API, MCP and webhooks

Use Rival Spy intelligence without copying it by hand.

Read approved intelligence from one or more workspaces, connect an AI client or receive a signed event when a verified change, recommendation or report is ready.

Open integrations Compare plan access

Read-only API

Request only what the workflow needs.

Create an API key in Integrations, select its workspaces and permissions, then pass the key as a bearer token. Every request requires an explicit workspace ID.

curl "https://rivalspy.ai/api/v1/events?workspace_id=WORKSPACE_UUID&limit=50" \
  -H "Authorization: Bearer $RIVAL_SPY_API_KEY"

Successful responses contain data and a nullable nextCursor. Pass that cursor on the next request. A page contains at most 100 records.

Available resources

GET /api/v1/competitorsGET /api/v1/eventsGET /api/v1/evidenceGET /api/v1/adviceGET /api/v1/actionsGET /api/v1/decisionsGET /api/v1/artifactsGET /api/v1/reportsGET /api/v1/research

MCP connection

Give an approved AI client current, source-linked context.

Connect to https://rivalspy.ai/mcp with a dedicated MCP credential. Each read tool accepts workspaceId, optional cursor and optional limit. MCP credentials cannot use API endpoints, and neither credential type can write customer data.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "read_advice",
    "arguments": { "workspaceId": "WORKSPACE_UUID", "limit": 25 }
  }
}

Signed webhooks

Get the update when it matters, signature included.

Webhook destinations must use public HTTPS. Rival Spy signs the exact request body and does not follow redirects. Preserve the raw body before parsing it.

timestamp = X-RivalSpy-Timestamp
event_id = X-RivalSpy-Id
expected = HMAC_SHA256(secret, timestamp + "." + event_id + "." + raw_body)
compare_constant_time("v1=" + expected, X-RivalSpy-Signature)

Reject stale timestamps according to your own replay window. Deduplicate with X-RivalSpy-Id. Return any 2xx status only after your system has safely accepted the event.

Event types

intelligence.event.createdadvice.publishedreport.generated

Access behavior

Know exactly what can fail, and what to do next.

Business keys allow 120 requests per minute. Scale keys allow 600 requests per minute.
A rotated or revoked key stops authorizing immediately.
401 means the bearer key is missing or unknown. 403 means scope or workspace access is denied.
429 includes a retry interval. 503 means the intelligence store is temporarily unavailable.
Webhook failures retry with bounded backoff and become visible in Integrations. Dead letters are never silently discarded.