01What connects
Each claused. project can be read from outside the workspace and can send its events to other systems. There are three ways in and out, and all of them are read-only: nothing outside claused. can change a register.
- The MCP connector lets an AI assistant answer questions about the register: what is due this fortnight, which high-risk conditions have no evidence, what condition B12 says word for word.
- The REST API returns the same data as JSON for Power BI, Excel, a data warehouse or your own tools.
- Webhooks post signed events as they happen, so HammerTech, Procore, Workato, Zapier or your own service can act on an incident, an action or a lodged licence report.
An editor on the project sets these up under Project settings, Integrations.
02Tokens
The API and the MCP connector use a read-only token that belongs to one project. It is shown once when it is created, and only a hash of it is stored. Send it as a bearer token:
Authorization: Bearer cl_ro_…
A project can have up to 10 active tokens. Each token may make 120 requests a minute. Revoking a token stops it at once. The workspace shows when each token was last used.
03AI assistants (MCP)
The connector speaks the Model Context Protocol over Streamable HTTP at https://claused.com.au/api/mcp. It works in clients that can send an Authorization header, such as Claude Code and Cursor. Sign-in for the claude.ai and ChatGPT connector directories, which use OAuth, is on the roadmap.
claude mcp add --transport http claused https://claused.com.au/api/mcp \ --header "Authorization: Bearer cl_ro_YOUR_TOKEN"
Every tool is marked read-only:
| Tool | What it returns |
|---|---|
get_project_summary | The project, its instrument, and headline counts: conditions by stage, high-risk conditions, open and overdue actions, open incidents, and what falls due in the next 14 days. |
list_conditions | Conditions in the register, sorted by reference. Filter by stage, type or risk, or search words across the reference, title and verbatim wording. |
get_condition | One condition by its reference (for example B12) or id: verbatim wording, plain English, evidence required, trigger, reporting cadence, and the field records and files filed against it. |
list_actions | Corrective actions with severity, assignee, due date and whether they are overdue. Open actions by default. |
list_incidents | Environmental incidents captured on site, newest first. |
upcoming_deadlines | Everything due or overdue within a window: condition due dates, corrective actions and 21-day EPA licence non-compliance reports. Dates are Sydney calendar dates. |
04REST API
Base URL https://claused.com.au. Responses are JSON and are never cached.
| Endpoint | Returns |
|---|---|
GET /api/v1/project | The project, its instrument and headline counts: conditions by stage, high-risk conditions, open and overdue actions, open incidents. |
GET /api/v1/conditions | Conditions sorted by reference. Filters: stage (to_do, in_progress, under_review, verified), q, type, risk, limit (up to 500), offset. |
GET /api/v1/conditions/{ref} | One condition by reference, for example B12, or by id. Verbatim wording, plain English, trigger, evidence required, and the field records and files filed against it. |
GET /api/v1/actions | Corrective actions. status is open (default), closed or all. Each says whether it is overdue. |
GET /api/v1/incidents | Environmental incidents, newest first. status is open, closed or all (default). |
GET /api/v1/deadlines | Everything due or overdue in the next days (default 30, up to 365): condition due dates, corrective actions and 21-day EPA licence reports. Sydney calendar dates. |
curl -H "Authorization: Bearer cl_ro_YOUR_TOKEN" \ "https://claused.com.au/api/v1/deadlines?days=14"
Errors return a JSON body with an error message: 401 for a missing or revoked token, 404 for an unknown condition, 429 when the rate limit is reached, with a Retry-After header.
05Webhooks
A project can post to up to five HTTPS endpoints. Each endpoint receives every event, or the ones it subscribes to:
| Event | When |
|---|---|
condition.status_changed | A condition moves between To do, In progress, Under review and Verified. |
action.created | A failed inspection item or an observation raises an action. |
action.closed | An action is verified and closed. |
incident.reported | An environmental incident is captured on site. |
incident.closed | An incident is closed out. |
inspection.completed | An inspection is signed off, including rainfall-triggered ones. |
permit.approved | A dewatering or other permit passes its checks and is approved. |
nc_report.lodged | A 21-day licence non-compliance report is marked lodged with the EPA. |
evidence.added | A file or document reference is filed against a condition. |
Each delivery is a POST with this body:
{
"id": "6f1c0d4e-…",
"type": "action.closed",
"created_at": "2026-10-18T03:12:44Z",
"project": { "id": "4d43b435-…", "name": "Northlink Corridor" },
"data": {
"id": "961c9fda-…", "code": "ACT-031", "defect": "Sediment fence SF-07 undermined",
"severity": "major", "assignee": "D. Rossi", "due_at": "2026-10-17T07:00:00Z",
"status": "closed", "closed_at": "2026-10-18T03:12:40Z", "closed_by": "S. Fraser"
},
"links": { "workspace": "https://claused.com.au/workspace?id=4d43b435-…&s=actions" }
}Respond with any 2xx status within 10 seconds. Anything else is retried after 1 minute, 5 minutes, 15 minutes, 1 hour, 3 hours, 6 hours and 12 hours, then marked failed. An endpoint that fails 50 deliveries in a row is switched off and the reason is shown in the workspace. Deliveries are usually sent within two minutes of the event. Use the event id to ignore a repeat. The workspace has a Send test button that posts a ping event.
06Verifying a delivery
Every delivery carries three headers: Claused-Event, Claused-Delivery and Claused-Signature, in the form t=1792300364,v1=5f2b…. The v1 value is an HMAC-SHA256 of the timestamp, a full stop and the raw body, keyed with the endpoint's signing secret. Reject a delivery whose signature does not match or whose timestamp is more than five minutes old.
import crypto from "node:crypto";
// rawBody is the request body exactly as received, before JSON parsing.
export function verifyClaused(rawBody, header, secret, toleranceSeconds = 300) {
const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const t = Number(parts.t);
if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
const a = Buffer.from(expected, "hex");
const b = Buffer.from(parts.v1 ?? "", "hex");
return a.length === b.length && crypto.timingSafeEqual(a, b);
}Secrets begin whsec_, are shown once, and can be rotated from the workspace.
07Limits and safety
- Tokens are scoped to one project and cannot write.
- Webhook URLs must use HTTPS on port 443 or 8443 and resolve to a public address. The address is checked when the endpoint is saved and again before each delivery. Redirects are not followed.
- Events and delivery records are kept for 30 days.
- An integration never blocks a record being saved: if queueing an event fails, the record is still saved.
- Security reports go to support@claused.com.au. See the security policy.