Amplitude MCP API

openapi: 3.2.0
info:
  title: Amplitude Public MCP API
  version: '2026-10-05'
  summary: Event ingestion, analytics, taxonomy, export, async DSAR jobs, and agent-readable site content APIs for Amplitude.
  description: 'Amplitude is a digital analytics platform covering product analytics, experimentation, session replay, web analytics, and CDP capabilities.


    This document describes the public HTTP surface most useful to programmatic clients and AI agents:


    - **Ingestion** (`api2.amplitude.com`) — send events. Authenticated with a project API key in the request body.

    - **Analytics, Taxonomy, Export, Cohorts** (`amplitude.com/api`) — read and manage project data. Authenticated with HTTP Basic using a project API key and secret key.

    - **DSAR** (`amplitude.com/api/2/dsar`) — export a user’s data. Authenticated with HTTP Basic using the organization API key and organization secret key, not project credentials.

    - **Site content** (`amplitude.com`) — Markdown and index representations of amplitude.com pages, for retrieval-augmented and agent use.


    For conversational access to Amplitude data, prefer the Amplitude MCP server (`https://mcp.amplitude.com/mcp`, OAuth 2.0) over these REST APIs. For public documentation, use the read-only Docs MCP server (`https://amplitude.com/docs/api/mcp`).


    The full catalog of Amplitude’s agent-callable resources is published at https://amplitude.com/.well-known/ai-catalog.json.


    Endpoint coverage here is deliberately limited to documented, stable endpoints. See https://amplitude.com/docs/apis for the complete reference, including the Experiment, Attribution, Lookup Table, and User Privacy APIs.'
  termsOfService: https://amplitude.com/terms
  contact:
    name: Amplitude Support
    url: https://amplitude.com/support
  license:
    name: Amplitude Terms of Service
    url: https://amplitude.com/terms
servers:
- url: https://amplitude.com
  description: Analytics REST host (default / US data residency)
- url: https://analytics.eu.amplitude.com
  description: Analytics REST host (EU data residency)
tags:
- name: MCP
  description: Model Context Protocol endpoint. Preferred over the REST endpoints for conversational and agent access, because it carries per-user OAuth scopes rather than a project-wide key pair.
  externalDocs:
    url: https://amplitude.com/docs/amplitude-ai/amplitude-mcp
paths:
  /mcp:
    servers:
    - url: https://mcp.amplitude.com
      description: MCP host (default / US data residency)
    - url: https://mcp.eu.amplitude.com
      description: MCP host (EU data residency)
    post:
      tags:
      - MCP
      operationId: callMcpServer
      summary: Amplitude MCP server (Streamable HTTP)
      description: 'JSON-RPC 2.0 over Streamable HTTP, per the Model Context Protocol specification. Described here so the OAuth scopes an agent needs are discoverable from this document; the request and response bodies are defined by MCP, not by Amplitude.


        Do not hardcode tool names — call `tools/list` and read the definitions the server returns at runtime.


