# API & MCP — connect business systems and AI assistants

> Company API keys, personal tokens, connecting Claude, ChatGPT and Cursor to jeCheck over MCP, the call log and security.

Источник: https://jecheck.io/en/docs/account/api-mcp

The **API & MCP** section opens jeCheck data to other systems and AI assistants: an ERP can pull audits and create tasks, BI can build reports, and Claude or ChatGPT can answer questions about your network and prepare reviews. Everything follows the same permissions as the web app: a key or an assistant sees only what it is allowed to.

Open it from **Management → API & MCP** or from the profile menu (click your name at the bottom of the side menu). API and MCP are available on the **Enterprise** plan.

Technical documentation for developers — every endpoint, request and response examples, errors — is on the portal [jecheck.io/developers](https://jecheck.io/developers).

## What you can connect

- **Accounting and HR systems** — export audits, timesheets and payroll, sync employees and locations, create tasks.
- **BI (Power BI, Looker, Metabase)** — pull audits, violations, routine completion and HACCP data into your reports.
- **Bots and portals** — show instructions, accept requests, remind about tasks.
- **AI assistants (Claude, ChatGPT, Cursor and others)** — over MCP the assistant finds the data itself and can create tasks on your behalf.

## Company keys

A company key is for integrations that run on their own, without a specific person. It is issued by an employee with the permission **Company API keys** (administrators have it).

1. Open **API & MCP → Company keys** and click **New key**.
2. Name the key after the system that will use it, e.g. "ERP" or "Power BI".
3. Choose **Access**: **Read only** or **Read & write**.
4. Tick the **Key roles** — the key gets exactly the permissions of these roles. You can grant only roles whose permissions you have yourself.
5. Choose **Locations** — the key sees data of these locations only (or all, including new ones).
6. Optionally set an expiry date and click **Create**.
7. Copy the token — it is shown **only once**. Pass it to the integration developer securely.

> The key acts as a service user "API: name". It cannot sign in to the web or mobile app, and everything the integration creates or changes appears in history under this name.

**Full access** (like an administrator) can be granted only by an administrator. Use it only if the integration really needs every section.

You can **Edit** a key — change its name, roles, locations and access without replacing the token — or **Revoke** it: the integration stops working immediately.

## Personal tokens

A personal token works with **your** permissions and suits scripts, API experiments and developer AI tools (Cursor, Claude Code, VS Code). Create one on the **My tokens** tab if you have the permission **Personal API tokens & AI apps**. Do not share a personal token with other people.

## Connecting an AI assistant (MCP)

MCP is an open protocol that AI assistants use to connect to services. The **AI apps (MCP)** tab shows the server URL and step-by-step instructions.

**Claude and ChatGPT** connect without a token:

1. Copy the **Server URL**.
2. In Claude: **Settings → Connectors → Add custom connector**. In ChatGPT: **Settings → Apps & Connectors → Create**.
3. Paste the URL, click **Connect**, sign in to jeCheck and allow access. Untick **Allow changes** to let the assistant only read.

**Cursor, VS Code, Claude Code** connect with a personal token — ready-to-copy settings are on the same tab.

Example questions for the assistant:

- "Which five locations did worst on the kitchen audit this month and which violations repeat?"
- "Which tasks are overdue at Dostyk? Group them by owner."
- "Are any HACCP temperature logs missing today?"
- "Who is on shift at the central kitchen right now?"

Connected apps are listed under **Connected apps**; **Disconnect** closes their access immediately.

## Call log

The **Call log** tab shows the last 100 API and MCP requests: time, key, operation, response code and IP. Administrators and holders of "Company API keys" see calls of company keys; every employee sees calls of their own tokens and apps. The log is kept for 30 days. Issuing and revoking keys is recorded in the access log of "Roles and permissions".

## Security

- Create a separate key for each system with the minimum roles and locations — it is easier to limit and revoke.
- If an integration only reads data, give it **Read only**.
- Set an expiry date for temporary connections.
- Revoke keys that are no longer used. If a token may have leaked, revoke it immediately and create a new one.

## Frequently asked questions

### Why do requests return plan_required?

API and MCP are part of the Enterprise plan. You can create keys in advance, but requests will be rejected until the company switches to Enterprise.

### The key does not see some data

A key sees only the data of its roles and locations — just like an employee with those permissions in the web app. Check the key's roles and locations or the role permissions in "Roles and permissions".

### Does the old instructions-bot key still work?

Yes. Keys issued earlier for the knowledge-base bot keep working with instructions. Create a new key for other sections.