication:
Production Security:GET method is disabled in production for security. Always use POST with Bearer token authentication in production environments.
Cron Configuration Examples:
See the Maintenance Guide for complete setup instructions and best practices.

Webhook Best Practices

Never process webhooks without verifying the signature to ensure they’re from Plugged.in.
Return a 2xx status code within 5 seconds. Process webhook data asynchronously if needed.
Use the event ID to handle potential duplicate deliveries:
Check webhook delivery status regularly:

Support