Sign in

ProductConnect

API and SDKslive

REST, webhooks, MCP, a command line and SDKs in six languages

One API, every transport on the same routes.

Everything the console does is a route of one public API: REST, server-sent events, WebSocket, MQTT and signed webhooks carry the same calls with the same JSON. SDKs in six languages and the iohr command line sit on top of it, and MCP gives an assistant the parts that are allowed.

Read the docs

Live today. Accounts open after a 30-minute call.

0%
01The problem

Connecting to a product usually means an API that lags behind its screens, a separate system for events and libraries that drift. Letting an AI assistant in often means letting it do everything.

02How it works

One gateway checks who is calling; every way in uses the same list of calls, so they cannot drift apart.

How it works

01

Where it runs

On the platform, behind one gateway that verifies every caller and its scopes.
02

What it reads

Your calls, counted by when, which key and how they ended. Never what was sent.
03

What you approve

Keys and what each may do. For an AI assistant, only approved operations are tools; everything else is refused.
01SDKs and iohrSix languages and the command line.live
02MCPAllowlisted tools for assistants.preview
03The gatewayVerifies the caller and the scopes.live
04One registry of routesREST, SSE, WebSocket, MQTT.live
05Events and webhooksSigned, retried, recoverable.live
Many ways in, one set of routes
03What you getlive

Each line says how far it is built today. Live means anyone with an account uses it; preview means it runs in early access or as a pre-release; coming means it is written down and not built yet.

What you get

  • Five transports, one contract

    REST, a live event stream, one WebSocket that carries any call by name, MQTT, and signed webhooks; you can change the signing secret without missing a delivery.

    live

  • SDKs in six languages

    Rust, TypeScript, Python and Go on their registries; C# and Java from source. iohr sdk add picks your project's own package manager.

    live

  • The iohr command line

    Sign in, call any route with iohr api, install extensions and the agent. A pre-release until 1.0, signed with provenance.

    preview

  • MCP for your assistant

    Assistants sign in and get only the permissions each tool needs. Nothing is allowed unless listed, so only approved operations are tools (Decisions and the AI models). Monitors, incidents and the agent are not tools yet.

    preview

  • Keys, scopes and usage

    Keys with limited permissions, a safe way to repeat a write without doing it twice, and every call counted: when, by which key, how it ended. Never what was sent.

    live
04In your terminalExample data

One route called over REST and through the iohr command line, the one command that adds an SDK to your project, and the usage lines those calls leave behind.

In your terminal

One route from curl or iohr, and an SDK for your code

REST

curl -H "Authorization: Bearer $IOHR_TOKEN" \
  https://api.inorbit.hr/v1/accounts/orgs/org_example/monitors

iohr

iohr api GET /v1/accounts/orgs/org_example/monitors

SDK

iohr sdk add typescript
# adds @inorbithr/sdk with your package manager

Usage: every answered call counted, never its content

KeyOperationOutcome
ci-deploy16:42:07connectionsListMonitorsok
jane-laptop16:41:55incidentsGetIncidentok
ci-deploy16:41:30connectionsDeleteMonitornot_found

A call the gateway refuses, such as one outside a key's scopes, is never counted.

Example data

The commands and the route are real. The organisation, key names, times and outcomes are made up.

05Proof and links

Every claim on this page has its evidence: the documents that define it, the docs that say how to use it, and the API it runs on.

Proof and links

Documents

Docs

API

  • RESTliveJSON both ways, every route.
  • SSE · WebSocket · MQTTliveStreams and the multiplexed socket.
  • WebhooksliveSigned, with retries and recovery.
  • MCPpreviewAllowlisted operations as tools, under OAuth.

The evidence rule: a model saying it succeeded is never evidence. What counts is what was measured, by what, and when.

Your data, your call

The gateway is the only place a token is verified. Every call is one audit line (who, which operation, the outcome), never its content.

Logs record who did what and the outcome, never content. The platform's own models are self-hosted; a third-party model provider is one you connect with your own key, and it bills you directly, with no line or markup from InOrbit. Separately, our own DPAs with model providers are in progress, none signed yet. InOrbit is not certified: no auditor has attested its controls yet, and the known gaps are listed.

The company's facts, controls and gaps →

06Questions

Questions, answered plainly

Is everything in the console on the API?

That is the rule. Where a route is not public yet (the incidents API, for one), the product's page says so.

Which assistants work over MCP?

Any that speaks MCP with OAuth. The live tests with each assistant are not all done yet.

Are there limits?

Yes, per plan, and the docs list them with the error you get when one is reached.

Next step

See it on your own system

Book 30 minutes with an engineer. We look at your system together and, where it fits, open early access for your team.

Read the docs Every product, by category →