API Testing Guide

This guide is designed for pre-launch integration tests against the current production contract.

If an AI assistant is running the test, it must first read the AI Agent Integration Guide and must not ask for the key in chat.

Set test variables

export LEENOPS_API_URL="https://workspace.leenops.com"
export LEENOPS_API_KEY="wks_your_api_key"

PowerShell:

$env:LEENOPS_API_URL = "https://workspace.leenops.com"
$env:LEENOPS_API_KEY = "wks_your_api_key"

Use a temporary key with the smallest required scopes. Never paste a real key into screenshots, tickets, chat logs, or committed shell scripts.

1. Confirm authentication behavior

Without a key:

curl -i "$LEENOPS_API_URL/api/v1/crm/contacts?limit=1"

Expected: HTTP 401.

With a key:

curl -i "$LEENOPS_API_URL/api/v1/crm/contacts?limit=1" \
  -H "Authorization: Bearer $LEENOPS_API_KEY"

Expected: HTTP 200, JSON, and X-API-Version: v1.

2. Verify the key's MCP capability set

curl "$LEENOPS_API_URL/api/mcp/session" \
  -H "Authorization: Bearer $LEENOPS_API_KEY"

Check allowedToolCount, deniedToolCount, allowedToolNames, and permissions.granted.

3. Retrieve live tool schemas

curl "$LEENOPS_API_URL/api/mcp/tools/list?includeDenied=true&includeSchemas=true" \
  -H "Authorization: Bearer $LEENOPS_API_KEY"

This is the authoritative catalog for the tested key and deployed version.

4. Call a read-only MCP tool directly

First choose a name from allowedToolNames. Example:

curl -X POST "$LEENOPS_API_URL/api/mcp/tools/call" \
  -H "Authorization: Bearer $LEENOPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"search_contacts","arguments":{"query":"Acme"}}'

Expected success shape:

{
  "data": {},
  "entities": []
}

5. Test a REST mutation

Use a disposable record:

curl -X POST "$LEENOPS_API_URL/api/v1/crm/contacts" \
  -H "Authorization: Bearer $LEENOPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email":"api-test@example.invalid",
    "first_name":"API",
    "last_name":"Test",
    "tags":["temporary-test"]
  }'

The contacts create endpoint currently returns the created object directly.

6. Negative tests

Run at least:

• Missing bearer header → 401
• Invalid key → 401
• Valid key without required read permission → 403
• Valid key without required write permission → 403
• Unknown JSON field on a strict mutation → 400 or 422
• Unknown MCP tool → 404
• MCP tool denied by key → omitted from the default tool list or rejected by the call endpoint
• Excess traffic → 429 with Retry-After

Known test caveats

• Use the workspace.leenops.com origin directly to avoid bearer-header loss during redirects.
• OpenAPI publication is temporarily paused. Use the dedicated endpoint guides and runtime validation.
• GET /api/v1/issues defaults to project tasks unless kind=ticket is set.
• Do not use DELETE /api/v1/issues/{id} for support tickets.
• Webhook delivery is asynchronous and can take up to 24 hours on the current service tier.

Cleanup

Delete disposable data through a supported route or the UI, then revoke the temporary API key after the test session.

In PowerShell, remove the temporary process variables when finished:

Remove-Item Env:LEENOPS_API_URL
Remove-Item Env:LEENOPS_API_KEY

If a test still fails after following Troubleshooting, email support@leenops.com with the workspace ID, UTC timestamp, operation, client version, status, and sanitized response.