Skip to main content

API overview and authentication

You do not need the API to use Bryn: the dashboard covers setup and day-to-day operation. Reach for the API when you want to script configuration, pull data into your own systems, or build on top of what Bryn knows. The same capabilities are exposed to AI clients through the MCP server.

Base URLs​

  • REST API: https://bryn.civic.com/api
  • MCP endpoint: https://bryn.civic.com/mcp

Authentication​

The API is authenticated with Civic Auth bearer tokens (Authorization: Bearer <jwt>).

The JWT identifies the caller, not the tenant. Bryn resolves the active tenant from the caller's memberships on every request:

  • One membership: that tenant is selected implicitly; no header needed.
  • More than one: send X-Bryn-Tenant: <tenantId> naming one of your tenants.
  • Multi-membership with the header missing: 403 ambiguous_tenant.
  • A tenant you don't belong to: 403 tenant_forbidden.
note

The X-Bryn-Tenant header is a selector, not the source of truth: the tenant bound at the data layer is always taken from the matched membership.

Explore​

API reference

Browse the customer-facing REST endpoints with request/response schemas and an interactive "Try it" console.

MCP server

Connect an MCP client to Bryn over OAuth-secured streamable HTTP.

Server-side events & signing

Send signed events from your backend and link them to known accounts.