> ## Documentation Index > Fetch the complete documentation index at: https://developers.nexspace365.com/llms.txt > Use this file to discover all available pages before exploring further. # Resume a dropped MCP tool-call stream > Streamable-HTTP resume endpoint. When `POST /mcp` answers a `tools/call` with `text/event-stream`, it returns an `Mcp-Stream-Id` header and buffers every frame it emits. If the connection drops, reconnect here with that id and a `Last-Event-ID` header: buffered frames after that id are replayed, then — if the call is still running — live frames are forwarded until the terminal JSON-RPC response closes the stream. If the call already finished, the replay is written and the stream ends immediately. Without this, a dropped `tools/call` is unrecoverable: the JSON-RPC result exists only on the stream that was cut. Only the credential that opened the stream may resume it. An unknown id, an expired/evicted id, and another caller's id all answer the same `404` so stream ids stay unprobeable. **Host:** served only on `mcp.nexspace365.com`. ## OpenAPI ````yaml https://api.nexspace365.com/api/openapi.json get /mcp/stream/{streamId} openapi: 3.0.3 info: title: NexSpace 365 API description: > Multi-industry enterprise workforce management platform — scheduling, HR, payroll, CRM, AI, and messaging suites. ## Authentication Four credentials, all but the first sent as `Authorization: Bearer `: session cookie, JWT bearer, API key (`nex_live_…` / `nex_test_…` / `nex_pat_…`), and OAuth 2.1 access token. AI agents should use an API key or an OAuth token with the appropriate scopes. ## Authorization Endpoints require specific permissions via the RBAC system: - **Internal team**: Full platform access - **Facility users**: Scoped to their org/facilities - **Staff**: Limited to own data ## Error Contract All errors return `{ error: { message, code?, suggestion?, retryable? }, requestId? }`. The `suggestion` field hints at how to fix the request; `retryable` signals whether retry-with-backoff is appropriate. ## Versioning Pin your integration to a specific API version via the `NexSpace-Version` header (date-based, e.g. `2026-05-10`). When absent, the latest version is assumed. Deprecated versions include `Sunset` and `Deprecation` headers. Discovery at `GET /.well-known/api-versions`. ## Idempotency Write operations (POST/PUT/PATCH) accept an `Idempotency-Key` header. If the same key + body combination is sent again within 24 hours, the original response is replayed. Different body with the same key returns 409 Conflict. ## MCP (Model Context Protocol) AI agents interact via `POST /mcp` using JSON-RPC 2.0. Call `tools/list` to discover available verbs, then `tools/call` to invoke them. MCP is served on its own host — `https://mcp.nexspace365.com`, not the API host. `api.nexspace365.com` rejects `/mcp`, `/mcp/*` and `/.well-known/mcp` with `403 MCP_HOST_NOT_ALLOWED`, and those operations pin the correct host with an operation-level `servers` override. The `/.well-known/oauth-protected-resource*` operations are also tagged MCP but are **not** covered by the host guard — they answer on either host. version: 1.0.0 contact: name: NexSpace email: admin@nexspace365.com license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://api.nexspace365.com description: Production server security: - bearerAuth: [] - apiKeyAuth: [] tags: - name: Authentication description: User authentication and session management - name: Facilities description: Facility management - name: Staff description: Staff member management and profiles - name: Credentials description: Staff credential tracking — licenses, certifications, and training - name: Shifts description: Shift scheduling and management - name: Agents description: Headless agent runs, human-in-the-loop approvals, and automation triggers. - name: Dashboard description: Dashboard statistics and widgets - name: API Keys description: API key lifecycle — create, list, revoke, rotate - name: MCP description: Model Context Protocol endpoint for AI agent tool calling - name: OAuth description: OAuth 2.1 authorization server — DCR, authorize, token - name: Webhooks description: Outbound webhook subscription management - name: Analytics description: API usage analytics and observability - name: Sandbox description: Sandbox (`nex_test_`) data lifecycle for the same production host - name: Platform description: Version discovery and platform metadata. paths: /mcp/stream/{streamId}: get: tags: - MCP summary: Resume a dropped MCP tool-call stream description: | Streamable-HTTP resume endpoint. When `POST /mcp` answers a `tools/call` with `text/event-stream`, it returns an `Mcp-Stream-Id` header and buffers every frame it emits. If the connection drops, reconnect here with that id and a `Last-Event-ID` header: buffered frames after that id are replayed, then — if the call is still running — live frames are forwarded until the terminal JSON-RPC response closes the stream. If the call already finished, the replay is written and the stream ends immediately. Without this, a dropped `tools/call` is unrecoverable: the JSON-RPC result exists only on the stream that was cut. Only the credential that opened the stream may resume it. An unknown id, an expired/evicted id, and another caller's id all answer the same `404` so stream ids stay unprobeable. **Host:** served only on `mcp.nexspace365.com`. operationId: resumeMcpStream parameters: - name: streamId in: path required: true description: The `Mcp-Stream-Id` returned by the streaming `POST /mcp` call. schema: type: string - name: Last-Event-ID in: header required: false description: > Replay buffered frames emitted after this event id. Omit (or send a non-numeric value) to replay the stream from the beginning — it is parsed as a number and falls back to `0`. schema: type: integer responses: '200': description: SSE stream (text/event-stream) — replayed frames, then live frames. content: text/event-stream: schema: type: string '401': $ref: '#/components/responses/UnauthorizedError' '404': description: >- Unknown, expired, or foreign stream id. The body is a JSON-RPC error envelope ("Unknown or expired stream id") rather than the platform error shape. content: application/json: schema: type: object properties: jsonrpc: type: string id: type: string nullable: true error: type: object properties: code: type: integer message: type: string data: type: object additionalProperties: true '429': $ref: '#/components/responses/RateLimited' security: - apiKeyAuth: [] - oauth2: [] servers: - url: https://mcp.nexspace365.com description: Canonical MCP host — the only host that serves /mcp/*. - url: http://localhost:5000 description: >- Local development (the host guard is inactive when MCP_PUBLIC_HOST is unset). components: responses: UnauthorizedError: description: Missing, invalid, expired, or revoked credential. