Developers

Build on Who Sees What

Who Sees What Enterprise includes a REST API and a hosted MCP server. Both run the same audit operations the app uses, scoped to your connected org. Create your own credential in the app and send it as a Bearer token; no sales call is needed.

For AI agents MCP server

A hosted MCP server lets your own AI agent, such as Claude, run audits and export reports as tools.

MCP reference › For your systems and scripts REST API

A REST API runs the same audit operations the app uses, scoped to your org, so your own systems and scripts can run audits and export reports.

API reference ›

What you can build

Access checks in your pipeline. Call the REST API from CI/CD to confirm who can see a sensitive object or field before a change ships.
Agent-driven audits. Let an AI agent run an audit template and read back the findings over MCP.
Exports for evidence. Export any question's report as CSV, XLSX, PDF, or JSON over the REST API or the MCP whoseeswhat_export_report tool.

Access and tiers

REST API and MCP access are a Who Sees What Enterprise capability. Professional does not include API or MCP access: the same organization-menu item shows a locked preview that points to the plans page. Every call runs within the connected org's own Salesforce access, so an agent or script can see only what the audit engine itself can see.

To get a credential, open the organization menu in the app and choose API access. Questions about the API or MCP server? Contact us.