Recipes

These recipes describe standard operational workflows using the orriven MCP server. Each recipe outlines an objective, a sample prompt, the corresponding tool execution sequence, and verification steps. Prerequisites: Active MCP connection and Owner or Admin role in the target Business Unit.

​

Provision environment API credentials

Objective: Provision a restricted publishable key for a frontend application and a secret key for backend services in a staging environment. Prompt:

Configure API credentials for the Spring Summit staging deployment at https://staging.summit.example in the Events Business Unit: a publishable key restricted to the domain origin and a secret key for backend services, both labeled “staging”.

Execution sequence:

1. Invoke list_workspaces to locate the workspaceId for the Events Business Unit.
2. Invoke create_publishable_key with workspaceId, label: "staging", and allowedOrigins: ["https://staging.summit.example"].
3. Invoke create_api_key with workspaceId and label: "staging".

Output & verification:

• Tool returns the publishable key token (opk_…) and the one-time secret key credential (osk_…).
• Verify via list_api_keys.
• Confirm creation events in the audit log, attributed to the authorizing user and marked via MCP.

​

Diagnose and remediate webhook failures

Objective: Identify failing webhook deliveries for an endpoint, inspect failure payloads, and replay missed events. Prompt:

Webhook notifications for attendee registrations in the Events Business Unit failed during the past 24 hours. Investigate failing endpoints, determine error causes, and replay undelivered events.

Execution sequence:

1. Invoke list_webhook_endpoints with workspaceId to review endpoint health, failure counts, and lastSuccessAt.
2. Invoke list_webhook_deliveries with workspaceId and endpointId to inspect delivery statuses, HTTP response codes, response bodies, and nextAttemptAt timestamps.
3. After resolving upstream receiver issues, invoke ping_webhook_endpoint to test connectivity.
4. Invoke resend_webhook_delivery for each failed delivery ID.

Output & verification:

• resend_webhook_delivery creates a new delivery attempt that preserves the original event identifier, allowing downstream receivers to maintain idempotency.

​

Incident response: Revoke compromised credentials

Objective: Immediately invalidate an exposed API key and audit recent request activity. Prompt:

API key ok_3f9a… was exposed in a public repository. Revoke this key immediately, generate a replacement secret key labeled “production-backend”, and audit all requests made using the compromised key over the past 24 hours.

Execution sequence:

1. Invoke revoke_api_key with workspaceId and apiKeyId. Revocation takes effect immediately and cannot be undone.
2. Invoke create_api_key with workspaceId and label: "production-backend" to issue a replacement credential.
3. Invoke list_api_request_logs filtered by apiKeyId and time range to review all requests, IP addresses, paths, and payload bodies processed by the exposed key.

Output & verification:

• Confirm the key status changes to revoked in list_api_keys.
• All subsequent HTTP requests presenting the revoked secret return 401 Unauthorized.

​

Investigate API errors and metrics

Objective: Filter request logs for 4xx and 5xx errors and analyze failure distributions over time. Prompt:

Investigate elevated 5xx error rates occurring on checkout API endpoints today. Identify affected routes, request payloads, and the timeline distribution of failures.

Execution sequence:

1. Invoke list_api_request_logs with workspaceId, status: "5xx", and path: "/v1/checkout" to retrieve recent failing requests.
2. Invoke get_api_request_log with workspaceId and logId to inspect complete request and response payloads, status codes, and error bodies.
3. Invoke get_api_metrics with workspaceId and days: 1 to retrieve error distributions across 48 time buckets.

Output & verification:

• Log entries display client IP, user agent, requested parameters, and upstream response messages.

​

Provision credentials for Developer API operations

Objective: Generate an API key through MCP and execute event operations via the Developer API. Prompt:

Create a secret API key labeled “automation” in the Events Business Unit, then retrieve remaining ticket capacity for all ticket types in the Spring Summit event.

Execution sequence:

1. MCP tool execution: Invoke create_api_key to obtain a scoped secret key (osk_…).
2. Developer API execution: Issue standard HTTP requests to https://openapi.orriven.com/v1:
   • GET /v1/events (locate target event ID)
   • GET /v1/events/{eventId}/ticket-types (retrieve capacity, confirmed counts, and remaining availability)
   • Requests include Authorization: Bearer osk_….