# ActionDock > ActionDock is a human-in-the-loop approval gateway for AI-agent API writes: an MCP server and HTTP API that puts deterministic policy, owner approval of the exact request, and server-held credentials between an agent's tool call and a real API write. Official MCP server: https://actiondock.app/mcp (remote Streamable HTTP — nothing to install). ActionDock (actiondock.app) is unrelated to the `actiondock` and `@actiondock/*` packages on npm and to “Action Dock” boat-lift or loading-dock businesses. The MCP server answers initialize and tools/list without a key so hosts and registries can read the tool catalog; every tool call and the HTTP API require `Authorization: Bearer ` and return 401 otherwise, so the authenticated surface is described here rather than linked. The MCP server is https://actiondock.app/mcp (Streamable HTTP, nothing to install) with the tools list_actions, list_connections, run_action, get_job, wait_for_job, list_job_reconciliations, list_events, and list_usage. The HTTP API is POST https://actiondock.app/v1/actions/{action} (returns a 202 job), GET https://actiondock.app/v1/jobs and https://actiondock.app/v1/jobs/{jobId}, plus https://actiondock.app/v1/connections, https://actiondock.app/v1/events, https://actiondock.app/v1/usage, and https://actiondock.app/v1/artifacts. Never expose the key in prompts, logs, output, or browser-visible configuration. Every external write pauses as `awaiting_approval` on an exact preview until a signed-in workspace owner releases it in the dashboard; the agent and its API key cannot approve their own request. A stable idempotency key deduplicates the ActionDock submission; it does not guarantee exactly-once execution in an arbitrary provider. Terminal job statuses are `succeeded`, `failed`, `rejected`, and `execution_unknown`. When a job reports `execution_unknown`, stop blind retry and reconcile the external system before submitting another request, and never claim an external write happened until the job reports `succeeded`. The durable record shows submitted intent, owner approval or rejection, terminal execution state, and the response received by ActionDock; it is not independent attestation of the provider's external state. ActionDock controls only actions routed through its MCP or HTTP API, not an agent's browser, computer, or alternate direct access to a provider. Workspace API keys can have an optional expiration chosen by the owner at creation. At or after expiresAt, new HTTP and remote MCP requests using that key return 401. Omitted or null expiresAt preserves indefinite access until revocation. Expiration does not cancel in-flight requests or accepted jobs, revoke owner sessions, or change provider credentials. It does not apply to the local stdio transport. Ask the owner for a replacement through the host secret store; agents cannot issue, extend or renew their own access. Preserve job IDs and idempotency keys when replacing a key; do not resubmit a write blindly. Only the signed-in owner can revoke an approved integration.execute while it is still queued, before the worker claims it. Successful revocation releases capacity and emits job.rejected, retaining the preview and both approval and rejection evidence. Agent API keys cannot revoke approval. This cannot cancel running requests or undo external changes. Treat rejected as terminal even after approval; do not automatically resubmit. The original idempotency key returns the rejected job; a replacement requires a new proposal, key and owner approval. For a support handoff, direct the signed-in owner to Download job evidence on the dashboard job. GET /v1/dashboard/jobs/{jobId}/export requires the owner session, not an agent API key. The JSON contains that job and up to 1,000 of its newest stored job events and owner observations per collection, with truncation flags. It is not signed or independent provider verification and never replays a request. Events may lag job updates. Review sensitive content before sharing. The signed-in owner can filter Workflows and jobs by status and load older jobs, including approvals and execution_unknown records outside the recent overview. GET /v1/dashboard/jobs accepts status, limit (1-100, default 50), and a before job UUID; follow nextBefore until null. Results are newest first by creation time and ID, scoped to the owner workspace. These are live pages, not a snapshot; refresh to see new jobs or changed statuses. Agent API keys cannot use this owner endpoint; MCP tools and agent job reads keep their existing contracts. Only the signed-in owner can retry a failed callback notification to the current configured receiver. An enabled callback is required. Retry queues a new bounded delivery cycle; it never reruns the job or changes execution_unknown. Event and delivery IDs stay stable; verify the signature and deduplicate X-ActionDock-Delivery. Delivery is at least once, and polling remains available. Agent API keys and MCP tools cannot retry notifications. The owner can browse Callback delivery history by status, including older failures. GET /v1/dashboard/callback-deliveries accepts status, limit (1-100, default 50), and a before delivery UUID; follow nextBefore until null. Results contain receipt metadata, not event payloads or signing secrets, ordered by delivery creation time and ID descending. These are live pages, not a snapshot; refresh for changed statuses or return to the first page for new deliveries. Agent API keys and MCP tools cannot read this owner-only history. Only the signed-in owner can configure a connection operatorIdentity (application name and public HTTPS contact URL). ActionDock sends its generated User-Agent on reads and writes; configured values are included in the approval preview and changing or clearing them invalidates pending approvals. list_connections exposes operatorIdentity and the effective userAgent, never a credential. Agents cannot override request headers or configure identity. This is public, unverified contact information, not authentication or provider permission. Connection metadata includes enabled: false when paused. Only the signed-in owner can pause or resume a connection in the dashboard. Pausing preserves its configuration and credential, blocks new reads/writes and approval, and is rechecked before dispatch. Each pause or resume invalidates earlier write proposals and approvals, even after resuming; submit a fresh proposal for owner review. Requests that already passed the final state check may still finish. Resume does not replay failed or unknown jobs. Other connections are unaffected; this does not stop shell, browser or direct provider access. Only the signed-in owner can set a connection apiVersion. For api.notion.com, choose 2025-09-03 or 2026-03-11; ActionDock sends the fixed Notion-Version header on reads and writes. list_connections exposes the selection and the exact write preview includes versionHeader. Changing it invalidates earlier proposals and approvals; submit a new proposal for review. Agents cannot override the version or request headers. Legacy Notion connections without a selection must be edited before use. Version selection does not grant page access or write permission, enable beta features or add native MCP support. The signed-in owner can open Test GET on a connection, choose a relative path and optional scalar query parameters, and run one integration.fetch. GET must be allowed and the connection active; current path and provider restrictions still apply. Inspect the returned job ID, status, provider response or error. Refresh result uses owner-session GET /v1/dashboard/jobs/{jobId} to read the saved job; it never resends the provider request. A successful check describes only that request, not overall connection health, write permission or completion of asynchronous provider work. Agent API keys cannot use owner test/result routes; agents keep integration.fetch and get_job. For integration.fetch and integration.execute, output.statusCode is the provider HTTP status, distinct from ActionDock submission HTTP 202. A succeeded job with provider HTTP 202 confirms acceptance, not completion. Inspect output.body and, when present, output.headers.xMsOperationId and output.headers.retryAfter. These headers are validated metadata, not verified business outcomes. Missing, malformed, duplicate or oversized values become null; older receipts may omit them. ActionDock does not retain Location headers, poll an operation, follow a provider URL or retry a write automatically. To check progress, submit an explicit integration.fetch to an owner-allowed GET path with the required provider permissions; inspect the returned operation state even after HTTP 200. A job.succeeded callback carries the same acceptance-only meaning. Do not propose another write merely because completion is pending. The complete catalog has 7 actions: `integration.execute` (Perform one supervised write request against a workspace-approved HTTPS API connection within strict allowlists; external write, owner approval required); `document.analyze` (Analyze an internal business document and return a cited decision brief as a downloadable Markdown report); `data.extract` (Extract a caller-defined structured schema from supplied business text, including evidence and missing required fields); `data.validate` (Validate a structured record against deterministic field rules and return machine-readable failures); `research.web` (Research a business question on the public web and return a source-linked evidence report for the calling agent); `integration.fetch` (Read JSON or text from a workspace-approved HTTPS API connection within its method and path allowlists); `report.create` (Turn agent-supplied findings into a durable Markdown or JSON report artifact for audit and handoff). ActionDock does not provide telephony, customer messaging, campaigns, social posting, generated media, payment processing, money transfer, stored value, regulated advice, or decisions, scoring, profiling, ranking, or categorization of people. Connections to SMS, telephony, email, marketing, consumer-messaging, social, exchange, money-transfer, and most payment destinations are blocked; Slack and Stripe (restricted key) are restricted destinations with server-denied