---
title: BaseCite developer resources
description: Server-side integration guidance for BaseCite uploads, status, quota, and MCP resources.
---

# BaseCite developer resources

## Start here

- [Capabilities](https://api.basecite.com/api/v1/ai/capabilities)
- [OpenAPI](https://api.basecite.com/api/v1/ai/openapi.json)
- [MCP metadata](https://mcp.basecite.com/.well-known/mcp.json)
- [MCP server card](https://mcp.basecite.com/.well-known/mcp/server-card.json)
- [Smithery MCP registry listing](https://smithery.ai/servers/alwaysrememberme1024/basecite)
- [Official MCP Registry listing](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.paxton888%2Fbasecite/versions/0.1.0)
- [Authentication](https://basecite.com/auth.md)
- [Pricing](https://basecite.com/pricing.md)
- [Public repository and agent guidance](https://github.com/paxton777/basecite-evidence-receipts-v0.1-proof)

Partner uploads use sequential multipart requests with a configured part size, SHA-256 completion, status polling, quota enforcement, and workspace-scoped withdrawal. Production integrations must use server-side credentials and must not expose tokens in frontend code.

## Endpoint map

- POST /api/v1/organizations/{org_id}/partner-uploads/initiate starts one organization-scoped upload.
- PUT /api/v1/organizations/{org_id}/partner-uploads/{upload_id}/parts/{part_number} uploads one sequential part.
- POST /api/v1/organizations/{org_id}/partner-uploads/{upload_id}/complete commits the declared SHA-256 digest.
- GET /api/v1/organizations/{org_id}/partner-uploads/{upload_id} is the canonical status and six-gate polling endpoint.
- GET /api/v1/organizations/{org_id}/quota reads the configured persistent-storage allowance.
- POST /api/v1/organizations/{org_id}/partner-uploads/{upload_id}/withdraw removes the original and configured derived context while retaining the deletion receipt and minimum audit metadata.
- POST https://api.basecite.com/oauth/token exchanges provisioned tenant client credentials for a short-lived organization-bound bearer token.
- GET https://api.basecite.com/oauth/identity returns the organization and scopes bound to the current bearer token.

Every mutation requires a stable Idempotency-Key. A 202 Accepted response means the caller must follow the returned status reference; it does not mean that extraction, controlled summary, or AI context is complete. Clients must treat WITHDRAWN as terminal and must not retry a successful withdrawal as a new upload.

## Versioning and deprecation

The REST contract is versioned under `/api/v1/`. Existing v1 operations remain backward-compatible during the published support window. If an operation is retired, the response advertises `Deprecation` and `Sunset` headers at least 90 days before removal; the OpenAPI document and this guide are updated with the replacement before the sunset date.

## Async processing and bulk semantics

Upload completion is an asynchronous job pattern: the completion response returns an upload identifier and canonical status reference, and clients poll the status endpoint until a terminal state. BaseCite does not expose an unbounded bulk-export endpoint. Any future bulk operation must be explicitly organization-scoped, idempotent, quota-checked, and represented in the OpenAPI contract before release.

## Rate limits

Rate-limited API responses expose both the legacy `X-RateLimit-*` headers and the IETF `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` headers. A `429` response is retryable only after the advertised reset window and must not be used to probe another organization or credential.