register_and_provision
Create/reuse an account and the first tracking container in one agent-safe call. For brand-new emails: the API creates the account, immediately emails the user a welcome / set-password link, and returns a 60-minute JWT in data.auth._sensitive_access_token so this agent can continue applying snippets and verifying events without further authentication. Hold the JWT only for this conversation and pass it back as auth_token on subsequent onboarding tool calls. After the user clicks the welcome email link, they finish setup and log into the dashboard.
The response carries two informational flags for fresh registrations: pending_user_activation: true and welcome_email_sent_to: <email>. Surface the inbox-check instruction to the user verbatim when these are present.
PROACTIVE auth_token: If you ALREADY have an auth_token (the user is signed in, or a previous turn returned one), pass it INSTEAD of email. With auth_token the call returns the existing-or-new container for that (user, website_url) pair — no duplicate_account error occurs. Do NOT pass name or email alongside auth_token; the server reads identity from the JWT.
RECOVERY on duplicate_account (HTTP 409): the user already has a Tracklution account. Ask them to log in at https://app.tracklution.com (or request a fresh setup link at https://app.tracklution.com/account-recovery if they never finished the welcome flow), then re-run this tool with auth_token in memory.
RECOVERY on multi_client_ambiguous (HTTP 409): the JWT-authed user has multiple companies (clients) and the requested website_url does not match any existing container. The server cannot pick a company on the user's behalf. Surface next_action.reason verbatim (it contains a dashboard URL) and EXIT — do NOT call any other MCP tool. The user finishes the container creation from their dashboard, then re-runs this tool with the same website_url, which returns the container created there.
PERMISSIONS: for a signed-in user, creating a NEW container under an existing company requires admin permission on that company (insufficient_permissions, details.required_permission = "admin"); re-running for a website that already has a container under one of the user's companies returns that container when the user has view permission or higher on it (details.required_permission = "view" otherwise). In both denials, surface errors[0].message verbatim and stop.
MULTI-SERVER SESSIONS: in a session connected to several servers the returned next_action.args.server_name names the server this container was created on; pass the returned next_action back verbatim.
RECOVERY on rate_limited (HTTP 429): respect retry_after_seconds strictly. Never retry without backoff. If errors[0].details.key mentions domain:<host>, the cap is per-website-domain — a different email will NOT bypass it.
The MCP server does NOT generate idempotency keys — the agent MUST supply idempotency_key (UUID v7 recommended). Every response includes _request_id in structuredContent.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| goal | No | ||
| name | No | ||
| No | |||
| phone | No | ||
| company | No | ||
| dry_run | No | ||
| framework | Yes | ||
| auth_token | No | SENSITIVE: existing-user path. JWT held by the agent in memory; passes to /mcp-api/v1/* as Authorization: Bearer. | |
| heard_from | No | ||
| website_url | Yes | ||
| agent_client | Yes | ||
| idempotency_key | Yes | UUID v7 recommended. Required. | |
| event_source_system | No | ||
| onboarding_session_id | No | ||
| onboarding_session_token | No | SENSITIVE: required when onboarding_session_id is supplied and the session has no user yet. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| field | No | ||
| errors | No | ||
| status | No | ||
| details | No | ||
| warnings | No | ||
| rate_limit | No | ||
| _request_id | No | ||
| http_status | No | ||
| next_action | No |