API & MCP

Use Wavemaker programmatically — platform-api REST and Bearer MCP for Discover, runs, graphs, iterate, and packs.

Last updated August 12, 2026

The live product API is platform-api (local :8790, $PLATFORM_API_URL). Paths are origin-rooted (/runs, /mcp). Do not call https://api.wavemaker.io/api/v1/videos or worker /mcp — those routes return HTTP 410.

SurfaceHostRESTMCPAuth
Platform (live)$PLATFORM_API_URL/discover, /runs, /iterate/*, /openapi.jsonBearer POST /mcpwm_ key or org JWT
KEEP workerapi.wavemaker.ioAuth, billing, Studio Inngest/mcp → 410Site login / Stripe
Managed media (retired)api.wavemaker.io/api/v1/* gen → 410OAuth /mcp → 410—

Contracts: OpenAPI YAML · public GET $PLATFORM_API_URL/openapi.json · api-mcp guide · /developers#platform.

Authentication

Mint a wm_ key in the app (Account → Keys) and send it as a bearer token:

curl -X POST "$PLATFORM_API_URL/runs" \
  -H "Authorization: Bearer wm_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"workflowId":"<uuid>","graph":{...},"inputs":{"prompt":"editorial lookbook"}}'

MCP:

curl -X POST "$PLATFORM_API_URL/mcp" \
  -H "Authorization: Bearer wm_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Scopes: runs:read / runs:write / workflows:write. Product shell cookie is wm_shell (POST /auth/shell-session); direct platform-api cookie is wm_session (POST /auth/session). CSRF on cookie auth: X-Platform-Client: web on unsafe methods.

Copy-paste client setup (Cursor, Claude Desktop, Claude Code) is on /developers#platform.

The core flow

# 1. Discover or bind a workflow, or author a graph in a session
GET  /discover?q=fashion
POST /sessions
POST /sessions/{id}/op          # SessionOp / GraphOp
# MCP: search_workflows → create_session → get_session → apply_workflow / edit_graph

# 2. Validate (free) + cost preflight
POST /workflows/validate
POST /runs/preflight

# 3. Submit (Idempotency-Key recommended)
POST /runs
# MCP: run_workflow (session) or submit_run

# 4. Poll
GET /runs/{runId}
GET /runs/{runId}/events
GET /run-groups/{runGroupId}

# 5. Iterate a gallery file
POST /iterate/resolve
POST /iterate/execute           # clientRequestId; likenessConsent for face_swap

Large uploads: MCP mint_file_upload returns a presigned PUT URL. Parked identity refs: POST /run-groups/{id}/resume with inputs. Production edit on idle General Video: POST /run-groups/{id}/edit. Reassemble a terminal group: POST /run-groups/{id}/reassemble.

Catalog campaigns (DCO): POST /campaigns/engage with feedFileId + template (static-ads | ads-catalog-video, {{slot}} prompt) — 24-variant cap, campaignId = runGroupId. Poll GET /campaigns/{id}. MCP: engage_campaign / get_campaign. Dashboard: /platform/campaigns. Creative packs: /creative-packs/*.

Retired managed kernel (HTTP 410)

POST /api/v1/videos, /api/v1/static-ads, /api/v1/audio, /api/v1/w/{slug}/runs, worker OAuth /mcp, and the old workspace tool catalog are gone. Do not copy them into new integrations. Historical shape (if you are migrating): docs/public-api.md (archived) and the retired block on /developers.

Use the Platform table above instead.