Developer platform

Build on your evidence workspace

A workspace-scoped REST API described by OpenAPI 3.1.

Connect Claude, ChatGPT, Cursor, and other assistants through an OAuth-secured MCP server.

Quickstart

01In the app, open Workspace settings → API tokens and create a token with the scopes you need.
02Copy the token once — it is stored only as a hash and cannot be shown again. Keep it server-side; never ship it to a browser.
03Send it as Authorization: Bearer wsk_… to any endpoint below.

Rate limit

120 req / min per token

Pagination

cursor + limit (max 100)

Errors

{ error: { code, message } }

List matters · curl

curl -s https://dossierplus.ai/api/public/v1/workspaces/$WORKSPACE_ID/matters \
  -H "Authorization: Bearer $DOSSIER_TOKEN"

Model Context Protocol

Connect an AI assistant

Dossier exposes a Streamable HTTP MCP server secured with OAuth 2.1. Clients register themselves, you approve the connection on a consent screen, and every tool call then runs as you — row-level security applies exactly as it does in the app.

Server URL

https://dossierplus.ai/mcp

Add this URL as a private custom MCP connection, complete Dossier sign-in and consent, then review the tools before using them in a conversation.

ChatGPT setup Claude setup

In Cursor, Codex and other config-file clients, use:

mcp.json

{
  "mcpServers": {
    "dossier": {
      "url": "https://dossierplus.ai/mcp"
    }
  }
}

Available tools

list_mattersreadFind matters the signed-in user can access.
get_matter_overviewreadCounts and headline facts for one matter.
list_timeline_eventsreadChronology with date, tag and text filters.
search_evidencereadLocate source files and see extraction status.
list_actorsreadPeople and companies, including known aliases.
list_storylinesreadThemed storylines, including auto-generated ones.
list_contradictionsreadWhere the record disagrees with itself.
list_dd_casesreadDue-diligence cases with gate and decision state.
get_dd_case_scorereadLatest 0–100 control score and weakest domains.
add_event_notewriteAppend an analyst note to a timeline event.

Security model

Workspace-bound tokens

Every token is scoped to exactly one workspace and carries explicit read/write scopes. Cross-workspace requests return 403 before any data is read.

Hashed at rest

Only a SHA-256 hash of a token is stored, compared in constant time. Revoke or expire a token at any moment; revocation is immediate.

MCP runs as you

MCP tool calls carry a verified OAuth token forwarded to the database, so row-level security applies. No service-role credential is reachable from the MCP surface.

Bounded by design

Page sizes are capped, graph exports are row-limited, and every response carries an X-Request-Id for support and audit correlation.