Admin utilities

API keys, custom fields, activity logs, and navigation counters.

13 endpoints. Every request needs an Authorization: Bearer mtro_... header, and responses follow the envelope described in Errors and conventions.

POST `/api-keys/delete`

Delete an API key. This is destructive and should require owner confirmation when used by an agent.

Required scope: api_keys.manage
MCP tool: api_keys_delete

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required	Description
`apiKeyId`	`any`	no

Example

curl -X POST 'https://core.mtro.app/api-keys/delete' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

POST `/api-keys/generate`

Generate a new API key. This creates a secret and should require owner confirmation when used by an agent.

Required scope: api_keys.manage
MCP tool: api_keys_generate

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required
`description`	`any`	no
`expiresAt`	`any`	no
`name`	`any`	no
`scopes`	`any`	no

Example

curl -X POST 'https://core.mtro.app/api-keys/generate' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

GET `/api-keys/list`

List API keys for the authenticated owner/entity.

Required scope: api_keys.manage
MCP tool: api_keys_list

Example

curl -X GET 'https://core.mtro.app/api-keys/list' \
  -H 'Authorization: Bearer mtro_your_api_key'

Response

Field	Type
`message`	`string`
`error`	`boolean`
`apiKeys`	`any[]`

POST `/api-keys/revoke`

Revoke an API key. This is security-sensitive and should require owner confirmation when used by an agent.

Required scope: api_keys.manage
MCP tool: api_keys_revoke

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required	Description
`apiKeyId`	`any`	no

Example

curl -X POST 'https://core.mtro.app/api-keys/revoke' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

POST `/fields/create`

Create a custom field. This writes account data and should require owner confirmation when used by an agent.

Required scope: templates.write
MCP tool: fields_create

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required
`defaultToToday`	`any`	no
`entityId`	`any`	no
`fieldName`	`any`	no
`fieldType`	`any`	no
`options`	`any`	no

Example

curl -X POST 'https://core.mtro.app/fields/create' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

POST `/fields/delete`

Delete a custom field. This is destructive and should require owner confirmation when used by an agent.

Required scope: templates.write
MCP tool: fields_delete

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required	Description
`fieldId`	`any`	no

Example

curl -X POST 'https://core.mtro.app/fields/delete' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

GET `/fields/get/all`

List custom fields.

Required scope: any valid API key for the entity.
MCP tool: fields_list

Example

curl -X GET 'https://core.mtro.app/fields/get/all' \
  -H 'Authorization: Bearer mtro_your_api_key'

Response

Field	Type
`fields`	`any[]`
`error`	`boolean`

GET `/fields/get/entity/{entityId}`

List custom fields for an entity.

Required scope: any valid API key for the entity.
MCP tool: fields_get_by_entity

Path parameters

Name	Type	Required	Description
`entityId`	`string`	yes	Entity ID.

Example

curl -X GET 'https://core.mtro.app/fields/get/entity/<entityId>' \
  -H 'Authorization: Bearer mtro_your_api_key'

Response

Field	Type
`fields`	`any[]`
`error`	`boolean`

POST `/fields/update`

Update a custom field. This writes account data and should require owner confirmation when used by an agent.

Required scope: templates.write
MCP tool: fields_update

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required
`defaultToToday`	`any`	no
`fieldId`	`any`	no
`fieldName`	`any`	no
`fieldType`	`any`	no
`options`	`any`	no

Example

curl -X POST 'https://core.mtro.app/fields/update' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

POST `/logs/actions`

List audit log action types.

Required scope: any valid API key for the entity.
MCP tool: logs_actions

Request body

A JSON object. This endpoint's fields are not documented yet — send the same body the admin panel sends, or ask MTRO PRO for the field list.

Example

curl -X POST 'https://core.mtro.app/logs/actions' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

POST `/logs/get`

Search audit logs.

Required scope: any valid API key for the entity.
MCP tool: logs_get

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required
`action`	`any`	no
`endDate`	`any`	no
`ip`	`any`	no
`limit`	`any`	no
`page`	`any`	no
`startDate`	`any`	no
`userEmail`	`any`	no

Example

curl -X POST 'https://core.mtro.app/logs/get' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

POST `/logs/stats`

Get audit log stats.

Required scope: any valid API key for the entity.
MCP tool: logs_stats

Request body

note

Field names are taken from the Core handler, which reads exactly these. Types and which of them are required are not yet documented.

Field	Type	Required	Description
`endDate`	`any`	no
`startDate`	`any`	no

Example

curl -X POST 'https://core.mtro.app/logs/stats' \
  -H 'Authorization: Bearer mtro_your_api_key' \
  -H 'Content-Type: application/json' \
  -d '{}'

GET `/nav/counts`

Get sidebar/navigation badge counts for the authenticated owner.

Required scope: applications.read, bookings.read, conversations.read, guests.read, leads.read, payments.read, tasks.read
MCP tool: nav_counts

Example

curl -X GET 'https://core.mtro.app/nav/counts' \
  -H 'Authorization: Bearer mtro_your_api_key'

Response

Field	Type
`newLeads`	`integer`
`pendingBookings`	`integer`
`applicationActions`	`integer`
`currentGuests`	`integer`
`unreadMessages`	`integer`
`pendingPayments`	`integer`
`todoTasks`	`integer`
`error`	`boolean`

POST /api-keys/delete​

POST /api-keys/generate​

GET /api-keys/list​

POST /api-keys/revoke​

POST /fields/create​

POST /fields/delete​

GET /fields/get/all​

GET /fields/get/entity/{entityId}​

POST /fields/update​

POST /logs/actions​

POST /logs/get​

POST /logs/stats​

GET /nav/counts​

POST `/api-keys/delete`

POST `/api-keys/generate`

GET `/api-keys/list`

POST `/api-keys/revoke`

POST `/fields/create`

POST `/fields/delete`

GET `/fields/get/all`

GET `/fields/get/entity/{entityId}`

POST `/fields/update`

POST `/logs/actions`

POST `/logs/get`

POST `/logs/stats`

GET `/nav/counts`