        `mcp:read` is sufficient for read-only tools. Tools that create or modify dashboards, notebooks, experiments, cohorts, or metrics additionally require `mcp:write`.'
      security:
      - mcpOAuth:
        - mcp:read
      - mcpOAuth:
        - mcp:write
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              description: A JSON-RPC 2.0 request as defined by MCP.
            example:
              jsonrpc: '2.0'
              id: 1
              method: tools/list
      responses:
        '200':
          description: JSON-RPC result, or an SSE stream when the client accepts `text/event-stream`.
          content:
            application/json:
              schema:
                type: object
            text/event-stream:
              schema:
                type: string
        '401':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing, expired, or revoked access token. The `WWW-Authenticate` header carries the protected resource metadata URL. Refresh once; if that fails, restart the authorization code flow.
          headers:
            WWW-Authenticate:
              description: Bearer challenge carrying `resource_metadata`, per RFC 9728.
              schema:
                type: string
        '403':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The token is valid but lacks the scope for this tool, or the underlying Amplitude user lacks permission on the target resource.
components:
  schemas:
    ApiError:
      type:
      - object
      - string
      description: Shared description of existing error bodies, not a new wire envelope. JSON APIs may return optional code/error fields or an errors array; other endpoints return text or Markdown. Fields are optional and clients must use the HTTP status and Content-Type. Endpoint-specific details may be present.
      properties:
        code:
          type: integer
          description: HTTP status code, repeated in the body.
        error:
          type: string
          description: Human-readable error description.
          examples:
          - Invalid request path
          - Missing request body
          - Invalid JSON request body
          - Request missing required field
          - Invalid event JSON
          - Invalid API key
          - Invalid field values on some events
        missing_field:
          type: string
          description: Request-level required field that is missing.
        events_with_invalid_fields:
          type: object
          description: Maps field names to the indexes of the events that failed validation.
        events_with_missing_fields:
          type: object
          description: Maps field names to the indexes of the events missing them.
        eps_threshold:
          type: integer
          description: Current events-per-second threshold for the project.
        throttled_devices:
          type: object
          description: Maps device IDs to their current events-per-second rate.
        throttled_events:
          type: array
          items:
            type: integer
          description: Indexes of events that were throttled.
        silenced_devices:
          type: array
          items:
            type: string
          description: Device IDs Amplitude has silenced.
        silenced_events:
          type: array
          items:
            type: integer
          description: Indexes of events whose device was silenced.
        exceeded_daily_quota_devices:
          type: object
          description: Maps device or user IDs to their daily event count, for those over quota.
        errors:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
            additionalProperties: true
          description: Taxonomy API error details.
      additionalProperties: true
  securitySchemes:
    orgApiKeyAndSecretKey:
      type: http
      scheme: basic
      description: DSAR uses HTTP Basic with the org API key and org secret key, as documented in the DSAR request examples.
    apiKeyAndSecretKey:
      type: http
      scheme: basic
      description: 'HTTP Basic authentication. Username is the project API key, password is the project secret key. Both are found in Amplitude under Settings → Projects → General. Credentials must be base64 encoded.


        This scheme is project-scoped and all-or-nothing: a key pair grants every operation on its project. There is no narrower grant. When an agent needs least-privilege access, prefer the MCP server and its `mcpOAuth` scopes over these keys.'
    mcpOAuth:
      type: oauth2
      description: 'OAuth 2.1 authorization code flow with PKCE, used by the Amplitude MCP server at `https://mcp.amplitude.com/mcp`.


        Endpoints and scopes here mirror the authorization server metadata at https://mcp.amplitude.com/.well-known/oauth-authorization-server, which is authoritative. Clients may be registered dynamically (RFC 7591) at `https://mcp.amplitude.com/register`; public clients are supported.


        Scopes bound the token but do not widen it — every call is additionally enforced against the permissions of the Amplitude user who approved the grant. Request the narrowest scope that covers the task.


        For EU data residency, substitute `https://mcp.eu.amplitude.com`.'
      flows:
        authorizationCode:
          authorizationUrl: https://mcp.amplitude.com/authorize
          tokenUrl: https://mcp.amplitude.com/token
          refreshUrl: https://mcp.amplitude.com/token
          scopes:
            mcp:read: Read charts, dashboards, cohorts, experiments, feature flags, events, properties, and session replays.
            mcp:write: Create and modify dashboards, notebooks, experiments, cohorts, and metrics.
            offline_access: Issue a refresh token so the agent can act after the user closes the browser. Omit for one-shot interactive tasks.
externalDocs:
  description: Amplitude API reference
  url: https://amplitude.com/docs/apis
x-api-versioning:
  scheme: per-api-path
  documentVersionScheme: date
  description: API families use independent path namespaces (for example /2/httpapi, /api/2/dsar and /api/5/cohorts). Batch and site-content paths are unversioned. The namespace number is not a shared release number or a semantic-version guarantee.
  deprecationPolicy:
    status: not-verified
    description: No company-wide REST retirement notice period or sunset dates are asserted by this document. SDK maintenance policy does not establish REST API lifecycle policy.