Use Accessio.AI from the OpenAI API

Accessio.AI exposes a public REST API at https://api.accessio.ai/v1. You can call it directly, or let GPT models invoke it for you via OpenAI's Responses API — it accepts MCP servers as a tool type and routes tool calls over the same JSON-RPC transport Claude uses.

This page covers the programmatic (Bearer) flow. For the ChatGPT consumer connector (OAuth) flow, see the ChatGPT Apps guide (coming with Phase 2).

1. Create a service-account API key

In the dashboard, go to Settings → Developers → API keys, create a new key, and grant the scopes you need:

Keys are hashed at rest; the plaintext is shown once. Store it in your secret manager as ACCESSIO_API_KEY.

2. Call the REST API directly

curl -H "X-API-Key: $ACCESSIO_API_KEY" \
     "https://api.accessio.ai/v1/scans?limit=20"

Every response carries disclaimer, scanSchemaVersion, and an X-Request-Id header — see the Claude API guide for the full envelope.

3. Let GPT call the API for you

OpenAI's Responses API accepts an MCP server in tools. Your Accessio.AI key goes in the Authorization header that the Responses API forwards to our MCP transport.

Python (openai >= 1.x)

from openai import OpenAI
import os
 
client = OpenAI()
 
response = client.responses.create(
    model="gpt-5",
    tools=[
        {
            "type": "mcp",
            "server_label": "accessio",
            "server_url": "https://mcp.accessio.ai/mcp",
            "headers": {
                "Authorization": f"Bearer {os.environ['ACCESSIO_API_KEY']}"
            },
            "require_approval": "never"
        }
    ],
    input="List our 10 most recent accessibility scans and summarise the critical issues."
)
 
print(response.output_text)

require_approval: "never" lets GPT call read-only tools without prompting the user. For the three step-up tools (run_scan, approve_alt_text, reject_alt_text) we recommend "always" or a per-tool allow-list — these mutate merchant data.

TypeScript / Node

import OpenAI from 'openai';
 
const client = new OpenAI();
 
const response = await client.responses.create({
  model: 'gpt-5',
  tools: [
    {
      type: 'mcp',
      server_label: 'accessio',
      server_url: 'https://mcp.accessio.ai/mcp',
      headers: {
        Authorization: `Bearer ${process.env.ACCESSIO_API_KEY}`
      },
      require_approval: 'never'
    }
  ],
  input:
    'List our 10 most recent accessibility scans and summarise the critical issues.'
});
 
console.log(response.output_text);

curl

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"model\": \"gpt-5\",
    \"tools\": [{
      \"type\": \"mcp\",
      \"server_label\": \"accessio\",
      \"server_url\": \"https://mcp.accessio.ai/mcp\",
      \"headers\": { \"Authorization\": \"Bearer $ACCESSIO_API_KEY\" },
      \"require_approval\": \"never\"
    }],
    \"input\": \"List our 10 most recent accessibility scans and summarise the critical issues.\"
  }"

Tool surface (admin tier, Phase 1):

• list_scans, get_scan, run_scan
• list_alt_text, approve_alt_text, reject_alt_text
• get_quota, list_embed_scripts

Each tool requires the scope shown in the .well-known/mcp.json server card at mcp.accessio.ai/.well-known/mcp.json.

4. Approval policy for write tools

The Responses API's require_approval field (per-tool or global) is your friend for any operation that mutates merchant data. We recommend:

tools=[{
    "type": "mcp",
    "server_label": "accessio",
    "server_url": "https://mcp.accessio.ai/mcp",
    "headers": {"Authorization": f"Bearer {os.environ['ACCESSIO_API_KEY']}"},
    "require_approval": {
        "never": {"tool_names": ["list_scans", "get_scan", "list_alt_text", "list_embed_scripts", "get_quota"]},
        "always": {"tool_names": ["run_scan", "approve_alt_text", "reject_alt_text"]}
    }
}]

Reads run silently; writes prompt the user (or your own backend) for explicit approval before executing.

5. Security notes

⚠️ Never paste your API key into a chat prompt. Keys go in environment variables on your server, in CI secrets, or in a secret manager. A key dropped into a ChatGPT or GPT-API conversation may be logged, cached, or trained on — treat it as leaked the moment it reaches a prompt.

• Server-to-server secret. The headers.Authorization value is forwarded by OpenAI to our MCP transport — never expose it to a browser. Use a backend proxy if your frontend needs scan data.
• Rotate on leak. Revoke in the dashboard; we support a 30-day dual-active window so rotation does not break live agent sessions.
• Scope narrowly. Keys issued with only scans:read cannot invoke writes, even if a model is tricked by a prompt-injected product title.
• Rate limited. Each key is capped at 60 requests / minute per tool in v1 (Phase 2 raises this and adds per-tool weights). Watch for 429 Rate limit exceeded and back off using the Retry-After header.
• IP privacy. We coarsen client IPs (IPv4 → /24, IPv6 → /48) before they land in the audit log.
• Audit log. Every tool call writes a Node-side row plus a paired Java-side row joined by requestId. Raw arguments are never stored; only a SHA-256 hash. Default retention is 24 months.
• Deprecation. When a route is scheduled for retirement we set Deprecation, Sunset, and Link: rel="successor-version" response headers per RFC 8594. Agents that cache responses must honour these.

6. Differences from the Claude API path

If you've already wired Accessio.AI into Anthropic's Messages API, the OpenAI Responses API integration is a drop-in:

The MCP server itself is the same https://mcp.accessio.ai/mcp for both — there's nothing Accessio-specific you need to swap.

OpenAPI spec

• Machine-readable: api.accessio.ai/v1/openapi.json
• Interactive explorer: api.accessio.ai