Developers

Developer portal

Public APIs on the Comunidad App marketing site for AI agents and integrators: contact, MCP, and discovery documents. The manager panel (gestor.comunidadapp.es) is a separate authenticated application and is not part of this surface.

Quickstart

Register an OAuth client, request a token with the least-privilege scope you need, then call the API.

  1. Register a client: 
    POST https://comunidadapp.es/oauth/register
{
  "client_name": "My agent",
  "grant_types": ["client_credentials"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "contact:write docs:read"
}
  2. Request an access token: 
    curl -sS https://comunidadapp.es/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials \
  -d scope=contact:write
  3. Call the contact API: 
    curl -sS https://comunidadapp.es/api/contact \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Ana","email":"ana@example.com","message":"Demo panel gestor","privacy":true,"locale":"es"}'

OpenAPI specification

The OpenAPI 3.1 document describes endpoints, security schemes, and scopes. Use it to generate clients or so an agent can understand the API automatically.

OAuth 2.0 authentication

The authorization server publishes RFC 8414 metadata. Agents can self-register (RFC 7591) and obtain tokens with client_credentials or authorization_code + PKCE S256.

Scoped permissions

Request only the scope you need. Scopes are declared in OpenAPI security schemes and in RFC 9728 scopes_supported.

Scope Description
docs:read Read public documentation, pricing, and discovery documents.
contact:write Submit a contact inquiry to the Comunidad App team.
mcp:invoke Invoke tools on the Comunidad App MCP server.

Credentials / API keys

There is no API-key dashboard. Dynamic client registration issues a client_id and client_secret, which are the machine credentials. Store the secret; it cannot be retrieved later.

Sandbox

The staging host mirrors the same API, OpenAPI, and OAuth routes. Use it for agent testing without touching production traffic.

https://new.comunidadapp.es

MCP

The MCP server exposes the contact_comunidadapp tool and a contact-form MCP App UI. Authentication is optional; if you send a Bearer token, use the mcp:invoke scope.

Rate limits

Public POST endpoints are rate-limited per IP. A 429 includes Retry-After and RateLimit-* headers. This is application-layer protection; volumetric DDoS still belongs at the firewall / Cloudflare edge.

Endpoint Limit
POST /oauth/register 10 / hour / IP
POST /oauth/token 30 / minute / IP
GET|POST /oauth/authorize 30 / minute / IP
POST /api/contact 8 / hour / IP
POST /mcp 60 / minute / IP

Endpoints