# Superdocu — quickstart for AI agents > Superdocu is a document collection and compliance platform. Companies request documents and information from their contacts (clients, suppliers, employees), validate them and track expiry dates. Agents can read and act on a Superdocu account through MCP, the REST API v2 or the CLI. Same permissions and business rules everywhere. ## 1. MCP server (AI assistants) - URL: https://app.superdocu.com/mcp - Transport: Streamable HTTP, JSON-RPC - Auth: OAuth 2.1 + PKCE (S256), dynamic client registration (RFC 7591). No API key, no config file. - Claude: Settings > Connectors > Add custom connector > paste the URL > sign in > approve scopes - ChatGPT: Settings > Connectors > add an MCP connector with the same URL - Scopes: mcp (always), see_all_contacts, manage_contacts, validate_documents, manage_workflows, manage_portals. The user can untick any of them. - Tokens: JWT, 1 h, refreshed automatically. A tool also needs the matching role permission (else: permission_denied). - Resource: superdocu://resources/workflow-blueprint (field grammar for workflow_create and step_input_add) - Setup guide: https://developers.superdocu.com/mcp ## 2. MCP tools (75) - identity: me_show - contacts: contact_list, contact_show, contact_create, contact_update, contact_delete, contact_invite, contact_enable, contact_disable, contact_remind, contact_download, contact_timeline_global, contact_timeline_contact - contact workflows: contact_workflow_list, contact_workflow_show, contact_workflow_create, contact_workflow_update, contact_workflow_archive, contact_workflow_unarchive, contact_workflow_delete, contact_workflow_download - validation: dashboard_show, documents_group_show, documents_group_approve, documents_group_request, documents_group_mark_not_applicable, documents_group_approve_not_applicable, documents_group_refuse_not_applicable, documents_group_update_expiration, documents_group_delete, custom_documents_group_create, document_approve, document_reject, document_url, document_delete, step_request_show, step_request_approve, step_request_reject, step_request_update - workflow templates: workflow_list, workflow_show, workflow_create, workflow_update, workflow_enable, workflow_disable, workflow_duplicate, workflow_update_reminders, workflow_state_create, workflow_state_update, workflow_state_reposition, step_input_add, step_input_attach, step_input_update, step_input_reposition, step_input_set_conditions, company_document_type_list, company_document_type_show - portals: portal_list, portal_show, portal_create, portal_update, portal_delete, portal_publish, portal_unpublish - other: reminder_options, reminder_list, contact_tag_list, contact_tag_create, contact_tag_delete, shared_document_list, shared_document_url, shared_document_update, shared_document_update_position, shared_document_delete, download_show ## 3. REST API v2 (your code) - Base URL: https://api.superdocu.com/api/v2 - Headers: Authorization: Bearer <JWT> ; Accept: application/vnd.api+json (JSON:API) - Tokens: created in the Superdocu admin (Developers). Requires the Pro plan or above. - Loop: GET /me (check permissions) > GET /dashboard (typed pending actions: validate_document, validate_form_answer, review_not_applicable) > read available_actions / unavailable_actions on the resource > act > repeat - Never hardcode state machines: read available_actions first. If the reason is permission_denied, escalate to a human. - Idempotency: Idempotency-Key (UUID v4) on POST/PATCH/DELETE, kept 48 h. Replays return Idempotent-Replay: true. - Pagination: per_page 1-100, after / before cursors, has_more, next_cursor - Rate limits per token: reads 600/min, writes 200/min, emailing writes 30/min, downloads and imports 10/min. 429 + Retry-After. - Errors: JSON:API with a stable code (permission_denied, not_found, validation_failed, rate_limited, invalid_cursor, build_mode_active...) - Docs for LLMs (raw Markdown): https://developers.superdocu.com/api-v2/tutorial.md - OpenAPI reference: https://developers.superdocu.com/api ## 4. CLI (coding agents, scripts) - Install: brew install