# Frontify

> Frontify is a brand management and digital asset management (DAM) platform: one governed home for brand guidelines, logos, images, video, templates and creative workflows. Its public developer surface is a per-instance GraphQL API, a hosted MCP server for AI assistants, a client-side Brand SDK (App Bridge, Finder, Uploader, CLI), and project-scoped webhooks.

Frontify does NOT publish an llms.txt of its own (https://developer.frontify.com/llms.txt returns the docs SPA HTML shell, and https://www.frontify.com/llms.txt returns 404). This file is generated by API Evangelist from the artifacts in this repository, all of which were probed or searched from Frontify's own public surfaces.

Key facts an agent should know before calling Frontify:

- The API is **GraphQL only**. There is no REST API and no OpenAPI document.
- The endpoint is **per-instance**: `https://{instance}.frontify.com/graphql`. POST only; GET returns 404.
- **Schema introspection is open and unauthenticated**; data resolution is not. An anonymous data query returns HTTP 200 with `errors[0].extensions.category = "permission"`.
- Pagination is **offset-based** (`limit`, `page`), not Relay cursors.
- There is **no idempotency key**. Retrying a create can duplicate. Use `Asset.externalId` + `Library.assetsByExternalId` as a dedupe handle.
- Query cost comes back as `extensions.complexityScore` on every response, but **no budget is published**.
- Validation errors collapse to a bare `"Invalid query"` (HTTP 422) with no field detail — validate against the schema locally first.

## Contract

- [GraphQL SDL](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/graphql/frontify.graphql): The live schema — 13 root queries, 57 root mutations, 308 types, 63 dated `@deprecated` fields.
- [GraphQL introspection JSON](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/graphql/frontify-introspection.json): The verbatim anonymous introspection response.
- [Schema manifest](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/graphql/frontify-graphql.yml): Endpoint pattern, counts, probes and ownership evidence.
- [Data model](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/data-model/frontify-data-model.yml): Account > Brand > Library/Workspace > Folder > Asset, with 29 derived relationships.

## Agent surfaces

- [MCP server](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/mcp/frontify-mcp.yml): Hosted at `https://mcp.frontify-integrations.com/mcp`, 54 tools in 10 role-scoped packs, OAuth (`mcp:tools`). Beta/experimental. Remote only — there is no stdio package.
- [Tool crosswalk](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/mcp/frontify-tool-crosswalk.yml): Each MCP tool bound to the GraphQL field that backs it, plus what each surface exposes that the other does not.
- [Agent Skills](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/skills/_index.yml): Frontify publishes its own curated Agent Skills catalogue at github.com/Frontify/skills.
- No A2A agent card is served on any Frontify host.

## Events

- [Webhook catalogue](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/asyncapi/frontify-webhooks.yml): 24 events (`AssetWebhookEvent`), project-scoped, signed with a per-webhook secret, two payload versions. No AsyncAPI document is published. No MCP tool can manage webhooks.

## Runtime semantics

- [Conventions](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/conventions/frontify-conventions.yml): Pagination, filtering, error envelope, tracing, permissions model.
- [Error catalogue](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/errors/frontify-error-catalog.yml): Probed error classes and the exact bodies returned.
- [Rate limits](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/rate-limits/frontify-rate-limits.yml): No published limits; `extensions.complexityScore` is the only signal.
- [Lifecycle](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/lifecycle/frontify-lifecycle.yml): Schema evolution, 63 dated deprecations, status page.

## Auth

- [Authentication](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/authentication/frontify-authentication.yml): Instance OAuth 2.0 authorization code, instance API tokens (Bearer), and the MCP server's own PKCE/DCR authorization server.
- [Scopes](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/scopes/frontify-scopes.yml): `basic:read`, `basic:write`, `account:read`, `blocks:read`, `webhooks:read`, `webhooks:write` on the instance; `mcp:tools` on the MCP server.
- [Well-known](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/well-known/frontify-well-known.yml): RFC 8414 and RFC 9728 metadata are served on the MCP host; nothing on the product hosts.

## Packages

- [Packages](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/packages/frontify-packages.yml): 12 first-party npm packages. All JavaScript/TypeScript, all client-side. No server SDK in any language.
- [CLI](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/cli/frontify-cli.yml): `@frontify/frontify-cli` — serve, build and deploy Content Blocks and Platform Apps.
- [Components](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/components/frontify-components.yml): App Bridge, Finder, Uploader, Fondue design system, Content Blocks.

## Trust and security

- [Trust center](https://trust.frontify.com/): SOC 2, ISO 27001 / 27017 / 27018, GDPR.
- [Security and vulnerability disclosure](https://www.frontify.com/en/security/): BugCrowd bug bounty and security@frontify.com. No security.txt is served.
- [Conformance](https://raw.githubusercontent.com/api-evangelist/frontify/refs/heads/main/conformance/frontify-conformance.yml): Standard-by-standard conformance with evidence.

## Human docs

- [Developer portal](https://developer.frontify.com/) — JS-rendered SPA; not machine-readable.
- [GraphQL reference](https://frontify.github.io/graphql-reference/) — Frontify's own generated schema reference.
- [Getting started with the GraphQL API](https://help.frontify.com/en/articles/5402357-getting-started-with-the-frontify-graphql-api)
- [Developer tools overview](https://help.frontify.com/en/articles/5402354-overview-of-frontify-developer-tools)
- [Changelog](https://developer.frontify.com/changelog)
- [Status](https://status.frontify.com/)
- [Pricing](https://www.frontify.com/en/pricing/) — no published tiers; MAU-based, contact sales.

## Optional

- [GitHub organization](https://github.com/Frontify)
- [MCP server repository](https://github.com/Frontify/mcp-servers)
- [Agent Skills repository](https://github.com/Frontify/skills)