Plans & Limits¶
The Contio User API is available on every plan, but the managed MCP transport, PATs, workspace API keys, and workspace webhooks require a paid workspace.
Plan availability¶
| Capability | Free | Pro | Elite | Enterprise |
|---|---|---|---|---|
| REST API core endpoints (meetings, action items, agenda, calendar, profile) | ✅ | ✅ | ✅ | ✅ |
| OAuth 2.1 + PKCE | ✅ | ✅ | ✅ | ✅ |
| User Events (SSE) | ✅ | ✅ | ✅ | ✅ |
Hosted MCP gateway (mcp.contio.ai) | — | ✅ | ✅ | ✅ |
| Personal Access Tokens (create) | — | ✅ | ✅ | ✅ |
| Workspace API Keys | — | ✅ | ✅ | ✅ |
| Workspace Webhooks | — | ✅ | ✅ | ✅ |
Free users can still build agent integrations
FREE workspaces can call the /v1 REST API with an OAuth token and can host a private MCP server using the published mcp.json. The hosted gateway at mcp.contio.ai is the paid convenience layer.
Hosted MCP scopes¶
The gateway requests these User API scopes during OAuth:
meetings:readmeetings:writeaction-items:readaction-items:writecalendar:readcalendar:writecanvases:readcanvases:write
The workspace:read and workspace:write scopes are not requested through OAuth and are not available on PATs; they are available only on workspace API keys. PATs are created with the subset you choose; the gateway still lists every user-level tool, and the API rejects a call whose scope the token lacks.
Rate limits¶
All /v1 endpoints, including those called through the MCP gateway, are subject to per-principal rate limits. Limits are keyed on the authenticated principal and scale by plan.
See the Rate Limits guide for per-plan request budgets, response headers, and throttling best practices.
Admin tool access¶
Admin tools require a workspace API key (cto_wk_v1_). PATs, short-lived access tokens and OAuth tokens see only the user-level tool catalog, even when they belong to a workspace owner or admin. See Hosted MCP Server › Admin tools.
Upgrading¶
To enable the hosted MCP gateway, PATs, workspace API keys, or workspace webhooks, upgrade your workspace to PRO or higher in the Contio app. Your existing OAuth-based /v1 integrations continue to work unchanged.