There are 2 ways in. The REST API lives under /v1 on the API host, described by /v1/openapi.json. The MCP server at /mcp exposes the same actions as tools, listed with their inputs on the MCP page. Both run the same permission checks as the browser.
Keys
Make an API key in workspace settings. A key acts for the person who made it, with that person's permissions.
Webhooks
Subscribe a URL to record events. Each delivery carries a Catara-Signature header, a SHA-256 signature of the body, so your server can check it came from Agos.