The Control API, described for machines.

Authentication

None. The Control API needs no API key, token, or OAuth flow, and the OpenAPI document declares an empty security requirement. Do not send credentials. Account, billing, chat, and desktop-sync endpoints are authenticated and are not part of the public surface.

Webhooks and SDKs

Control publishes no webhooks and no client SDK. The surface is small enough to bind directly: import /openapi.json into your tool bridge and call the eight operations by their operationId, or connect to the MCP server below. Each operation carries an inline response schema and an example, so no $ref resolver is needed.

Rate limits

Each client may make 120 requests per 60 seconds, keyed by source IP. Every response carries the IETF RateLimit fields (draft-ietf-httpapi-ratelimit-headers): RateLimit-Policy states the policy and RateLimit states the requests remaining (r) and seconds left in the window (t). Past the quota you get a 429 with Retry-After and the error code rate_limited; wait that many seconds before retrying. A response served from a shared cache repeats the origin's fields, so treat them as advisory when Age is present.

RateLimit-Policy: "public-api";q=120;w=60
RateLimit: "public-api";r=119;t=60

HTTP/1.1 429 Too Many Requests
Retry-After: 42
RateLimit: "public-api";r=0;t=42

Control MCP server

The same eight operations are MCP tools over Streamable HTTP at https://trycontrol.app/mcp. Tool names equal the operation IDs, every tool is read-only and idempotent, and results arrive as structuredContent with an output schema. The endpoint is stateless: JSON-RPC over POST, no sessions, no authentication. Discovery follows the MCP Server Card extension: the AI Catalog at /.well-known/ai-catalog.json points at the Server Card at /mcp/server-card, whose name and version match the live serverInfo.

{
  "mcpServers": {
    "control": {
      "type": "http",
      "url": "https://trycontrol.app/mcp"
    }
  }
}

Predictable responses

Success is always { "success": true, "data": … }. Failures return a 4xx or 5xx status with a stable machine-readable code, a human-readable message, a hint describing the next step, and a documentation link. Nothing under /api answers with an HTML page.

{
  "success": false,
  "error": "No published article exists with the slug \"missing\".",
  "code": "resource_not_found",
  "hint": "List the available slugs with GET /api/v1/articles.",
  "documentation": "https://trycontrol.app/developers"
}

Markdown instead of HTML

Public pages content-negotiate per the acceptmarkdown.com convention. Ask for text/markdown and you get the page without navigation, scripts, or layout markup. Markdown responses set Vary: Accept, and each page advertises its .md sibling through a Link: rel="alternate" header.

curl -s -H "Accept: text/markdown" https://trycontrol.app/pricing
curl -s https://trycontrol.app/pricing.md