Available now: API keys and the reporting API support authorised integrations. Planned: the broader organisation-key, user-OAuth and incremental automation workflows described below are still being developed; do not assume every proposed endpoint or write action is released.
Start with the current API
Open API in the main navigation.
Create a named API key and store it in your integration's secret settings.
Read the API guidance and use the documented reporting endpoints and filters.
Ask support for the current endpoint list and any required gateway subscription access.
Verify a small read request and confirm its account and tenant scope.
The API uses your authorised access. A key does not add a subscription entitlement. Keep the full secret out of chat prompts, screenshots and source control. Hosted MCP uses OAuth instead and exposes its own supported tool set.
Build a reliable review integration
Use the source and stable item ID to identify records. Follow pagination and the endpoint's current filter contract. When an announcement changes, update the mapped destination record instead of creating a duplicate task. Preserve the destination's owner, comments and completion state unless your workflow intentionally changes them.
Message Center, Roadmap and Azure remain separate source datasets. Use only the endpoints and fields confirmed in the current API reference.
API and MCP rate limits
We may rate-limit API and MCP use to keep ChangePilot reliable for everyone. We may change these limits with reasonable notice.
Current limits, checked on 26 October 2026:
REST API: 1,000 calls per minute and 10 million calls per month, per client IP address.
Public Message Center feed (/public): 30 calls per minute, per client IP address.
Hosted MCP (/mcp): 30 requests per minute, per caller credential. Requests using the same key share this allowance. MCP connection and tool-discovery requests count as well as tool calls.
IP-based allowances are shared by integrations using the same public IP address, for example through a shared corporate network. The local MCP server calls the REST API and is subject to its API limits.
If you receive HTTP 429 (Too Many Requests), pause requests and wait for the time in the Retry-After header when supplied. Otherwise, retry with an increasing delay. Avoid immediate retry loops and large bursts; use filters and pagination to retrieve only what you need. If you reach a monthly allowance or need help planning higher-volume use, contact help@changepilot.cloud.
Planned expansion
The design includes organisation-scoped credentials, supported user actions, incremental retrieval with opaque cursors, and polling-based external workflows. The planned Power Automate connector will support retrieval and label-based workflows. These descriptions are not a released endpoint reference, and there is no promised outbound webhook workflow here.
Keep credentials scoped to the intended organisation and check supported actions before building a dependency. Contact support when your integration needs a capability absent from the current reference.