LinkDR MCP System API

openapi: 3.2.0
info:
  contact:
    email: support@linkdr.com
    name: LinkDR support
    url: https://linkdr.com/contact
  description: 'LinkDR is a managed backlink service: real publisher placements priced by Domain Rating (DR), ordered one-time or monthly, fulfilled in 3-4 weeks.


    Agents have three doors:


    1. Managed backlinks (no auth needed to plan): fetch https://linkdr.com/SKILL.md, plan the DR-tier mix from the budget, then send the user one https://linkdr.com/agent/checkout URL. The user logs in and pays in the browser; the user MCP can also charge a card already saved on the project, after the user confirms the quote.

    2. User MCP (any LinkDR account): https://linkdr.com/mcp over Streamable HTTP with OAuth 2.1. Your own projects, orders, outreach progress, live links, and AI answers, plus cache-first keyword SERPs and domain metrics. It can also add a site and its keywords, answer site approvals, quote and order links (a saved card is charged only after the user confirms; otherwise it returns the checkout link), and send feedback. Docs: https://linkdr.com/docs/mcp.

    3. Admin MCP (LinkDR admins only): https://linkdr.com/mcp/admin. The operator''s tools: every order and project, publisher outreach, customer emails, guest posts, and research with contacts. Other accounts complete OAuth and receive 403. Docs: https://linkdr.com/docs/admin.


    Machine-readable resources: this spec (https://linkdr.com/openapi.json), agent instructions (https://linkdr.com/llms.txt), the checkout skill (https://linkdr.com/SKILL.md), and docs (https://linkdr.com/docs).'
  termsOfService: https://linkdr.com/terms
  title: LinkDR System API
  version: 1.0.0
servers:
- description: Production
  url: https://linkdr.com
tags:
- description: Health and machine-readable metadata.
  name: System
paths:
  /api/health:
    get:
      description: 'Process liveness for Coolify and Docker. Returns 200 with { ok: true } when the Next.js process can serve a request. Does not probe Stripe, Resend, or the database. No authentication.'
      operationId: getHealth
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthStatus'
          description: Process is up
      summary: Check process liveness
      tags:
      - System
  /openapi.json:
    get:
      description: This document. Fetch it to discover the API surface programmatically.
      operationId: getOpenApiSpec
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
          description: OpenAPI 3.1 specification
      summary: Fetch this OpenAPI specification
      tags:
      - System
components:
  schemas:
    HealthStatus:
      properties:
        ok:
          type: boolean
      required:
      - ok
      type: object
  securitySchemes:
    McpOAuth:
      description: 'OAuth 2.1 authorization-code flow with PKCE (required) for both MCP servers. Authorization server metadata: https://linkdr.com/.well-known/oauth-authorization-server. Dynamic client registration is accepted. Each server is its own protected resource (https://linkdr.com/mcp and https://linkdr.com/mcp/admin), so a token is audience-bound to one of them. The admin server also requires the admin role on the LinkDR account.'
      flows:
        authorizationCode:
          authorizationUrl: /api/auth/oauth2/authorize
          refreshUrl: /api/auth/oauth2/token
          scopes:
            email: Identify the account by email address during sign-in
            offline_access: Receive a refresh token so long-running agent sessions stay connected until revoked
            openid: Sign in with a LinkDR account
            profile: Read the account display name
          tokenUrl: /api/auth/oauth2/token
      type: oauth2
    SessionCookie:
      description: Dashboard session cookie (better-auth.session_token) issued by browser sign-in. Endpoints under this scheme serve the logged-in app and its rate limits; there is no header-token alternative yet.
      in: cookie
      name: better-auth.session_token
      type: apiKey