Contents

Tools

Served by each module. Tool names have no module prefix here (search_orders); the MCP connector adds one (commerce_search_orders). The full catalogue per module is in the MCP connector API (x-nucleo-tools).

Base URL, authentication and conventions of this API are on the AI Tools API page.

get/api/v1/ai-tools

List the tools available in a company

Requires the nucleo.ai_tools scope.

The tools the person may use in the company of X-Nucleo-Company, already filtered by their permissions and roles in that module, sorted by name. Definitions do not change between a list and a call unless the company or the person's permissions change.

Caching: responses carry ETag and Cache-Control: private, max-age=60; send the ETag back in If-None-Match to get 304 Not Modified.

Company errors (400 company_required, 403 company_forbidden, 409 company_not_ready) mean the module is not usable for this person in this company: hide it. 403 ai_connector_disabled means the company has switched off this module's AI connector (Nucleo Core → company modules): hide it too. That check runs on every module right after the token and the person's access to the module are verified, and before the company, version and tool checks, on the company of X-Nucleo-Company (on Brain, without the header, the token's company or the person's only company with Brain). Switching the connector off usually applies within seconds, but can take up to 5 minutes.

Catalog only: a company can have several catalogs. X-Nucleo-Store (id or slug) picks one; without it the first ready catalog the person can access is used (the first created), and company.store says which. The MCP connector never sends X-Nucleo-Store, so it always works on that catalog.

Module differences. On Brain, company errors are plain {"message": "..."} bodies (400 no company, 403 no access, 404 Brain not set up for the company — no 409), and it does not echo X-Nucleo-Request-Id. Intelligence checks the company before the contract version.

Rate limit: 120 requests per minute per user on every module (Brain, Catalog, Commerce, Intelligence), in a separate bucket from tool calls.

GET https://api-commerce.nucleoplatform.com/api/v1/ai-tools
Authentication: OAuth 2.0 access token
Rate limit: 120 requests per 1m, per user

Headers

  • X-Nucleo-Companystringrequired

    Numeric company id (companies[].id from the context, or orgs[].id from userinfo).

    pattern ^[1-9][0-9]{0,18}$
    Example: 7
  • X-Nucleo-Languagestring

    Language of human-readable texts in results and errors (en or it, default en). Tool descriptions are written for the model and do not follow X-Nucleo-Language; Catalog tools are currently described in Italian. Catalog applies it only to its protocol errors (company, version, unknown tool, invalid arguments): the texts inside its tool results, domain errors and the permission_denied messages written by a tool are in Italian whatever the header.

    One ofenit
    default en
    Example: en
  • X-Nucleo-AI-Tools-Versionstring

    Contract version. Missing = 1. Any other value → 406.

    One of1
    default 1
    Example: 1
  • X-Nucleo-Request-Idstring

    Your id for the call (UUID recommended), echoed back and written in Nucleo's logs. Pattern ^[A-Za-z0-9._:-]{1,128}$, otherwise a new UUID is used.

    max length 128
    Example: 2f9c1e4a-7b3d-4c5e-9f8a-1b2c3d4e5f6a
  • X-Nucleo-Storestring

    Catalog only — id or slug of the catalog (store) to use within the company (ignored by other modules).

    Example: acme-eu
  • If-None-Matchstring
    Example: "5f1d3b0c9a4e2b7d8c6f1a0e3b2d4c5a6f7e8d9c"

Responses

  • 200Tool list.
    Headers
    • ETag
    • Cache-Control
    • X-Nucleo-Request-Id Echo of the request id (or a generated one). Not sent by Brain.
    • version1required
    • modulestringrequired
      One ofbraincatalogcommerceintelligence
    • companyobject

      On Catalog, id is the company but slug and name are those of the catalog in use (the same as store).

      Child attributes
      • idinteger | null
      • slugstring | null
      • namestring | null
      • storeobject

        Catalog only — the catalog in use.

        Child attributes
        • idinteger
        • slugstring
        • namestring
    • languagestring
    • instructionsstring

      Module-level guidance for the model (English).

    • toolsarray of ToolDefinitionrequired
      Attributes of each item
      • namestringrequired
        pattern ^[a-z][a-z0-9_]{1,47}$
      • titlestring
        max length 60
      • descriptionstringrequired

        Written for the model, cut at 1,024 characters. Brain, Commerce and Intelligence describe their tools in English; Catalog tools are currently described in Italian.

        max length 1024
      • inputSchemaobjectrequired

        JSON Schema of type object (no $ref, oneOf/anyOf/allOf or additionalProperties).

      • permissionstring | null

        Module permission the tool requires (informational).

      • side_effectsstringrequired
        One ofreadwrite
      • annotationsobject
        Child attributes
        • readOnlyHintboolean
        • destructiveHintboolean

          true only for a write that cannot be undone automatically (for example a merge of two records, forgetting a memory, or removing a deal). The gateway passes every hint unchanged to the AI client.

