Build with Tagura
Every business on Tagura can connect its orders, bookings, catalog and customers to AI assistants, Zapier and its own systems. Available on the Pro and Premier plans.
AI assistants (MCP)
Tagura is a remote MCP server. Add it as a custom connector in Claude, ChatGPT or any assistant that supports MCP, sign in, choose the business and approve what it may do. The assistant can then answer “what's due today?”, confirm or complete orders, message customers, take phone orders, and update prices and stock.
https://tagura.vercel.app/api/mcp
Streamable HTTP, stateless. Protocol versions 2026-07-28 (per-request metadata, server/discover) and 2025-03-26 through 2025-11-25 (initialize). Authorization is OAuth 2.1 with PKCE; discovery starts from the 401 challenge or /.well-known/oauth-protected-resource/api/mcp. Clients may register dynamically (RFC 7591) or use a Client ID Metadata Document URL as their client_id.
Tools: get_business, list_orders, get_order, get_schedule, update_order_status, send_order_message, create_order, list_products, update_product, list_customers, create_customer, get_sales_report.
Authentication
Send Authorization: Bearer <token> on every request. The token is either an API key (emp_…) created in Settings > Connections, or an OAuth access token (emp_at_…) your app gets when an owner approves it.
OAuth: authorization endpoint https://tagura.vercel.app/oauth/authorize, token endpoint https://tagura.vercel.app/api/oauth/token, registration https://tagura.vercel.app/api/oauth/register, metadata https://tagura.vercel.app/.well-known/oauth-authorization-server. Authorization code with PKCE (S256) only. Access tokens last one hour; refresh tokens rotate on every use. Pass resource=https://tagura.vercel.app/api/v1 (REST) or https://tagura.vercel.app/api/mcp (MCP); a token only works where it was issued for.
Scopes: business:readorders:readorders:writecatalog:readcatalog:writecustomers:readcustomers:writeinsights:read. A write scope includes reading. Calls also run with the role of the person who made the key or approved the app, so staff accounts cannot do more through the API than in the app. Nothing in the API moves money: refunds and payouts stay in Tagura.
Endpoints
Base URL https://tagura.vercel.app/api/v1. JSON in and out; amounts are integer cents in the business's currency. The full schema is in openapi.json. Send an Idempotency-Key header when creating orders.
| Endpoint | Scope | What it does |
|---|---|---|
| GET /business | business:read | The business this connection works for, with today at a glance: orders due today, orders waiting for the owner, sales today, unread customer messages and items running low. |
| GET /orders | orders:read | Orders, quotes and bookings, newest first (or soonest first for active and upcoming). "action" = waiting for the owner (to review, quote or collect payment); "active" = confirmed, in progress or ready; "upcoming" = scheduled from now on. |
| GET /orders/{id} | orders:read | One order, quote or booking in full: items and choices, prices, payments, customer, schedule, recent messages, and which statuses it can move to next. |
| GET /schedule | orders:read | Bookings and scheduled pickups or deliveries between two days (default: today and the next 6 days), in time order, with who they are with. |
| POST /orders/{id}/status | orders:write | Moves an order along: confirm it, start it, mark it ready for pickup, complete it, or cancel it. The customer is told by email or text unless notify is false. Check nextStatuses from get_order first. Cancelling a paid order does not refund it; refunds are done by the owner in Tagura. |
| POST /orders/{id}/messages | orders:write | Sends a message on the order's conversation. The customer sees it on their order page and gets an email or text. Use internal=true for a note only the team sees. |
| POST /orders | orders:write | Records an order taken by phone, in person, by email or social media, with the same pricing, numbering and notifications as online orders. Lines with a productId take the name and price from the catalog unless given. Use kind "quote" with status "quote_sent" to send a price for the customer to approve. |
| GET /products | catalog:read | The catalog: products and services with price, how they are ordered (buy, quote or book), stock and whether customers can see them. |
| PATCH /products/{id} | catalog:write | Changes an item's price, stock count, or whether customers can see it (visible) or it is archived. Only the fields you send change. |
| GET /customers | customers:read | Customers, newest first, optionally matching a name, email or phone. |
| POST /customers | customers:write | Adds a customer. Set marketingOptIn only when the customer has agreed to receive marketing from the business. |
| GET /reports/sales | insights:read | Sales between two days (default: the last 7 days including today): orders, sales after refunds, money received, average order, customers, sales by day and by channel, and top items. On Pro and Premier also repeat customers, estimated margin, quote win rate, storefront conversion and busiest hours. To compare periods, call it once per period. |
| GET /me | The business, credential, role and scopes behind the token. |
curl https://tagura.vercel.app/api/v1/orders?status=active \ -H "Authorization: Bearer emp_..."
Webhooks and REST hooks
Subscribe a URL to an event with POST /hooks { "target_url": "https://…", "event": "order.placed" }; remove it with DELETE /hooks/{id} or by answering 410 Gone. Owners on Pro and Premier can also add webhooks in Settings.
Events: order.placedorder.status_changedorder.updatedorder.rescheduledorder.paidorder.refundedquote.approvedquote.declinedcustomer.created.
Each delivery is a POST of { id, type, created, businessId, data } with the header Emporion-Signature: t=<unix>,v1=<hex>, where v1 is HMAC-SHA256 of "<t>.<raw body>" with the subscription secret. Failed deliveries are retried with backoff for about a day. Event data carries ids; fetch the full record with the API.
Zapier
The Tagura Zapier app connects with an API key and offers triggers (new order, order status changed, order paid, booking rescheduled, new customer), actions (create order, update order status, message a customer, update stock or price, add customer) and searches (find order, find customer). Until it is listed, use Zapier's Webhooks by Zapier with the REST hooks above.
Limits and errors
600 requests per minute per key or app. Errors return { "error": { "code", "message" } } with the HTTP status: 401 (missing or invalid token, with a WWW-Authenticate challenge), 402/403 (plan or permission), 404, 409 (state conflict, such as a status change that is not allowed), 422 (invalid input), 429 (slow down).
Questions? Contact us.