Superdocu/tap/superdocu (or: curl -fsSL https://raw.githubusercontent.com/Superdocu/cli/main/install.sh | sh) - Auth: superdocu login --token <jwt> ; check: superdocu whoami - Examples: superdocu dashboard get ; superdocu contacts list --filter-status active ; superdocu documents-groups request <id> --requested-message "..." - Output: pretty JSON, --raw for compact, -o <file> for exports. --idempotency-key <uuid> on mutations. - Repo: https://github.com/Superdocu/cli (macOS, Linux) ## 5. Webhooks - Events (11): documents_group_to_review, documents_group_will_expire, documents_group_expired, documents_group_rejected, contact_complete, contact_invited_to_workflow, contact_workflow_started, contact_workflow_complete, step_request_submitted, step_request_approved, step_request_rejected - Signature: X-Hub-Signature = base64(SHA256(verify_token + X-Hub-Timestamp)) - Retries over 2 days on 4xx/5xx. Handle duplicates. - Docs: https://developers.superdocu.com/webhooks ## 6. Limits - No file uploads over MCP (documents, CSV imports): use the API or the CLI. - Steps, modules and workflows can't be deleted over MCP: disable the workflow instead. - Editing a workflow only affects future assignments. - Emailing tools: 30 calls/min per token. ZIP exports: 10/min. ## 7. Plans - MCP: every plan, including the 7-day free trial. - API v2 tokens, webhooks, Zapier: Pro plan and above. - CLI: free and open source. - Pricing: https://www.superdocu.com/en/pricing/ - Sign up: https://app.superdocu.com/c/sign_up ## 8. Vocabulary - contact: the external person or company sending documents - workflow: a sequence of steps (forms, document requests, checklists, e-signature) assigned to a contact - documents group: one requested document type for one contact, with its files, status and expiry date - portal: a public sign-up page that creates contacts automatically
Agentic ready: MCP, API v2 & CLI
Document collection for AI agents.
MCP, API & CLI.
Connect Claude, ChatGPT or your own code. Your agents chase files and review uploads, with only the permissions you grant.
Why Superdocu
Your agent can write the reminder. It can’t tell which certificate is missing.
Document collection still lives in inboxes, shared drives and spreadsheets. An AI agent can’t do much with that: no status, no rules, no way to know what’s already approved. Superdocu turns that mess into data and actions an agent can use safely.
Structured, not scattered
Next steps, not guesses
Guardrails included
Three ways in
Pick the door your agent speaks.
The MCP server, the API v2 and the CLI share the same permissions and business rules. Start with a chat, end up with an automation.
MCP
For AI assistants. Paste one URL in Claude, ChatGPT or any MCP client, sign in, tick the permissions you grant. No API key, no config file.
# Settings → Connectors → Add custom connector
https://app.superdocu.com/mcpOAuth 2.1 with PKCE, tokens refresh on their own
75 tools, filtered by the scopes you approve
API v2
For your code and automations. A REST API covering almost everything your team does in the app, built so agents can use it without guesswork.
curl -H "Authorization: Bearer $TOKEN" \
-H "Accept: application/vnd.api+json" \
https://api.superdocu.com/api/v2/dashboardJSON:API, cursor pagination, stable error codes
Idempotent writes and 11 signed webhook events
CLI
For coding agents and scripts. An open-source command line for macOS and Linux: Claude Code, Codex or Cursor drive Superdocu straight from the terminal.
brew install Superdocu/tap/superdocu
superdocu login
superdocu dashboard getPretty JSON by default, --raw for pipes
--idempotency-key on mutations
Prompt to portal
From one message to a live portal.
Describe the process. Your agent sets it up.
Explain your onboarding the way you’d explain it to a new hire. The assistant creates the workflow, adds the steps, forms and document requests, sets the reminders, then publishes a public portal so new contacts sign up on their own.
You review it in the workflow builder, change what you want, and go live. Setting up Superdocu used to be the boring part. Now it’s one message.
