# Using AI Tools with the EXR Commercial API

## Discover the public sources

Start with [`/llms.txt`](https://cre.exrplatform.com/llms.txt), a concise index of the explicitly public developer documents. The same index is available at [`/.well-known/llms.txt`](https://cre.exrplatform.com/.well-known/llms.txt). Use [`/llms-full.txt`](https://cre.exrplatform.com/llms-full.txt) only when you need the complete approved Markdown corpus.

The canonical machine contract is [OpenAPI 3.1](https://cre.exrplatform.com/api/v1/openapi.json). Human-readable pages and their Markdown alternates are listed in `llms.txt`.

## Source precedence

1. The current OpenAPI document is authoritative for API operations, parameters, schemas, scopes, response codes, and webhook contract fields.
2. The public API reference and webhook guide explain that contract.
3. The approved lease-commission guide explains financial interpretation for lease and sublease deals.
4. If a behavior is absent or conflicts across sources, do not guess. Treat it as undocumented and ask the integration owner to confirm it.

## Safe use

- Reading documentation is public. Calling authenticated API operations is not: each call needs a valid bearer token and the required scope.
- Keep API tokens and webhook signing secrets out of prompts, source control, client-side code, URLs, logs, and generated artifacts.
- Follow cursor pagination, preserve money values as integer-cent strings, and use an `Idempotency-Key` for every write retry.
- Verify webhook signatures against the raw request body, reject stale timestamps, and use a timing-safe comparison.
- Respect `404` visibility responses. They can mean a record is absent or not visible to the token; do not probe for existence.

EXR Commercial does not publish an MCP server. Do not represent these documentation routes as an MCP endpoint.