API

Constructable API

GraphQL for project data, plus MCP for assistants.

1,689 GraphQL types · 538 mutations

Search API documentation

Search

Constructable exposes a GraphQL API at https://api.constructable.ai/graphql. The same schema powers the Constructable web and native apps, the in-product Agent, and the Model Context Protocol (MCP) server.

There is no separate REST resource API for project records. Reads and writes go through GraphQL. File bytes are uploaded directly to object storage with a GraphQL-issued signed URL.

Base URLs

Sign-in and a few account routes live under /api on that origin, for example POST https://api.constructable.ai/api/users/sign_in. GraphQL is not under /api; it is POST https://api.constructable.ai/graphql. OAuth lives on the API origin as well: /oauth/authorize, /oauth/token, /oauth/revoke.

What you can do

• Query organization and project records: RFIs, submittals, drawings, commitments, invoices, daily logs, and the rest of the product model. Start from organization(id:) and nest into project(id:).
• Mutate those records through nested mutation fields: organization(id:) { project(id:) { createDraftRfi(input: ...) } }.
• Search project content with organization.project.search.
• Upload files with createFileUpload, then attach the returned signedId on a later mutation.
• Connect an integration with an organization API OAuth client and call GraphQL directly. See Authentication.
• Connect an assistant through MCP without embedding a session token in the client.

The generated GraphQL reference lists every type, field, and mutation in the schema.

Choose an access path

Use organization API OAuth when another system should call GraphQL without collecting Constructable passwords. An organization admin creates a confidential client in Organization Settings. The user signs in on Constructable, consents, and your integration receives an api-scoped access token. See Authentication.

Use GraphQL with a session token when you are calling the API as a specific Constructable user from a backend you control. Create the token with email and password (and OTP when enabled), then send it as Authorization: Bearer.

Use MCP when an assistant should act as a user. MCP discovers the authorization server, completes OAuth with the mcp scope, and then runs GraphQL through tools. See MCP.

api and mcp tokens are not interchangeable. An API access token calls /graphql. An MCP access token calls /mcp. All three paths enforce the same product permissions. A token cannot see or change more than the authorizing user's role allows.

Identifiers

Record ids are UUID values, typically UUID version 7. Create mutations often accept a client-generated id so you can choose the id before the request. If you omit it, the server generates one.

Organization and project ids are required on almost every operation. Do not substitute a project number, slug, or name. Load ids from viewer, organization, or organization.projects.

Stability

This API is the same schema the product uses. Fields and mutations can be added as Constructable ships features. Treat undocumented internal fields as unavailable, and prefer the types and operations in this reference. When a mutation is omitted from the public schema, it is not part of the API.

Next steps

1. Authenticate with organization API OAuth, or obtain an organization-scoped session token.
2. Run the GraphQL getting-started query against viewer and organization.
3. Page through lists with Relay connections.
4. Work a full example in Examples.
5. Look up types in the reference.