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: message: Invalid or revoked API key code: UNAUTHENTICATED suggestion: >- Send a valid `Authorization: Bearer ` (nex_live_/nex_pat_ key, JWT, or OAuth access token). retryable: false RateLimited: description: > Per-key rate limit exceeded. Includes `Retry-After` and the full `X-RateLimit-*` set so agents can back off precisely (NEX-1659). headers: Retry-After: $ref: '#/components/headers/Retry-After' X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' example: error: message: Rate limit exceeded for this API key code: API_KEY_RATE_LIMITED suggestion: >- Wait until X-RateLimit-Reset before retrying, or batch operations. retryable: true schemas: Error: type: object properties: error: type: object properties: message: type: string description: Human-readable error message code: type: string description: Machine-readable error code (e.g. VALIDATION_FAILED, NOT_FOUND) details: type: object description: Structured details (e.g. Zod validation issues) suggestion: type: string description: Hint for agents on how to recover retryable: type: boolean description: Whether the same request might succeed on retry required: - message requestId: type: string description: Correlation ID for logs and Sentry required: - error headers: Retry-After: description: Seconds to wait before retrying (present on 429). schema: type: integer X-RateLimit-Limit: description: Requests allowed per window for this API key (NEX-1659). schema: type: integer X-RateLimit-Remaining: description: Requests remaining in the current window. schema: type: integer X-RateLimit-Reset: description: Unix timestamp (seconds) when the current window resets. schema: type: integer securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT token authentication apiKeyAuth: type: http scheme: bearer bearerFormat: NexSpaceApiKey description: | API key or personal access token (NEX-1042). Send as `Authorization: Bearer `. Token format: - `nex_live_…` — live API key (server-to-server) - `nex_test_…` — sandbox API key - `nex_pat_…` — personal access token (acts as the issuing user) Authorization is decided by the key's `scopes` array, not the owning user's RBAC role. See `POST /api/api-keys` to mint a key. oauth2: type: oauth2 description: | OAuth 2.1 access token issued by this server's authorization endpoints (`/oauth/authorize` + PKCE, or the RFC 8628 device flow). Send as `Authorization: Bearer ` — the same header slot as an API key. Granted scopes are carried on the token and enforced from `req.tokenScopes`. Requested scopes are filtered to the catalog below (`filterKnownHeadlessScopes`, `shared/headless-scopes.ts`); anything outside it is dropped at registration, consent, and grant time, so it can never appear on an issued token. flows: authorizationCode: authorizationUrl: https://api.nexspace365.com/oauth/authorize tokenUrl: https://api.nexspace365.com/oauth/token refreshUrl: https://api.nexspace365.com/oauth/token scopes: shifts:read: Read shifts shifts:write: Create / edit shifts shifts:assign: Assign shifts to staff staff:read: Read staff staff:write: Create / edit staff credentials:read: Read credentials credentials:verify: Run credential verifications payroll:read: Read payroll payroll:run: Run payroll crm:*: CRM (all actions) facilities:read: Read facilities facilities:write: Create / edit facilities integrations:write: Manage webhooks & integrations analytics:read: Read analytics & reports facility:read: Read facility directory & staffing calendar:read: Read schedule & availability communications:read: Read messaging status marketing:read: Read marketing, social & content general:read: Read knowledge base & web search scheduling:read: Read schedules & settings crm:read: Read CRM (leads, deals, contacts) compliance:read: Read compliance & credentials crm:write: Create / edit CRM records scheduling:write: Create / edit shifts & schedule settings communications:write: Send messages & manage campaigns apps:read: Read data from your connected apps apps:write: Take actions in your connected apps agents:run: Run configured AI agents agents:approve: Approve / reject & resume agent runs x-deviceCode: deviceAuthorizationUrl: https://api.nexspace365.com/oauth/device/code tokenUrl: https://api.nexspace365.com/oauth/token refreshUrl: https://api.nexspace365.com/oauth/token scopes: shifts:read: Read shifts shifts:write: Create / edit shifts shifts:assign: Assign shifts to staff staff:read: Read staff staff:write: Create / edit staff credentials:read: Read credentials credentials:verify: Run credential verifications payroll:read: Read payroll payroll:run: Run payroll crm:*: CRM (all actions) facilities:read: Read facilities facilities:write: Create / edit facilities integrations:write: Manage webhooks & integrations analytics:read: Read analytics & reports facility:read: Read facility directory & staffing calendar:read: Read schedule & availability communications:read: Read messaging status marketing:read: Read marketing, social & content general:read: Read knowledge base & web search scheduling:read: Read schedules & settings crm:read: Read CRM (leads, deals, contacts) compliance:read: Read compliance & credentials crm:write: Create / edit CRM records scheduling:write: Create / edit shifts & schedule settings communications:write: Send messages & manage campaigns apps:read: Read data from your connected apps apps:write: Take actions in your connected apps agents:run: Run configured AI agents agents:approve: Approve / reject & resume agent runs ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.