Build on Floral: REST API, OpenAPI spec and an MCP server.

You do not need to talk to sales to make a first call. Floral has a free 30-day trial, and a token is created by you, in the app. There is no separate sandbox: use a trial workspace with test data as your test environment.

1. Start a free trial (or sign in to an existing workspace at app.floral.so).
2. Open Settings › Assistants › MCP in the workspace, create a personal access token, pick the narrowest scopes and an expiry, and copy the token: it is shown once.
3. Call GET /api/v1/workspaces/{workspaceSlug}/companies with the token as a Bearer header. The quickstart walks through a relationship search next.
4. For an AI client, add https://app.floral.so/mcp as a remote MCP server and sign in with OAuth, or paste the same token.

A versioned REST API over JSON. Every request is pinned to one workspace by its slug. Lists use cursor pagination, records carry ETags, and every operation in the spec has a unique operationId, typed parameters, response schemas and the scopes it needs, so a client generator or an LLM tool definition can be produced straight from the document. The spec at floral.so/openapi.json is the one the product publishes, cached hourly.

Base URL

https://app.floral.so/api/v1

OpenAPI

https://floral.so/openapi.json (OpenAPI 3.1.0, 22 operations)

Docs

https://docs.floral.so

API catalog

/.well-known/api-catalog (RFC 9727)

Authenticate with a personal access token created in your Floral workspace, sent as a Bearer token. A token is pinned to one workspace and carries one or more named scopes. Request the least you need: the spec declares the scopes under x-scopes on the security scheme and lists x-required-scopes on every operation.

curl https://app.floral.so/api/v1/workspaces/{workspaceSlug}/companies \
  -H "Authorization: Bearer $FLORAL_TOKEN" \
  -H "Accept: application/json"

Scopes

• contacts:readRead companies, people, relationships and custom-field definitions in the workspace.
• contacts:writeCreate, update, archive and restore companies and people.
• meetings:readRead meetings, approved summaries and briefings.
• meetings:writeCreate meetings and submit meeting content for summarisation.

Limits are per token and per minute, by class of operation. Every response carries the current limit and what remains; a 429 tells you when to retry.

X-RateLimit-Limit · X-RateLimit-Remaining · Retry-After (429)

The Model Context Protocol server speaks Streamable HTTP and authenticates with OAuth 2.0 (the authorization server and supported scopes are published as RFC 9728 protected-resource metadata). Connections made through OAuth are read-only, and everything runs with the connected user’s workspace membership, role and feature access. Setup guides per client live in the API and MCP overview and in the docs.

Endpoint

https://app.floral.so/mcp

RFC 9728

https://app.floral.so/.well-known/oauth-protected-resource/mcp

RFC 8414

https://clerk.app.floral.so/.well-known/oauth-authorization-server

server.json

https://floral.so/server.json

The major version in the path (/api/v1) is the compatibility boundary. Keep the base path configurable, parse only the fields you need, and treat unknown fields and enum values as expected.

• Within a major version Floral may add operations, optional request fields and filters, response fields, and enum values where the field documentation allows it.
• A breaking change ships as a new major path with at least 180 days of overlap. Before the overlap starts we publish the replacement operation, migration steps, the effective date and a support channel.
• Deprecated operations are marked in the API reference with their replacement. A confirmed security or privacy issue may shorten the window.
• The full policy is in the docs: Versioning and deprecation.