Skip to content

Developers

Connect your systems and agents by API, webhooks and MCP.

Spectra exposes its data and actions through public REST APIs, signed webhooks and an MCP server. API documentation, with an OpenAPI 3.1 spec, is shared on request.

Talk to salesSee the MCP server

Public REST APIs

The APIs cover what other systems most often need. The storefront API serves vehicles, parts products, carts, checkout and orders to websites. Supplier EDI uses scoped keys with idempotency.

  • Storefront v1

    Headless access to vehicles, products, carts, checkout and orders.

  • Supplier EDI

    Scoped keys and idempotency.

  • Part-exchange intake

    Take part-exchange enquiries in from your website.

  • Event ingest and 3CX

    Endpoints for events from your site and for the phone system.

  • Rate limiting

    Public APIs are rate-limited.

API documentation is shared on request

The API documentation and its OpenAPI 3.1 spec are generated from one endpoint catalogue, so they agree. We do not publish them yet. Ask at hello@spectradms.com or in a demo.

  • OpenAPI 3.1

    Generated from the endpoint catalogue, shared on request.

  • llms.txt

    A compact map of the API for agents, shared with the documentation.

Webhooks you can verify

From Professional

Outbound event webhooks are signed with HMAC-SHA256, so you can verify they came from Spectra. Named integration endpoints hold credentials write-only. Both live in the Data Hub, part of Professional.

  • HMAC-signed outbound events
  • Write-only credentials on named endpoints
  • An HTTP request step and named integration step in the automation builder

An MCP server for your agents

From Professional

Connect an MCP-compatible agent and it can operate the DMS through 80 tools across 13 areas. Agents see only tools their OAuth scopes allow. Calls are rate-limited and audit-logged.

  • 80 tools across 13 areas
  • OAuth 2.1 with PKCE and client credentials, standard metadata endpoints
  • Tools filtered by OAuth scope
  • Rate-limited and audit-logged

An audit log for agent actions

From Professional

The agent audit log records MCP calls and mail-agent actions, tagging each entry as agent, human or system. API clients and the audit log are part of Professional.

Supplier EDI

Suppliers work in their own portal or connect through the REST and EDI API. One supplier login can serve several dealerships. Both are part of Professional.

A headless storefront, a WordPress plugin, an embeddable widget

The headless storefront API serves your stock, products and checkout. The WordPress plugin, Spectra Shop, uses an HMAC-signed reverse proxy with no iframes. Custom domains are available on Enterprise.

  • Headless API

    From Professional

    Your stock, products and checkout as JSON.

  • WordPress plugin

    From Professional

    Spectra Shop, through a signed reverse proxy.

  • Embeddable widget

    From Professional

    Shadow DOM, so it keeps clear of the page styles.

What each plan includes

API clients, MCP, webhooks and the agent audit log start at Professional, with read-only API access. Enterprise includes full API access, by arrangement.

  • Starter

    No API clients, MCP or webhooks.

  • Professional

    Read-only API, MCP, webhooks, API clients and audit log.

  • Enterprise

    Full API access, by arrangement.

Send events in and out

From Professional

A consent-first website event-tracking SDK feeds analytics and automation triggers. The automation builder can call out over HTTP, a webhook or a named integration. Both are part of Professional.

Questions and answers

Can I see the API documentation?

Yes, on request. We share the documentation and its OpenAPI 3.1 spec directly, and do not publish them yet. Ask at hello@spectradms.com or in a demo.

How are webhooks secured?

Outbound event webhooks are signed with HMAC-SHA256 in the X-Webhook-Signature header, over a timestamp and the raw body. Verify the signature on receipt.

What are the rate limits?

APIs and the MCP server are rate-limited. We do not publish figures on this page, so ask us if you expect high volume.

Can an agent write data, or only read it?

Both, within limits. Some MCP tools create or update records, such as contacts, deals and bookings. An agent can use only the tools its OAuth scopes allow, and its calls go into an audit log.

Do I get full read and write API access?

Professional includes read-only API access. Full API access is part of Enterprise, by arrangement. Talk to us about what you need to build.

Building something on Spectra?

Tell us what you want to connect. We will say which endpoints, webhooks or MCP tools get you there.

Talk to salesSee pricing

Spectra. The DMS for leisure dealers.