Tenderen API and MCP connector

• Search tenders and read their documents and extracted requirements
• Manage saved tenders, bids, alerts, teams and consortiums
• Upload and download documents in your library
• Run AI analysis, match scoring and gap analysis
• Read market data: statistics, contract awards and competitors
• Generate an ESPD response and a compliance matrix

1. Make sure your company is on the Enterprise plan and that you are an Owner or Admin.
2. Go to Developers → API keys and create a key. New keys are read-only (tenders:read) until you add scopes.
3. Copy the key straight away. It is shown once; Tenderen stores only a hash of it.
4. Send it as a Bearer token in the Authorization header to endpoints under https://tenderen.com/api/v1.

1. Add a custom connector in your AI assistant with the URL https://tenderen.com/api/mcp. Clients that only support the older HTTP+SSE transport use https://tenderen.com/api/mcp/sse.
2. Sign in to Tenderen when the assistant asks. The connector uses OAuth with PKCE and supports dynamic client registration; on Enterprise, clients that cannot do OAuth can send an API key as a Bearer token instead.
3. Ask the assistant to search tenders, read requirements or update an alert. It can only do what the key or sign-in allows.

On Enterprise, Owners and Admins can register HTTPS endpoints under Developers → Webhooks, or with an API key that has the webhooks:manage scope. Tenderen then sends each event your company subscribes to as a signed JSON POST.

• Events: tender.new (a new tender matched one of your company's alerts), tender.deadline (submission deadline in 7, 3 or 1 days for a tender in your pipeline), tender.awarded (contract award for a tender in your pipeline), bid.status_changed and bid.submitted (pipeline stage changes) and alert.triggered (an alert found new matches).
• Every request carries X-Tenderen-Signature (t=Unix time, v1=HMAC-SHA256 of "t.body" with the endpoint's signing secret) and an event id you can use to ignore duplicates.
• Events only go to endpoints that belong to the company the event concerns.
• Failed deliveries are retried after 1 minute, 5 minutes, 30 minutes and 2 hours. After 50 failed deliveries in a row the endpoint is turned off and its owner is notified.

Each API key may make 1,000 requests per hour by default. Going over returns HTTP 429 RATE_LIMIT_EXCEEDED until the hourly window resets. The MCP endpoint has its own limit of 1,000 requests per hour per token.

• API keys can only be created on the Enterprise plan, by an Owner or Admin. The MCP connector works on every plan, and the plan's limits (saved tenders, AI analyses, users) also apply to what the assistant does.
• Webhooks are part of the Enterprise plan. Endpoints must be public https addresses, and redirects are not followed.
• The Zapier app and the Word add-in are not yet publicly listed.

Is there a sandbox?

No. Use a key with read-only scopes while you build, and add write scopes when you are ready.

Where is the full endpoint list?

In the developer docs, which list every endpoint with the scope it needs, the error codes and the webhook format.