Organisation API & MCP

Create tokens in Settings & More → MCP / API. Send Authorization: Bearer 1ngo_… to the Railway org-api origin shown on that page. WordPress plugin tokens are read-only and must also send X-1NGO-Organization-Id.

Scopes

• brand:read / brand:write — colours, logos, public chrome
• content:read / content:write — campaigns, events, stories
• embeds:read — iframe embed catalogue (external sites only)
• media:read / media:write — organisation files
• site:read / site:write — main-website pages
• webhooks:read / webhooks:write — donation.received endpoints

HTTP

GET  /org-api/v1/me
GET  /org-api/v1/brand
GET  /org-api/v1/campaigns
GET  /org-api/v1/campaigns/{id}
GET  /org-api/v1/events
GET  /org-api/v1/events/{id}
GET  /org-api/v1/stories
GET  /org-api/v1/site/pages
POST /org-api/v1/site/pages
GET  /org-api/v1/embeds/catalog
GET  /org-api/v1/update-webhooks
POST /org-api/v1/update-webhooks
POST /org-api/v1/update-webhooks/{id}   (disable)

Update webhooks

POST JSON { event: "donation.received", organization_id, data: { source, campaign_id, slug, title, amount, currency, donor_name } }. Headers: X-1NGO-Event, X-1NGO-Timestamp (unix seconds), X-1NGO-Signature: sha256=HMAC_SHA256(secret, timestamp + "." + rawBody).

Internal Website Builder AI uses the same handlers with a signed-in session. External automations must use a Bearer token. Rate limit: 60 requests / minute / IP.