Lev developer resources: API, OpenAPI, MCP, and auth

Lev developer resources

Build on Lev with the REST API, OpenAPI description, MCP server, authentication model, and agent-facing docs. This page is the predictable index for developer tools so a name-based search for Lev API, Lev MCP, or Lev OpenAPI lands on a real resource instead of a marketing shell.

Open Lev API docs OpenAPI spec

Predictable URLs

Use these canonical developer surfaces. These resources are listed in llms.txt; the API catalog and MCP server card link back to this hub.

Lev API overview

REST JSON API at https://api.lev.com/api/external/v2 for deals, documents, CRM, lenders, term sheets, and market data.

OpenAPI description

OpenAPI 3.1 spec reconstructed from the documented endpoints. Also linked from /.well-known/api-catalog.

Authentication and API keys

Bearer API keys (lev_sk_) for server-to-server jobs and Auth0 JWTs for interactive and MCP clients.

Scoped permissions

OAuth scopes, API key inheritance, workspace roles, and the ai:actions platform scope for credit-charging writes.

Rate limits

Per-account and per-endpoint request budgets and 429 retry_after_seconds.

Versioning and deprecation

URL versioning under /api/external/v2, breaking-change policy, and Sunset/Deprecation signaling.

Lev MCP

Streamable HTTP MCP at https://mcp.lev.com/mcp. Tool catalog, OAuth, and setup for Claude, Cursor, and ChatGPT.

MCP tools

Public listing of the 60 registered tools across 13 groups, with read/write classification and REST counterparts.

CLI setup

Documented Lev CLI command surface. The pipx package is not on PyPI yet; use the REST API or MCP until GA.

Docs for agents

Compact docs index plus /docs/llms-full.txt and per-page .md representations from the docs site.

Scoped permissions

Agents should request only the access they need. Lev separates identity scopes from resource authorization.

OAuth scopes (MCP)

The Lev MCP server asks Auth0 for openid and email during authorization-code + PKCE. Those scopes authenticate the session. They do not expand what the user can do. Every tool call is authorized against the live Lev workspace role. Call get_my_profile to inspect the active account.

API keys and roles

API keys are prefixed lev_sk_and inherit the creating user's account permissions. A key cannot access resources the user cannot access. Key presets are full_access and read_only. Workspace and Vault roles are separate. Revocation is immediate.

Platform scopes

Some writes are gated by platform scopes. POST /contacts/{contact_id}/actions/unlock charges credits and requires ai:actions. Treat credit-charging or irreversible external actions as confirming writes.

Versioning and deprecation

Stable Lev REST operations live under /api/external/v2 on https://api.lev.com. Breaking changes require a new major path. Additive fields and optional parameters may appear on the current major version without a path change.

Document the replacement in the API reference and changelog.
Keep the old operation available for at least one stable major version after the announcement.
Signal deprecation on affected responses with RFC 9745 Deprecation and, when a removal date is scheduled, Sunset headers.

Agents should treat the presence of a Deprecation header as a warning to migrate. RFC 9745 values are dates (for example @1688169599); parse that date when present. Honor Sunset as the last-response date, and prefer operationId values from the OpenAPI description.

Rate limits

Authenticated endpoints apply per-account and per-endpoint request-per-minute budgets (free 30/10, standard 100/20, enterprise 500/60). A 429 body includes retry_after_seconds. Back off on 429 and honor Retry-After when present.

Rate limit docs