Anything the pages can show, the API can answer.

A JSON API mirroring the app's capabilities one to one — the close, transactions with the same filters and the same filtered totals, one line and its provenance, accounts, sync history, rules and exceptions; and the same three writes the pages have — categorise, adjudicate, run the rules — with a JSON body under a read-write token. The public data API is in build now.

Access rides personal access tokens — minted on your Settings page, one year, read-only or read-write, revoked there and refused on the next call — under the same per-tenant entitlements as everything else. The web tier holds no privileged second path — an API that can see more than its tenant is a disclosure letter waiting for a date — so the API's answers are the app's answers, by construction.

The categoriser, the rules engine, and sync status all surface through it as they land; the MCP face is the same surface with a different handshake.