docs: document API key access and API-trigger automations

[charlesrhoward]

Documents the key access levels and API triggers from Mogplex/mogplex#614. Merge after that PR is deployed, so the docs don't describe settings the app doesn't have yet.

• New page, Integrations → API Triggers: setting up an automation with the API (integrations) start event, declaring inputs, the trigger request and response, refusals, idempotent retries, following a run, and limiting the calling key to automations.
• Settings: Mogplex Keys now describes the per-key access level (Full access or Automations only) and what an automations-only key is refused. Provider Keys gains the team owner's Mogplex API keys setting.
• API reference: a key access section under Authentication, the trigger response's new fields (versionId, versionNumber, workingBranch, replayed), and AUTOMATION_REQUIRED in the error table.
• MCP security and CI integration: what an automations-only PAT can still do through MCP, and that CI keys need Full access to start runs.

Every claim was checked against the code in #614: the refusal codes, the input field rules and limits (32 fields, 512 KB total, 64-character keys), and which endpoints refuse a restricted key. pnpm lint, pnpm types:check, pnpm test, and pnpm build pass, and the new #key-access and #team-key-access anchors render.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mogplex-docs	Ready	Preview	Oct 10, 2026 6:25pm UTC

[mogplex]

Mogplex PR Review

Status: No material issues found

Docs PR adds clear, consistent documentation for API-trigger automations and key access levels. All references align across content/docs/reference/api.mdx, content/docs/web/settings.mdx, MCP security, CI integration, and the new API triggers page. No content issues found.

• New API triggers page (content/docs/integrations/api-triggers.mdx): Comprehensive guide covering setup, inputs schema, limits (32 fields, 512 KB total), trigger endpoint usage, response fields (versionId, versionNumber, workingBranch, replayed), refusals, retries with idempotency, and following runs. Content is clear and well-structured.
• Settings updates (content/docs/web/settings.mdx): Added Team key access (Provider Keys section) and Key access (Mogplex Keys section). Clearly documents Full access vs Automations only, what is refused, and team-level enforcement. Anchors #team-key-access and #key-access are defined.
• API reference updates (content/docs/reference/api.mdx): Added Key access section explaining access levels, added trigger response fields, updated error table with AUTOMATION_REQUIRED and clarified FORBIDDEN cases, added detailed validation notes for API triggers.
• Security/MCP and CI: MCP security explains automations-only PAT behavior; CI integration clarifies keys need Full access to start runs.
• Navigation: meta.json updated to include api-triggers. All cross-references between pages are consistent.

View check run