        • idempotentHintboolean
        • openWorldHintboolean
      • tagsarray of string
    • generated_atstring (date-time)
  • 304Not modified (If-None-Match matched).
  • 400X-Nucleo-Company missing or not a positive integer.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 401Missing, expired or revoked token — or a token that is not from a self-registered client. Body: {"message":"Unauthenticated."}; Intelligence answers with application/problem+json.
    • messagestring
  • 403No access to the module in this company, or the company switched off its AI connector.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 404Brain only — Brain is not set up for this company.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 406Unknown contract version.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 409The person has access but the module is not set up yet for this company.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 429More than 120 requests per minute for this user on this endpoint. Default body; Intelligence answers with application/problem+json.
    Headers
    • Retry-After
    • X-RateLimit-Limit
    • X-RateLimit-Remaining
    • messagestring
Request
curl -X GET https://api-commerce.nucleoplatform.com/api/v1/ai-tools \
  -H "Authorization: Bearer $NUCLEO_ACCESS_TOKEN" \
  -H 'X-Nucleo-Company: 7' \
  -H 'X-Nucleo-Language: en' \
  -H 'X-Nucleo-AI-Tools-Version: 1' \
  -H 'X-Nucleo-Request-Id: 2f9c1e4a-7b3d-4c5e-9f8a-1b2c3d4e5f6a' \
  -H 'X-Nucleo-Store: acme-eu' \
  -H 'If-None-Match: "5f1d3b0c9a4e2b7d8c6f1a0e3b2d4c5a6f7e8d9c"' \
  -H 'Accept: application/json'
Response
{
  "version": 1,
  "module": "commerce",
  "company": {
    "id": 7,
    "slug": "acme",
    "name": "Acme Apparel"
  },
  "language": "en",
  "instructions": "Nucleo Commerce: Customer care (internal tickets between Customer Service, Logistics and the other teams; customer requests from the helpdesk, for the Customer Service team only), POS (points of sale, on-hand stock, inbound deliveries, transfers and returns) and Orders (the OMS: orders, customers, returns, shipments, sellable stock, routing, anomalies, fulfillment KPIs). Ticket codes look like TK-0029. Start from search_tickets or list_customer_requests (search_orders for orders), then read the detail. Everything here is read-only: nothing changes data, and reading a ticket does not mark it as read.",
  "tools": [
    {
      "name": "get_order",
      "title": "Get order",
      "description": "Orders (Nucleo OMS). One order in full, as on its page: customer and shipping address, items (SKU, quantities ordered, cancelled, shipped; price paid, full price, compare-at price and share of order discounts, fixed at the first download), amounts in the order currency and in the store currency (original and current after edits, refunds and cancellations; received, outstanding, refunded; shipping with discount and tax), refunds made on the sales channel, where each item ships from, pauses, shipments with tracking, returns, open anomalies. The order can be given by number (#1001) or id. For \"why is it here / why is it stuck\" use explain_order instead.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "order": {
            "type": "string",
            "description": "Order number (e.g. #1001) or id."
          }
        },
        "required": [
          "order"
        ]
      },
      "permission": "oms.read",
      "side_effects": "read",
      "annotations": {
        "readOnlyHint": true,
        "destructiveHint": false,
        "idempotentHint": true,
        "openWorldHint": false
      },
      "tags": [
        "oms",
        "orders"
      ]
    }
  ],
  "generated_at": "2026-10-04T09:15:00+02:00"
}
post/api/v1/ai-tools/{name}

Run a tool

Requires the nucleo.ai_tools scope.

Runs one tool with arguments (validated against its inputSchema) and returns an MCP CallToolResult:

  • content[0].text — readable result (JSON text, cut at 50,000 characters with a "truncated" note: refine the query);
  • structuredContent — the same result as JSON;
  • isError: true — a domain error the model can act on (record not found, no data source, a write that needs confirmation in the Nucleo app…). HTTP status stays 200.

Protocol errors use HTTP statuses: 404 unknown_tool, 403 permission_denied (+ permission), 422 invalid_arguments, and the company errors of the list endpoint, including 403 ai_connector_disabled when the company has switched off this module's AI connector.

Writes. Commerce and Intelligence tools are read-only. Brain and Catalog have write tools (side_effects: write): announce the change to the user before calling them. Catalog applies only small, reversible writes from AI clients (up to 3 writes / 5 products within 10 minutes per person and catalog, counted from the first write); deletions, whole-object replacements (every PUT, e.g. prices, stock, translations, categories, variants), bulk, storefront-facing changes, imports and publishing come back as a preview (will_do) with isError: true and error: confirmation_required_in_app — nothing is changed, the user confirms inside Nucleo.

Idempotency. Send a fresh X-Nucleo-Request-Id per logical call and reuse it on retries; Brain uses it to deduplicate record writes. Catalog does not: it only logs the id, so its writes are not idempotent and retrying create_product (or duplicate_product) creates another product. Before retrying a Catalog write that timed out, search for its result.

Responses should arrive within 25 seconds; long jobs return an id to poll with a companion tool.

Rate limit: 120 calls per minute per user on every module (Brain, Catalog, Commerce, Intelligence), in a separate bucket from tool lists.

