# Build on Sumhour

Four ways in. Each acts as one person inside one workspace, never beyond that person's role, and only within the permissions they granted.

| You want to | Use |
|---|---|
| Let Claude, ChatGPT or Cursor log time, read reports and draft invoices | [MCP](/developers/mcp) |
| Script Sumhour from any language | [REST API](/developers/api) |
| Stay in the terminal | [Command line](/developers/cli) |
| React when something happens in Sumhour | [Webhooks](/developers/webhooks) |

## Quick start

1. In Sumhour, open your account menu, then **API tokens**, and make a token. Copy it; it is shown once.
2. Call the API:

```bash
export SUMHOUR_TOKEN=sh_pat_...
curl https://app.sumhour.com/api/v1/me -H "Authorization: Bearer $SUMHOUR_TOKEN"
```

3. Log an hour and a half:

```bash
curl -X POST https://app.sumhour.com/api/v1/entries \
  -H "Authorization: Bearer $SUMHOUR_TOKEN" -H "Content-Type: application/json" \
  -d '{"projectId":"<projectId from /projects>","duration":"1:30","notes":"Design review"}'
```

## Permissions

A token or an AI connection gets some of these. Presets on the tokens page: **Time tracking**, **Read only**, **Everything your role allows**.

| Permission | Lets it |
|---|---|
| `time:read` | See entries, the timer and timesheets |
| `time:write` | Log, change and delete time, run the timer, submit weeks |
| `projects:read` | See projects, tasks and clients |
| `projects:write` | Add clients and projects (admins and owners) |
| `expenses:read` | See expenses |
| `expenses:write` | Add expenses |
| `invoices:read` | See invoices |
| `invoices:write` | Draft invoices and record payments |
| `reports:read` | Run reports |
| `approvals:read` | See weeks waiting for review |
| `approvals:write` | Approve and send back weeks |
| `team:read` | See the people in the workspace |
| `events:write` | Send workspace events to apps such as Zapier (admins and owners) |

## Rules that always apply

- The workspace's own rules hold everywhere: locked and approved weeks do not change, required notes and tasks are required, contractors see only their projects.
- Every change is recorded in the Activity log with where it came from, for example *via API · Zapier* or *via MCP · Claude*.
- Removing someone from the workspace, or revoking a token or a connection, takes effect on the next request.

## This server

Everything on these pages points at **https://app.sumhour.com**. A self-hosted Sumhour serves the same pages with its own address.

- OpenAPI 3.1: [https://app.sumhour.com/api/v1/openapi.json](https://app.sumhour.com/api/v1/openapi.json)
- MCP endpoint: `https://app.sumhour.com/mcp`
- For AI agents: [llms.txt](https://app.sumhour.com/llms.txt) and [llms-full.txt](https://app.sumhour.com/llms-full.txt)