API and AI agents
Everything the app does goes through one API, and that API is also an MCP endpoint. Claude Code, Cursor, and your own scripts can search, create, comment, log time, and read a context pack, with exactly the permissions of the person or agent account behind the token.
The problem
Most ticket systems have an API that lags behind the app and an AI feature that is a chatbot in a sidebar. Anything an assistant does for you still has to be copied into the tool by hand, and access control for integrations is an afterthought.
How SAQ solves it
In SAQ, the API is the product. The web app, email, and the MCP endpoint are adapters on the same services with the same authorization. A Zod contract defines each operation once and produces the HTTP route, the OpenAPI document, the MCP tool, and the frontend types, so they cannot drift.
What you get
- REST API
- Documented with OpenAPI 3.1. Bearer API keys, hashed at rest, shown once, with optional expiry and network restriction.
- MCP endpoint
- Streamable HTTP at
/mcp. A copy-and-paste snippet under Settings → MCP setup for Claude Code and Cursor. - Agent accounts
- A workspace user marked as an agent, such as
claude@acme, with its own token and no interactive login. Actions are attributed to the agent. Agent accounts are not counted as users. - Delegated tokens
- Minted by a person, acting on their behalf within read, write, or triage scope. The audit log records both the token and the person.
- Tools
- Search, get ticket, boards, create and update, move, comment, link, log time, inbox, timesheet, bank balances, GitHub link, and the context pack.
- Context pack
- One call that returns what an assistant needs to prioritize: your in-progress and to-do tickets, overdue and due soon, blocked tickets and blockers, stale tickets, time this period against estimate, unbilled work in progress, and recent GitHub links, all filtered by your permissions and capped per section.
- GitHub links
- Attach a commit, pull request, or URL to a ticket. SAQ stores the link and never fetches it.
- Limits
- Rate limits per key, per address, and per workspace sized by the plan and shared by every key in the workspace (the figures are on the pricing page), Origin checks, no cookies on the MCP path.
Key benefits
- Your coding assistant reads the ticket it is working on and updates it when done
- Unattended agents can triage the Inbox or prepare a morning summary
- Integrations get exactly the access a person would, no more
- Every automated action is attributed and audited
- Your data is reachable by script, not locked in a UI
Typical use cases
- Development in Claude Code. A delegated token with read and write. The assistant reads ACME-184, implements the fix, logs 90 minutes, links the pull request, and moves the ticket to review.
- Morning briefing. An agent account fetches the context pack for each consultant and posts a summary where the team reads it.
- Inbox triage. An agent with triage scope routes support mail to the right project and suggests a kind and priority; a person confirms.
Why this is simpler
There is no integration framework, no webhook designer, and no separate permission system for tokens. A token is a person or an agent with a scope. If you can do it in the app, you can do it through the API; if you cannot, neither can your token.
FAQ
API and AI agent questions
What is MCP?
The Model Context Protocol is an open standard that lets AI tools such as Claude Code and Cursor call tools on a server. SAQ's MCP endpoint exposes tickets, boards, time, and documents as tools, so an assistant working in your code editor can read and update the tickets it is working on.
Can an AI agent see everything?
No. A token acts either as an agent account, which is a workspace user with its own permissions, or on behalf of a person, within a scope that can never exceed what that person may do. Results are permission-filtered before anything is counted or excerpted.
What can be done through the API?
Search tickets, read and update them, comment with any audience the actor may use, move state and project, link tickets and GitHub commits, log time, read boards, download timesheets, read time bank balances, and fetch a context pack. Period close, billing runs, and administration are deliberately not available to any token.
Is there a self-hosted or on-premises option?
Not self-managed. Every plan is hosted by us in the EU, and Enterprise customers can get a dedicated instance run by us on their own hostname. The API and export give you your data at any time.
See whether SAQ fits your team
Workspaces are set up by us, not by a signup form. Tell us how your team works and we set one up, with a 30-day trial. Already invited? Log in.