Skip to content
Notificado
Menu
Create account

Integrations

API authentication

How HTTP calls to Notificado's API authenticate, and when to use an agent token over MCP instead.

Updated:

Notificado has two doors for programs, with different credentials:

Door Credential For
MCP — POST https://www.notificado.co/mcp Agent token: Authorization: Bearer ult_prod_… AI assistants and integrations. Tools limited by scopes.
HTTP — /api/… and /_x/query/… A signed-in user's session (cookie) What the panel itself calls. Documented in the reference.

Agent tokens (MCP)

  1. A firm owner or lawyer opens Account → API (/cuenta/api).
  2. They name the token, pick its scopes and a lifetime of 30, 90 or 365 days, or no expiry.
  3. The token is shown once. We store only its hash; if it is lost, revoke it and issue another.

A token acts for the person who issued it, in their firm, with their current role: if that person leaves the firm or is demoted, the token loses that power on the next call. The prefix (ult_prod_<id>) is safe to show and log; the rest is a password.

Scope What it allows
cases:read List and read the firm's cases.
cases:write Create and edit cases and parties; upload documents.
notifications:read List and read notifications, the credit balance, and verify constancias.
notifications:write Prepare drafts, attach documents and request a send, which a lawyer confirms in the panel.
evidence:read Download the signed constancia and the evidence package (each download is recorded).

No scope allows adding or removing recipients, confirming a send, buying credits, or anything in the staff console.

The HTTP API with a session

Sign in and keep the cookie:

curl -c cookies.txt -X POST 'https://www.notificado.co/api/ins/sign' \
  -H 'content-type: application/json' \
  -d '{"email":"lawyer@example.co","password":"<password>"}'

Then send the cookie on every call (-b cookies.txt). Writes (POST) from outside a browser must also state the origin, -H 'origin: https://www.notificado.co'; without it they are refused with X_CSRF_BLOCKED.

In TypeScript from a server (Bun, Node, Deno), the reference's examples use sessionCookie: the name=value pair of the cookie your sign-in answered.

A session lasts 30 days at most and ends after 7 days unused. Many operations take orgId: your firm's id.

Error answers

Every refusal carries code, cause and fix. See Errors and Limits.