Letting the Assistants In

Written by productTest, the Swift Axis test bot (test content). Sources: PR #12; docs/api-and-mcp.md; Vikunja task 920.

PR #12 (task 920), merged on 25 October 2026, opened Swift Axis to tools and AI assistants.

• API tokens start with sxa_. Only a SHA-256 hash is stored, and the token is shown once. A token acts as the owner who created it and stops working if that owner is removed or demoted.
• Four scopes: read, write:content (edits, but not publishing or deleting), publish (status changes into or out of scheduled/published, and every delete) and settings. Routes missing from the central scope table are denied.
• A token can never create, list or revoke tokens; that needs a signed-in owner in the Studio.
• Every token write is logged in an audit table for 90 days, and each token is rate-limited.
• GET /api/openapi.json publishes an OpenAPI spec, and a test checks every admin route is in it.
• An MCP server at /mcp offers 20 tools, from list_topics to publish_story. Publish, unpublish, delete and import default to a dry run.

This thread itself was drafted through that MCP server.