---
title: Build agents on the API
description: When to build your own agent or automation on the REST or GraphQL API instead of the MCP server, and how it authenticates.
canonical: https://developers.coevera.com/ai/build-agents-on-the-api/
section: ai
publisher: Coevera
---

# Build agents on the API

**Answer:** To build your own agent or automation, call the Coevera REST or GraphQL API with an API application's user name and password over HTTP Basic. The MCP server suits assistants that a person signs in to and supervises; it offers 20 fixed tools. OAuth applications for third-party integrations are not yet available, so API applications are the documented path.

## MCP server or API?

|                     | MCP server                                                        | REST and GraphQL API                                                                                              |
| ------------------- | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Who it acts as      | The person who signed in and approved the scopes                  | An API application, with the permissions an admin gave it                                                         |
| Sign-in             | OAuth, through a connector that Coevera activates                 | The application's user name and password over HTTP Basic                                                          |
| Coverage            | 20 tools over the main record types, custom entities included     | Every entity in the space, custom entities included, plus fields and pipelines                                    |
| Reacting to changes | Not available: the assistant has to ask                           | [Webhooks](/webhooks/overview/) for record events                                                                 |
| Business actions    | Bulk move, archive and qualify; change of owner                   | Qualify, move and change of owner in GraphQL ([REST or GraphQL?](/get-started/rest-or-graphql/#business-actions)) |
| Where it runs       | United States, for every space                                    | Your space's own region                                                                                           |
| Limits              | Burst per token and sustained per space; thresholds not published | A monthly call quota by plan ([pricing](https://www.coevera.com/crm/pricing/))                                    |

Use the MCP server when a person works through an assistant such as Claude or ChatGPT. Use the API
when your own code runs without a person in the loop: a sync, a scheduled job, a back-office
agent, or a service that reacts to webhooks.

## Authenticate as an API application

An API application is a user type for integrations. It has its own user name and password and its
own permissions, so each integration gets only the access it needs, and its writes show its
name in the record history. The [quickstart](/get-started/quickstart/#get-api-credentials) shows
how to create one and make a first call, and [authentication](/get-started/authentication/) how
its credentials are sent and rotated.

OAuth applications for third-party integrations are not yet available. OAuth exists only behind
the AI connectors; see [OAuth and scopes](/ai/oauth-and-scopes/).

## Tips for agent builders

- **Give the application only the permissions the agent needs.** Permissions are set per
  application, in the Records, Administration and Misc sections
  ([permissions and scopes](/get-started/permissions-and-scopes/)).
- **Read the schema of the actual space.** Spaces differ: custom fields, custom entities and
  renamed entities. An authenticated request for
  `/api/v100/rest/spaces/{space_id}/openapi.json` returns an OpenAPI document built for that
  space, its custom fields and custom entities included ([tools](/get-started/tools/#your-spaces-own-documents)).
- **Branch on the error `code`.** A missing permission answers `400` with code `50`, not
  `403`; [errors](/concepts/errors/) lists what each status means.
- **Retry on `429`.** Wait for the seconds in `Retry-After`, then retry
  ([rate limits and retries](/concepts/rate-limits-and-retries/)).
- **Check every item of a batch.** A batch write can succeed for some records and fail for
  others; read the result for each item ([batch operations](/concepts/batch-operations/#partial-failures)).
- **Give the agent these docs.** Every page here is also plain Markdown, listed in `llms.txt`;
  see [Use these docs with AI](/ai/use-the-docs-with-ai/).