endpoints (https://actiondock.app/acceptable-use#connections). ## Product - [ActionDock](https://actiondock.app/): Product overview: deterministic policy, owner approval of the exact request, server-held credentials, execution receipts, and safe handling of uncertain outcomes. - [Agent integration guide](https://actiondock.app/agents): How to connect any MCP-capable or HTTP agent, submit one supervised write, poll the job, and handle approval and execution_unknown. - [Pricing](https://actiondock.app/pricing): Launch, Growth, and Scale subscriptions with connection and storage limits, plus Enterprise by quote. - [Free sandbox](https://actiondock.app/sandbox): Create a sandbox workspace without a card: run the submit, approve, and execute loop against a built-in records API before choosing a plan. - [Recorded run](https://actiondock.app/demo): A recorded supervised write over MCP with every real payload: read with ETag, proposal bound to the version, owner approval of the exact request, execution receipt, and event log. - [AI agent incidents](https://actiondock.app/incidents): Source-linked incident reports and research demonstrations, mapped to ActionDock controls with explicit coverage boundaries. - [First safe API write](https://actiondock.app/use-cases/approved-integrations): Give any AI agent one supervised API-write path with deterministic policy, exact-request approval, a server-held credential, and an execution receipt. - [Durable actions for AI agent loops](https://actiondock.app/use-cases/durable-actions): Durable, idempotent business actions over MCP or HTTP while ActionDock enforces approval, policy, and evidence. - [Source-linked web research for AI agents](https://actiondock.app/use-cases/web-research): Bounded public-web research as a durable job that returns facts, inferences, unknowns, and usage. - [Decision-ready document intake](https://actiondock.app/use-cases/document-intelligence): Turn supplied contracts, policies, and operational notes into cited decision briefs attached to a durable job. - [Structured extraction and validation](https://actiondock.app/use-cases/structured-data): Extract caller-defined fields with evidence and validate the resulting record with deterministic rules. ## Machine-readable - [Agent Skill](https://actiondock.app/skill.md): Portable SKILL.md with connection, workflow, and safety rules for agents that use ActionDock. - [Agent manifest](https://actiondock.app/v1/manifest): JSON manifest of transports, MCP tools, the complete action catalog, execution contract, callbacks, and plans. - [OpenAPI 3.1](https://actiondock.app/openapi.json): HTTP API specification with Job, Connection, Artifact, and Error schemas and authenticated operations. - [MCP server metadata](https://actiondock.app/.well-known/mcp/server.json): MCP registry server.json describing the remote Streamable HTTP endpoint and its bearer header. ## Blog - [AI Agent API Key Expiration: Set a Lifetime and Rotate Safely](https://actiondock.app/blog/ai-agent-api-key-expiration): Choose an expiration for an ActionDock agent key, replace it before access stops, and understand what an expired key does not revoke. (published 2026-10-29) - [Notion-Version Header for AI Agents: Pin API Versions Before Writes](https://actiondock.app/blog/notion-api-version-ai-agents): Set the Notion-Version header, match page updates to the API contract, and keep version changes inside owner approval rather than agent-controlled request headers. (published 2026-10-22) - [HTTP 202 Accepted in AI Agent Workflows: How to Verify Completion](https://actiondock.app/blog/ai-agent-http-202-accepted): Distinguish queued jobs from provider HTTP 202 responses, inspect asynchronous operation state, and verify completion without repeating an approved API write. (published 2026-10-20) - [How to Pause AI Agent API Access Without Deleting a Connection](https://actiondock.app/blog/pause-ai-agent-api-access): Temporarily block an AI agent's API connection while preserving its setup. Learn what pause stops, what can still finish, and how to resume with fresh approval. (published 2026-10-13) - [How to Retry Failed AI Agent Webhooks Without Repeating API Writes](https://actiondock.app/blog/retry-failed-ai-agent-webhooks): Recover failed AI-agent webhook deliveries: repair the receiver, retry only the notification, deduplicate stable IDs, and verify job state before resuming work. (published 2026-10-08) - [AI Agent API Rate Limits: How to Handle 429 Without Duplicate Writes](https://actiondock.app/blog/ai-agent-api-rate-limits-429): Handle HTTP 429 in AI-agent workflows: identify which API rate-limited the request, honor Retry-After, and recover approved writes without duplicate effects. (published 2026-10-06) - [How to Cancel an Approved AI Agent API Write Before Execution](https://actiondock.app/blog/cancel-approved-ai-agent-api-write): Learn when an approved AI-agent API write can still be revoked, what a queued-to-running race means, and how to handle rejection or uncertain outcomes. (published 2026-10-01) - [AI Agent Approval Timeout: How to Prevent Stale API