Full developer documentation: searchable tool/input-schema reference, OAuth, security policy, management OpenAPI, interactive Apps, runnable clients and testing.
MCP endpoint: https://app.credentialcamp.com/api/mcp. Sign in with your tenant account, select scopes and choose approval settings. Revoke access in Agent Access.
Only records permitted by your current role and selected organisation are returned. Retrieved employee names, credential metadata and business records are sent to the AI provider you connect. Original files, I-9 data, unrestricted SQL, platform-admin tools and role/access changes are not exposed. The connected provider's terms and privacy practices apply to data it receives. Changes require human approval unless you explicitly enable selected supported tools. Provider confirmations can still apply. Normal workflows and configured notifications/webhooks may run after changes.
Privacy policy · Terms · Support
Open Agent Access to check the actual published OAuth discovery, database migration, authentication challenge, public documentation and branding. Technical checks do not grant directory approval. The Microsoft builder requires your real public app UUID and Developer Portal DCR reference, and generates a root-level manifest and icons with version 1.29 runtime tool discovery. Never enter secrets or tokens. The standard Copilot download contains GitHub configuration and instructions, not a placeholder upload manifest.
Authorization code with S256 PKCE, RFC 9728 resource discovery and RFC 7591 registration. Public clients and confidential client-secret Basic/POST methods are supported. Access tokens expire after one hour; refresh tokens rotate; account links expire after 90 days. Reuse of a spent refresh token revokes the connection. Tokens and client secrets are hashed at rest and never belong in downloaded packages.
Packages are not submitted, approved, or a guarantee of compatibility. Publish the updated app and database schema, test within each provider, verify publisher/domain ownership and upload the required materials. Use isolated synthetic reviewer data. Microsoft requires a real Developer Portal authentication reference. OIDC enterprise email-domain restrictions and CIMD are not advertised; DCR is the supported registration path.
Contact support@credentialcamp.com for connection assistance. Privacy inquiries: privacy@credentialcamp.com. Never send credentials, access tokens or employee records by email.