Frequently asked questions

Two products, each with two ways in. Signal is the CRM and GPS is the business operating system. Each has a REST API with webhooks for code you write, and an MCP connector for AI assistants. See Use cases.

Use the REST API when your own code or an automation tool makes the calls. Use the MCP connector when a person works in Signal or GPS from an AI assistant such as Claude or ChatGPT. The API signs in with a key and acts as the workspace or organization. The connector signs each person in and acts as them.

MCP is the open standard AI assistants use to connect to business apps. Signal and GPS each run an MCP connector, so an assistant can read your records and, if you allow it, make changes.

The Signal quickstart takes about five minutes: create a key, call GET /me, then create an Account. To connect an assistant instead, see Connecting your assistant.

The GPS quickstart takes about five minutes: create a key, list your Goals, then record a check-in. To connect an assistant instead, see Connecting your assistant.

Yes, one for each API. Download them from the Signal API explorer and the GPS API explorer, or browse every endpoint there.

Yes. Every page is also available as Markdown: swap .html for .md in the address. There's an index of every page at /llms.txt.

Not yet. Build against your own workspace or organization. Start with a read-only key, and use test records you can delete afterwards.

In Signal, open Autopilot, select the Webhooks & API tab, then API Keys and New Key. Name it, tick the scopes it needs and copy the key. Signal shows the full key only once. See Signal authentication.

In GPS, open Settings → Developer → Keys & Webhooks and select New API Key. Copy both the API key and the secret. The secret is shown only once. You need the Owner, Super Admin or Admin role. See GPS authentication.

Signal: send Authorization: Bearer YOUR_API_KEY, or the same key in an X-API-Key header. GPS: send two headers, X-API-Key and X-API-Secret.

A Signal key starts with sk_live_. A GPS key starts with emp_ and comes with a separate secret.

No. Signal keeps only a hash of the key, and GPS keeps only a hash of the secret. Create a new key and revoke the old one.

Signal keys don't expire. They work until you revoke them. A GPS key can have an optional expiry date, set when you create it.

A scope limits what a key can do, such as deals:read or goals:write. Give each key only the scopes its job needs. A request outside a key's scopes answers 403 INSUFFICIENT_SCOPE.

A Signal key stands for the workspace, not a person, so records it creates have no owner unless you send owner_id. A GPS key attributes records to the member who created the key, unless you send onBehalfOf with another member's ID.

No. A key reads and writes only the workspace or organization it was created in.

Keep keys on your server. A key in browser code can be read by anyone who opens the page.

Signal: https://crm.empiraa.app/api/v1. GPS: https://plan.empiraa.app/api/v1.

JSON over HTTPS. Send Content-Type: application/json on requests with a body. Successful responses put the result under data.

They're separate products with their own APIs. Signal uses snake_case field names. GPS uses camelCase. Each API's conventions page has the details.

Most lists use a cursor. Ask for up to 100 records with limit, and when meta.hasMore is true, pass meta.cursor back as cursor for the next page. Prospect Companies use limit and offset instead. See Signal conventions.

Every list takes limit (up to 200) and offset. meta.total tells you how many records match. See GPS conventions.

Signal lists take exact-match filters and have a fixed order, newest first unless a page says otherwise. There's no free-text search or sort parameter. GPS lists take filters, and you sort on your side.

Use PATCH and send only that field. Fields you leave out keep their values.

Timestamps are ISO 8601 in UTC. Signal amounts are numbers in the workspace's currency, which GET /me returns.

In Signal, yes, on prospect contacts, developments and plots. Send them in a custom_fields object keyed by each field's internal name. See Custom fields.

Signal uses the problem details format with a stable code, such as NOT_FOUND. GPS returns error, code and, for validation failures, an issues array naming each field. In both, build your handling on code, not on the message text.

The record is probably in another workspace or organization. Both APIs answer 404 for those, the same as for an ID that doesn't exist. In GPS, archived Goals, Objectives and Meetings also answer 404.

GPS allows 100 requests a minute for each API key. Past that it answers 429 with a Retry-After header. Signal allows 1,000 requests a minute for each API key and answers the same way. See Signal rate limits and GPS rate limits.

Wait for the number of seconds in Retry-After, then try again.

In Signal, send an Idempotency-Key header on creates. Retries with the same key create the record only once. GPS doesn't support idempotency keys, so before retrying a create, list the records to check whether the first attempt landed.

POST /prospects in Signal matches on email. Sending the same person twice updates them instead of creating a duplicate.

No. Deleting through the API is permanent.

The version is in the path (/api/v1). New fields can be added at any time, so ignore fields you don't recognize. Each connector also has a changelog and a versioning page.

