PUBLIC INTEGRATION

Evidence you can trace.
Access you can control.

Use a personal, environment-bound credential to retrieve bounded operational evidence through REST or genuine MCP. Every query is restricted by your current Mantap entitlement, tool grants, and client scope.

Quickstart

1. Open Mantap → Knowledge Health.
2. Review My integration credential and generate a credential if you are entitled.
3. Copy the credential once and store it in your approved secret manager.
4. Call GET /v1/tools before your first retrieval.

Copycurl https://knowledge.onebrick.io/v1/tools \
  -H "Authorization: Bearer $KNOWLEDGE_CREDENTIAL"

Personal credentials

One credential can be active for each Mantap user and environment. The raw value is shown only after generation or rotation. Rotation invalidates the previous value immediately; revocation blocks both REST and MCP.

Client scope

Authorization happens before any Knowledge query. Grants name exact tools and exact client UUIDs. If a transaction reference matches more than one authorized client, send client_id; Knowledge returns 409 ambiguous_client_scope instead of guessing.

REST API

POST /v1/retrieve

Copy{
  "query": "Show the transaction timeline",
  "tool": "graph.transaction_timeline",
  "params": {
    "transaction_reference": "TX-123",
    "client_id": "00000000-0000-0000-0000-000000000001",
    "start": "2026-09-13T00:00:00Z",
    "end": "2026-09-14T00:00:00Z",
    "limit": 20
  }
}

Errors

MCP Integration

Connect to https://knowledge.onebrick.io/mcp with Streamable HTTP. Send the personal credential as a Bearer token on every HTTP request. The server is stateless and uses the official MCP Python SDK.

Copy{
  "mcpServers": {
    "bricko-knowledge": {
      "url": "https://knowledge.onebrick.io/mcp",
      "headers": { "Authorization": "Bearer ${KNOWLEDGE_CREDENTIAL}" }
    }
  }
}

Compatibility

Personal access tokens are supported. OAuth-only clients are not currently supported. Streamable HTTP serves current 2026 clients and compatible 2025 clients; the deprecated HTTP+SSE transport is not exposed.

Code examples

Copyimport os, requests

response = requests.post(
    "https://knowledge.onebrick.io/v1/retrieve",
    headers={"Authorization": f"Bearer {os.environ['KNOWLEDGE_CREDENTIAL']}"},
    json={"tool": "graph.knowledge_freshness", "params": {}},
    timeout=10,
)
response.raise_for_status()
print(response.json())

Copyconst response = await fetch("https://knowledge.onebrick.io/v1/tools", {
  headers: { Authorization: `Bearer ${process.env.KNOWLEDGE_CREDENTIAL}` },
});
if (!response.ok) throw new Error(`Knowledge returned ${response.status}`);
console.log(await response.json());

Copyreq, _ := http.NewRequest(http.MethodGet, "https://knowledge.onebrick.io/v1/tools", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KNOWLEDGE_CREDENTIAL"))
resp, err := http.DefaultClient.Do(req)
if err != nil { log.Fatal(err) }
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK { log.Fatalf("Knowledge returned %d", resp.StatusCode) }

Evidence contract

Responses distinguish known evidence from missing context, include traversal counts and truncation, and preserve provenance where the selected tool provides it. Absence of evidence is never reported as proof of absence or root cause.

Safety limits

• Fixed, parameterized, read-only SQL over narrow rag.* views.
• Maximum 50 records, seven-day windows, and five-second database statements.
• Finance tools remain disabled unless the service and user both have exact client scope.
• No caller SQL, vector search, embeddings, external LLM provider, or Knowledge write path.

Tool catalogue

Use GET /v1/tools for the authoritative catalogue filtered to your active grants. Graph tools cover transaction context, timelines, relationships, related transactions, blast radius, provenance, pipeline lineage, and freshness. Finance tools appear only when the governed Finance capability is enabled.