generated: '2026-07-25' method: derived status: candidate published: false source: openapi/whitespace-london-platform-openapi.yml searched: - https://apidocs.whitespace.co.uk/ (no MCP, agent or AI integration page) - https://www.whitespace.co.uk/integration/ (queues + REST only) - https://github.com/whitespace-software (11 public repos, none MCP-related) - npm @modelcontextprotocol scope and the public MCP registry (no Whitespace server) server: name: whitespace-platform transport: http url: null auth: >- HTTP bearer JWT service token issued out of band by Whitespace Support and restricted to allowlisted IPs — see authentication/whitespace-london-authentication.yml. Any MCP server would have to carry a per-organisation service token; there is no self-serve credential. notes: >- Whitespace publishes NO Model Context Protocol server. This file is an API Evangelist CANDIDATE tool projection over the published OpenAPI — a design for what an agent surface on the Whitespace Platform API would look like, grounded operation-by-operation in the real spec. Every source_operation below is a verbatim method + path from openapi/whitespace-london-platform-openapi.yml; the specification declares no operationIds, so operations are addressed by method and path (see overlays/ for the operationIds API Evangelist assigns). Tool inputs are the real path/query parameters and request bodies of those operations. Agent risk classification per operation lives in agentic-access/whitespace-london-agentic-access.yml — note that most write operations here are legally consequential acts in a subscription insurance market (binding cover, signing a contract), which is why they are modelled as high-consequence. tools: - name: whoami description: Get the calling user, their organisation, teams and channels. source_operation: GET /api/user/myDetails category: identity - name: list_risk_summaries description: >- List batches of risk summaries the caller can see; optionally filtered by an updated-since date or a POST filter payload. source_operation: GET /api/summary alternate_operation: POST /api/summary category: discovery inputs: [from] - name: get_risk description: Get a risk in JMRC (JSON Market Reform Contract) format. source_operation: GET /api/risks/{riskID} category: contract - name: get_extended_mrc description: >- Get the extended state of a risk — contract, questionnaire, written line sets, signed line sets, endorsement followers and provenance. source_operation: GET /api/risks/{riskID}/getExtendedMRC category: contract - name: list_risk_documents description: List every document associated with a root risk. source_operation: GET /api/risks/root/{rootID} category: contract - name: get_related_documents description: Return documents of a given type (e.g. RWComment) for a risk. source_operation: GET /api/risks/{rootID}/related/{type} category: contract - name: get_defined_data description: Get all tagged contract data for a risk using the default Whitespace tagset. source_operation: GET /api/v23.09/data/{riskID} category: data - name: get_defined_data_by_tagset description: >- Get tagged contract data using an alternative tagset — currently ACORDGPM, the ACORD Global Reinsurance and Large Commercial tag family. source_operation: GET /api/v23.09/data/{riskID}/tagset/{tagset} category: data - name: verify_defined_data description: >- Validate a Defined Data payload before writing it. Whitespace recommends calling this first because an unacceptable payload returns 500 on the write. source_operation: POST /api/v23.09/data/{riskID}/verify category: data - name: set_defined_data description: Write tagged contract data to a risk through the Defined Data system. source_operation: POST /api/v23.09/data/{riskID} category: data consequence: write - name: get_activity_history description: Get the full time-stamped history of everything that has happened to a root risk. source_operation: GET /api/activities/{rootID}/full category: audit - name: filter_activities description: >- Fetch all activity visible to the user matching a specific activity type and optional date range. Requires exactly one activity string; call the help endpoint for the vocabulary. source_operation: POST /api/activities/filter helper_operation: GET /api/activities/filter/help category: audit - name: list_mrc_headings description: Get the enumerated list of Market Reform Contract headings. source_operation: GET /api/lookup/headings category: reference - name: check_mrc_heading description: Check whether a line-item heading maps to one of the enumerated MRC headings. source_operation: GET /api/lookup/check/{heading} category: reference - name: list_corporates description: >- List every organisation on the platform with its teams, users and channels — the directory used to resolve companyIDs, teamIDs and SUMO UserIDs. source_operation: GET /api/shared/corporate category: reference - name: list_attachments description: Get metadata for all attachments available on a risk. source_operation: GET /api/attachments/{rootID} category: documents - name: get_document description: Fetch any platform document the caller is allowed to see, by document ID. source_operation: GET /api/documents/{docID} category: documents - name: export_contract_pdf description: Return a PDF of the risk contract. source_operation: POST /export/pdf/{riskID} category: documents - name: create_draft_risk description: Create a draft risk using the simplified input format. Broker only. source_operation: POST /api/risks/newDraft category: placing consequence: write - name: show_to_lead_underwriter description: Show a draft risk to an underwriter for quoting. Broker only. source_operation: POST /api/risks/{riskID}/showToLeadUnderwriter category: placing consequence: market-facing - name: quote_on_request description: Send a quote back to the broker without altering the quote request. Underwriter only. source_operation: POST /api/risks/{riskID}/quoteOnRequest category: quote consequence: market-facing - name: get_quote_details description: Return the information the underwriter entered in the Quote Details pane. source_operation: GET /api/risks/{riskID}/getQuoteDetails category: quote - name: decline_quote_request description: Decline a quote request. Underwriter only. source_operation: POST /api/risks/{riskID}/declineQuoteRequest category: quote consequence: market-facing - name: mark_as_firm_order description: Convert a quoted risk into a firm order. Broker only. source_operation: POST /api/risks/{riskID}/markAsFirmOrder category: bind consequence: binding - name: request_written_line_sets description: Send a firm order or bindable quote to a carrier for a written line. Broker only. source_operation: POST /api/risks/{riskID}/requestWrittenLineSets category: bind consequence: binding - name: write_line description: >- Write a line to the risk — the underwriter's binding commitment to insure a percentage of the contract. Underwriter only. source_operation: POST /api/risks/{riskID}/writeLine category: bind consequence: binding - name: sign_sets description: >- Sign the written lines on a firm order, promoting the risk to signed status. Broker only. This finalises the contract. source_operation: POST /api/risks/{riskID}/signSets category: bind consequence: binding - name: create_endorsement description: Create an endorsement to a firm order or signed contract. Broker only. source_operation: POST /api/risks/{riskID}/createEndorsement category: endorsement consequence: write - name: accept_endorsement description: Accept an endorsement as an underwriter. Underwriter only. source_operation: POST /api/risks/{EndorsementID}/acceptEndorsement category: endorsement consequence: binding - name: complete_endorsement description: Complete an endorsement and bind any notify parties to it. Broker only. source_operation: POST /api/risks/{riskID}/completeEndorsement category: endorsement consequence: binding coverage: rest_operations_total: 121 tools_projected: 30 note: >- A deliberate subset covering identity, discovery, contract read, Defined Data, audit, reference lookup, documents and the placing lifecycle. The remaining operations (label management, questionnaire editing, facility and declaration handling, contract corrections, off-platform lines, MI reporting) are catalogued in the OpenAPI and could be projected the same way. event_surface: note: >- An MCP server for Whitespace would be incomplete without the queue surface — integrations are typically initiated from the Azure Service Bus activity queue rather than by polling REST. See asyncapi/whitespace-london-queues-asyncapi.yml.