POST https://api-commerce.nucleoplatform.com/api/v1/ai-tools/{name}
Authentication: OAuth 2.0 access token
Rate limit: 120 requests per 1m, per user

Path parameters

  • namestringrequired

    Tool name from the list, without module prefix.

    max length 48pattern ^[a-z0-9_]+$
    Example: search_orders

Headers

  • X-Nucleo-Companystringrequired

    Numeric company id (companies[].id from the context, or orgs[].id from userinfo).

    pattern ^[1-9][0-9]{0,18}$
    Example: 7
  • X-Nucleo-Languagestring

    Language of human-readable texts in results and errors (en or it, default en). Tool descriptions are written for the model and do not follow X-Nucleo-Language; Catalog tools are currently described in Italian. Catalog applies it only to its protocol errors (company, version, unknown tool, invalid arguments): the texts inside its tool results, domain errors and the permission_denied messages written by a tool are in Italian whatever the header.

    One ofenit
    default en
    Example: en
  • X-Nucleo-AI-Tools-Versionstring

    Contract version. Missing = 1. Any other value → 406.

    One of1
    default 1
    Example: 1
  • X-Nucleo-Request-Idstring

    Your id for the call (UUID recommended), echoed back and written in Nucleo's logs. Pattern ^[A-Za-z0-9._:-]{1,128}$, otherwise a new UUID is used.

    max length 128
    Example: 2f9c1e4a-7b3d-4c5e-9f8a-1b2c3d4e5f6a
  • X-Nucleo-Storestring

    Catalog only — id or slug of the catalog (store) to use within the company (ignored by other modules).

    Example: acme-eu
  • X-Nucleo-Clientstring

    Informational. Modules currently ignore this header; send context.client in the body for Brain's record trace.

    Example: acme-agent/1.4

Request bodyapplication/json

  • argumentsobject

    Tool arguments (if omitted, the root keys except context are used as arguments).

  • contextobject

    Optional, informational.

    Child attributes
    • clientobject
      Child attributes
      • namestring
      • versionstring
    • session_idstring

Responses

  • 200Tool result (success or domain error).
    Headers
    • X-Nucleo-Request-Id
    • contentarray of objectrequired
      Attributes of each item
      • typestringrequired
        One oftextresource_linkimage
      • textstring
        max length 50000
    • structuredContentobject
    • isErrorbooleanrequired
  • 400X-Nucleo-Company missing or not a positive integer.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 401Missing, expired or revoked token — or a token that is not from a self-registered client. Body: {"message":"Unauthenticated."}; Intelligence answers with application/problem+json.
    • messagestring
  • 403Permission denied for this tool, no access to the module in this company, or the company switched off its AI connector.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 404Unknown tool, or (Brain) a tool not visible to this person. Catalog answers a tool that exists but that the person may not use with 403 permission_denied.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 406Unknown contract version.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 409The person has access but the module is not set up yet for this company.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 422Arguments do not match the tool's input schema.
    • errorstring
      One ofcompany_requiredcompany_forbiddencompany_not_readyai_connector_disabledunsupported_versionunknown_toolpermission_deniedinvalid_arguments
    • messagestringrequired

      In the language of X-Nucleo-Language where translated.

    • permissionstring

      permission_denied only.

    • supportedarray of integer

      unsupported_version only.

    • errorsobject

      invalid_arguments on Commerce and Intelligence (standard validation shape).

    • detailsarray of object

      invalid_arguments on Brain and Catalog.

      Attributes of each item
      • fieldstring
      • errorstring
  • 429More than 120 requests per minute for this user on this endpoint. Default body; Intelligence answers with application/problem+json.
    Headers
    • Retry-After
    • X-RateLimit-Limit
    • X-RateLimit-Remaining
    • messagestring
Request
curl -X POST https://api-commerce.nucleoplatform.com/api/v1/ai-tools/search_orders \
  -H "Authorization: Bearer $NUCLEO_ACCESS_TOKEN" \
  -H 'X-Nucleo-Company: 7' \
  -H 'X-Nucleo-Language: en' \
  -H 'X-Nucleo-AI-Tools-Version: 1' \
  -H 'X-Nucleo-Request-Id: 2f9c1e4a-7b3d-4c5e-9f8a-1b2c3d4e5f6a' \
  -H 'X-Nucleo-Store: acme-eu' \
  -H 'X-Nucleo-Client: acme-agent/1.4' \
  -H 'Content-Type: application/json' \
  -d '{
  "arguments": {
    "query": "giulia.rossi@acme.example",
    "status": "shipped",
    "per_page": 5
  },
  "context": {
    "client": {
      "name": "acme-agent",
      "version": "1.4"
    }
  }
}'
Response
{
  "content": [
    {
      "type": "text",
      "text": "{\n    \"total\": 1,\n    \"orders\": [ { \"number\": \"#1042\", \"status\": \"shipped\" } ]\n}"
    }
  ],
  "structuredContent": {
    "total": 1,
    "orders": [
      {
        "number": "#1042",
        "status": "shipped",
        "customer": "Giulia Rossi",
        "total": "89.00 EUR",
        "url": "https://app.nucleoplatform.com/commerce/orders/1042"
      }
    ]
  },
  "isError": false
}
Was this page helpful?