Steps, forms, document requests and conditions
Reminder schedule and expiry dates
Public intake portal, published or kept as draft
In real life
What teams give their agent.
Jobs that used to eat a morning. Same Superdocu, someone else doing the clicking.
Supplier compliance
“List the subcontractors whose insurance certificate expires this month and remind them.” Expiry dates are tracked, reminders go out, you get a summary instead of a spreadsheet.
Transport
“Create the carrier, assign our onboarding, tell me when the transport licence is verified.” The licence is checked against the official registry. Your agent reports back.
Immigration
“What’s still missing from the Martin family’s file? Reject the blurry passport scan and ask again.” The client gets a clear reason and a fresh request in their portal.
Back office
Webhook contact_complete → your agent updates the CRM and posts in Slack. It only wakes up when something actually happened.
For builders
Built for agent loops, not just demos.
Triage with GET /dashboard, decide with available_actions, act safely, and let webhooks wake your agent up only when there’s work.
// GET /api/v2/dashboard → included[0]
{ "type": "pending_action",
"attributes": { "action_type": "validate_document",
"resource_type": "documents_group", "resource_id": "4821",
"label": "Insurance certificate" } }
// GET /api/v2/documents_groups/4821
"available_actions": [ { "name": "request", "method": "POST",
"required_attributes": ["requested_message"] } ],
"unavailable_actions": [ { "name": "approve",
"reason": "expiration_date_required" } ]Simplified payloads. Full schema in the OpenAPI reference.
Docs your agent can read too
Guardrails
Let it work. Keep the keys.
Handing your client files to an AI is a fair thing to be careful about. So the agent gets exactly the access you choose, and nothing that bypasses your rules.
You pick the permissions
Same rules as your team
Safe retries
Good to know
Checked documents, honest limits.
Verified, not just collected
For French companies, Superdocu checks official documents against public sources. Your agent works with verification results, not with a PDF and hope.
URSSAF certificate, checked with URSSAF’s verification service
Kbis extract, checked against official company registries
Transport licence, checked against government registries
Expiry dates tracked, so renewals don’t slip
What’s included, and what isn’t (yet)
MCP works on every plan, including the 7-day free trial. API v2 tokens, webhooks and Zapier come with the Pro plan and above. The CLI is free and open source.
Not yet over MCP: file uploads (documents, CSV imports). Use the API or the CLI.
Workflows can’t be deleted from MCP. Disable them instead.
Editing a workflow only affects future assignments.
Questions about agentic Superdocu.
Short answers for teams wiring Superdocu into their agents.
What is the Superdocu MCP server?
It’s an MCP (Model Context Protocol) server at https://app.superdocu.com/mcp. It lets AI assistants such as Claude or ChatGPT read and act on your Superdocu account: contacts, workflows, documents, reminders and validations.
Do I need an API key to connect Claude or ChatGPT?
No. Add the MCP URL as a custom connector, sign in to Superdocu and approve the permissions you want to grant. OAuth handles the rest, and access tokens refresh automatically.
Can an AI agent approve or reject documents?
Yes, if you grant the document validation permission and your Superdocu role allows it. The same rules as in the web app apply: for example, a document that expires can’t be approved without an expiry date.
What’s the difference between the MCP server, the API v2 and the CLI?
The MCP server is for AI assistants, the API v2 is for your own code and automations, and the CLI wraps the API for scripts and coding agents working in a terminal. All three use the same permissions and business rules.
Which Superdocu plans include agent access?
The MCP server is available on every plan. Creating API tokens and using webhooks requires the Pro plan or above. Every plan starts with a 7-day free trial.
Is my data safe when an AI assistant is connected?
The assistant only reaches what your role and the scopes you approved allow. Files are shared through short-lived signed links, emailing actions are rate-limited, and your data stays hosted in Europe.
Still have questions? Talk to us, we read everything.
Give your agent something useful to do.
Connect Superdocu to Claude or ChatGPT in two minutes, then ask it what’s missing.
7-day free trial, cancel anytime.