They let Signal or GPS tell your systems the moment something changes, so you don't have to poll. See Signal webhooks and GPS webhooks.

Check the signature. Every delivery carries X-Empiraa-Signature, an HMAC-SHA256 made with your webhook's signing secret. Each webhooks page has a working example.

No. Signal signs the timestamp and the raw body joined with a period. GPS signs the raw body only. Use each product's own example.

Within 10 seconds for Signal. Return a 2xx as soon as you've verified and stored the event, then do the work in the background.

GPS makes up to 3 attempts for each event, then drops it. For Signal, see Delivery, timeouts and retries.

Yes. Record each event's ID and ignore repeats.

Yes. Use the catch-hook URL your tool gives you as the webhook's address. See REST API and automation tools.

Claude and ChatGPT, plus any MCP client that supports remote servers with OAuth sign-in, such as Claude Code, Cursor and VS Code with GitHub Copilot.

No. Each person signs in with their own Signal or GPS account and approves the connection.

Signal: https://crm.empiraa.app/mcp. GPS: https://plan.empiraa.app/mcp.

About a minute for each product. See the Claude and ChatGPT guides.

Yes. Turn both on and the assistant can use them together, for example to take sales figures from Signal into a check-in in GPS.

View only lets the assistant read what you can see. View and make changes also lets it create and update records, as you. You choose when you approve the connection.

A Grok bot built on the xAI API can use the REST API through function calling, or the connector with a token your app holds. See Grok bots.

Yes. OpenClaw supports remote MCP servers with OAuth sign-in. See OpenClaw bots.

Yes. The Prompt library has copy-and-paste prompts for both products.

The Signal tool reference has 51 tools and the GPS tool reference has 110.

An access token lasts 1 hour. A refresh token lasts 30 days without use, and each use restarts the 30 days.

Refresh tokens rotate. Each refresh returns a new access token and a new refresh token, and the old refresh token stops working. This limits the damage if a token is ever stolen.

No. The connector is stateless, so one access token works for any number of calls and sessions until it expires. Refresh only when it's about to expire, or after a 401.

Don't pass tokens in environment variables, because a process reads those only at start. Keep the tokens in one store owned by a small broker, and have each agent ask it for the current access token at call time. See Headless agents and token refresh.

They're probably both refreshing. The second one presents a refresh token that has already been rotated, and outside a 30-second window that's treated as theft, so the connection is revoked. Let one process own the refresh.

Retry with the same refresh token within 30 seconds, from the same client. You get a fresh pair.

No. The connector accepts OAuth access tokens only. For unattended jobs that do a set thing, use the REST API with an API key.

Signal and GPS pause a connection that makes an unusual number of changes or errors, in case it's stuck in a loop. Select Resume beside it in your connected apps.

No. It works as the person who connected it and sees only what their role lets them see.

In Signal, no. It can undo its own changes. In GPS, no, except removing an empty position from your org chart.

Changes are shown first. In Signal, every change is previewed as a card and your assistant app asks before applying it. In GPS, batches are previewed first.

Usually, within 7 days. Some changes can't be undone, and they say so up front. See Signal safety and GPS safety.

Signal's connector never emails anyone but the person who connected it. It drafts, and sending stays with people in Signal. In GPS, five tools reach people by email or calendar invite, and each says so in its description.

Signal records every change in Settings › AI activity. GPS labels each change with the app, such as "via Claude", and lists them in Connected apps.

Yes. Admins can turn assistants off for a whole Signal workspace or GPS organization, or limit them to View only. See Signal admin controls and GPS admin controls.

Signal: Settings › Integrations › AI assistants. GPS: Settings › Profile › Connected apps. Select Disconnect. Changing your password also disconnects every app.

In Signal, text that came from a record, an email or a Form reaches the assistant marked as untrusted data, so it can be told apart from your own requests. See Signal safety.

No. GPS receives only the name of each tool your assistant calls and the arguments it sends. What it returns goes to your assistant's provider, under your agreement with them. See GPS data and privacy.

No. Empiraa doesn't use the data an assistant reads or writes through the Signal or GPS connector to train AI models. Your assistant provider (for example Anthropic or OpenAI) has its own data terms for what the assistant sees, so check those too.

Signal stores only a hash of each API key. GPS stores only a one-way hash of each key's secret, and only a hash of each connector access token.

No. The connector is included on every Signal plan and every GPS plan. Each person also needs their own plan with their assistant app, for example Claude or ChatGPT.

No. API access is included on every Signal plan and every GPS plan.

Email team@empiraa.com. Say which product, which endpoint or tool, and what came back.

Email team@empiraa.com with the page and what's wrong.