Agents, canvases and API access

Build a useful canvas

1. Create a private canvas or choose a starter such as prepublication review or article-to-social drafts.
2. Choose the source content and add a prompt. Connect those nodes to a configured provider or named agent. Unresolved starter fields must be filled before running.
3. Save, then preview the exact context, destination and chosen model/tool. Run only after reviewing the request.
4. Read the returned note or private media result. A result does not publish or replace an article; apply editorial changes through their separate review/save flow.

Story-to-video uses separately reviewed stages: produce and review a script, connect that result to a configured video/render provider, then review and run that stage. It does not assume a universal video API.

Managed and external agents

• Managed text agent: GoRun uses the saved connection and selected model to produce a text result inside the reviewed canvas.
• External MCP agent: the named external client must connect and pick up delegated work. A waiting state does not mean the client is already running.
• Agent keys need both appropriate scopes and an explicit board grant. Grants expose selected context, not all private boards.
• Schedules begin disabled. Enable recurring work explicitly after reviewing its request; later source/graph/provider changes may require renewed consent.
• Cancel stops local acceptance or dispatch where possible; it cannot recall a request already accepted by an external provider.

Draft with the content studio

The studio below a saved content editor can use the current unsaved title and text. Choose text, image or a supported MCP media task, adjust the prompt and review the parameters before generating. Removing a studio candidate does not delete a media file already imported into Media.

A saved connection is not sufficient for every capability. Images require a supported image endpoint and explicit model; video/render require a configured tool and output/status mapping. Tool discovery is not generation.

Use the correct key and native schema

Open /api/docs on your own site for its interactive REST documentation, and /api/v1/openapi.json for the generated schema. Use an API key for REST and an agent key for /mcp. These key types are not interchangeable.

REST uses an Authorization: Bearer header. Keep the real token in a private environment or secret manager, never in public page HTML, URLs or screenshots. Key scopes intersect with the owner’s current permissions. Unsafe native session requests also need CSRF protection.

Read the schemas exposed by the installed site rather than copying speculative endpoints. Use test data and explicit review before any write, provider call or publication.