Writes](https://actiondock.app/blog/ai-agent-approval-timeout-stale-api-writes): Prevent stale AI-agent API writes with request-bound approval deadlines, final dispatch checks, ETags, and explicit handling for expired proposals. (published 2026-09-24) - [How to Test AI Agent API Writes Before Production](https://actiondock.app/blog/test-ai-agent-api-writes-before-production): Test AI-agent API writes before production with a failure-first matrix for policy, approval, ETags, idempotency, callbacks, and unknown outcomes. (published 2026-09-22) - [AI Agent API Concurrency Control: ETags, If-Match, and 412](https://actiondock.app/blog/ai-agent-api-concurrency-control-etag-if-match): Prevent stale AI-agent API writes with strong ETags and If-Match. See how 412 handling differs from approval, idempotency, and reconciliation. (published 2026-09-21) - [AI Agent Egress Control: Sandbox, Allowlist, and API Gateway](https://actiondock.app/blog/ai-agent-egress-control-sandbox-vs-api-gateway): Compare AI agent egress controls across sandboxes, network allowlists, and API gateways—and see why an approved domain is not an approved operation. (published 2026-09-17) - [AI Agent API Guardrails: Deterministic Policy vs LLM Checks](https://actiondock.app/blog/ai-agent-guardrails-deterministic-policy-vs-llm-checks): Learn where deterministic policy, LLM reasonableness checks, and human approval belong in an AI-agent API write path—and why none can replace the others. (published 2026-09-15) - [How to Prevent AI Agents From Deleting Production Data](https://actiondock.app/blog/prevent-ai-agents-deleting-production-data): Prevent destructive AI-agent actions with least-privilege credentials, request-bound approval, bounded API routes, isolation, and recoverable backups. (published 2026-09-08) - [Webhook Signature Verification for AI Agent Callbacks](https://actiondock.app/blog/webhook-signature-verification-ai-agent-callbacks): Verify AI-agent webhook callbacks with the raw body, HMAC-SHA256, a timestamp window, constant-time comparison, and atomic delivery deduplication. (published 2026-09-03) - [AI Agent Audit Trail: What to Log for API Actions](https://actiondock.app/blog/ai-agent-audit-trail-api-actions): Build an AI agent audit trail that records intent, policy, approval, execution, and uncertain outcomes without leaking secrets or overstating provider evidence. (published 2026-09-01) - [Give AI Agents API Access Without Exposing API Keys](https://actiondock.app/blog/ai-agent-api-access-without-exposing-keys): Keep a target API credential outside the model context while an AI agent submits bounded, owner-reviewed writes through a server-side gateway. (published 2026-08-28) - [AI Agent API Retries: Idempotency and Unknown Outcomes](https://actiondock.app/blog/ai-agent-api-retries-idempotency): Learn when an AI agent can retry an API write, what an idempotency key protects, and how to reconcile execution_unknown without duplicate side effects. (published 2026-08-28) - [AI Agent API Security: Make the First Safe Write](https://actiondock.app/blog/ai-agent-api-security-first-safe-write): Learn how to move an AI agent from read-only recommendations to one policy-checked, owner-approved API write without exposing the target credential. (published 2026-08-28) - [Human-in-the-Loop Approval for AI Agent Actions](https://actiondock.app/blog/human-in-the-loop-approval-ai-agents): A practical design for AI-agent approvals that bind a human decision to one exact API request, preserve pending state, and invalidate stale reviews. (published 2026-08-28) - [MCP Server Security for Write-Enabled Tools](https://actiondock.app/blog/mcp-server-security-write-tools): A production MCP security checklist for write-enabled tools: trusted servers, least privilege, approval gates, credential isolation, and action records. (published 2026-08-28) ## Pricing - [Sandbox](https://actiondock.app/sandbox): Free, no card. One built-in API connection with test supplier records, a one-off allowance of about 200 standard actions, and the same approval loop as a paid plan. - [Launch](https://actiondock.app/pricing): $49/month or $490/year; up to 3 API connections; 250 MB report storage; complete action catalog. - [Growth](https://actiondock.app/pricing): $149/month or $1,490/year; up to 10 API connections; 1 GB report storage; complete action catalog. - [Scale](https://actiondock.app/pricing): $399/month or $3,990/year; up to 30 API connections; 3 GB report storage; complete action catalog. - [Enterprise](https://actiondock.app/contact): Custom quote for larger connection counts, report storage, and support scope. ## Optional - [Privacy Policy](https://actiondock.app/privacy): How ActionDock handles workspace, job, integration, report, usage, and billing data. - [Terms of Service](https://actiondock.app/terms): Terms governing ActionDock subscriptions. - [Acceptable Use Policy](https://actiondock.app/acceptable-use): Permitted and prohibited uses of ActionDock actions, API connections, reports, and agent workflows. - [Refund and Cancellation Policy](https://actiondock.app/refund-policy): Full, unconditional 14-day refund for subscription purchases and renewals.