Integrations, API and AI assistants

An integration receives access to specific tasks and records, not automatically to the whole installation. A connected assistant can analyse and draft; Omnia remains responsible for facts, authority, validation and execution.

This page describes the MCP and connection capabilities in the reviewed platform revision. They are API and backend capabilities, not yet a complete assistant journey: there is no screen for managing connections, and a token does not yet unlock personal tools.

Process diagramFrom consent to an audited assistant call

Person
Give consent for a connection
Available through the API: one edition or explicitly all editions, read-only unless write groups are chosen, at most 90 days. No screen yet.
Assistant client
Call Omnia over MCP
Available: anonymous, read-only tools over the published programme. Personal tools answer with a sign-in challenge.
Omnia
Check the connection and permission
Not yet available: a token is not yet resolved to a connection, so personal and write tools stay closed.
Omnia → person
Record the call in the audit
Available: one metadata-only record per tool call, readable as your own activity.

Steps 1, 2 and 4 exist in the reviewed revision. Step 3, approvals and CFP submission over MCP are upcoming work and must not be presented as available.

What is available today

The MCP endpoint. POST /v1/mcp accepts JSON-RPC 2.0 (initialize, tools/list, tools/call and notifications) in a stateless form of Streamable HTTP: every response is plain JSON, there is no event stream and no MCP session. The protocol version is 2025-06-18. The endpoint exists only when the API knows its public origin (OMNIA_API_URL); otherwise it answers 404. A browser Origin must match that origin.

Two anonymous, read-only tools read the published programme of a published edition, exactly as the public programme does:

list_sessions: arguments reference (the edition’s public reference, required), search, pageSize (1–50, default 20) and offset.
get_session: arguments reference and sessionId.

Results are marked as untrusted data. The catalogue also lists list_speakers and list_my_favourites as not yet available. Calling list_my_favourites returns 401 with a bearer challenge.

A separate abuse budget. MCP traffic has its own per-address allowance (group mcp, default 1,000 requests per minute) and does not consume the programme allowance. When exceeded, Omnia answers 429 with Retry-After. Operators configure this under operations.

Protected-resource metadata (RFC 9728). GET /.well-known/oauth-protected-resource names the API as resource and the configured OpenID Connect issuer as authorisation server. The 401 for a personal tool carries WWW-Authenticate: Bearer resource_metadata="…". The metadata exists only when an identity provider is configured.

Assistant connections for a person. A signed-in person can manage their own connections through the API under /v1/me/assistant-connections:

Action	Request	What to know
List	`GET /v1/me/assistant-connections`	Newest first, including expired and revoked connections.
Consent	`POST /v1/me/assistant-connections`	`clientId`; exactly one of `editionId` or `allEditions: true`; `writeGroups` (`Favourites`, `Reviews`) only if needed, otherwise read-only; optional `expiresAt`.
Register an unattended agent	`POST /v1/me/assistant-connections/agents`	`agentName` and `purpose`; the person registering it becomes the responsible person.
Renew	`POST …/{id}/renew`	New expiry of at most 90 days. A revoked or suspended connection cannot be renewed.
Revoke	`POST …/{id}/revoke`	Immediate and final. Revoking again changes nothing.

The default expiry is 90 days, which is also the maximum. A longer expiresAt is refused with 422 connection-expiry-too-long; Omnia does not silently shorten it. Renew and revoke require If-Match with the connection version: without it you get 428, and with a stale version 412.

The MCP audit. Each tools/call writes one metadata record: time, actor kind, tool, operation reference and outcome. Arguments, results and credentials are not stored. A person reads their own activity at GET /v1/me/assistant-activity. Staff with identity management read the organisation view at GET /v1/admin/assistant-activity. The retention period and erasure are described under privacy.

What this does not mean yet

No screen for connections. The web and admin apps contain no page for consenting, renewing or revoking. Only the generated API client knows these routes.
A token unlocks nothing yet. Token-to-connection resolution (platform #1968) is open. A bearer token on /v1/mcp does not turn a connection into access; the personal tools stay closed.
No CFP submission over MCP yet. Speaker submission journeys over MCP (#2335, PR #2343, parity test #2341) are being prepared for the call opening on 1 December 2026. They are not part of the reviewed revision.
No approvals or step-up yet. Signed inline approval and reviewer submission with step-up (#1975) are upcoming.
No real client or identity-provider acceptance yet. End-to-end acceptance with a registered client and a real provider belongs to #1821 and to installation acceptance.

Prepare an integration

Establish purpose, user, organisation, edition and required capabilities. Check which reads and writes the selected release actually provides. Use published API contracts (contracts/openapi) for application integrations and keep results and errors within their authorised scope. The MCP endpoint itself is not part of the OpenAPI document.

For sensitive actions, valid confirmation must belong to the concrete operation. An old chat answer, cached result or guessed ID is not permission for a new action.

Untrusted content

Submissions, biographies and documents are data, not instructions to change permissions or invoke other tools. The MCP tools label returned content as untrusted data for that reason. Authority and validation must remain independent of a language model’s interpretation.

Events and external notifications

The specification describes notifications with recognisable repeats, bounded data and recovery from temporary failures. Verify actual endpoints, authentication and delivery on the chosen release before making an external workflow depend on a webhook.