Read and write CompanyCam projects, photos, videos, documents, checklists, tags, users and webhooks over the Core API v2.
CompanyCam ships in the w6w first-party pack. It declares 62 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.
io.w6w.companycamCompanyCam is a photo-documentation platform built for contractors, and this app brings a project’s whole record into a workflow: photos, videos, documents, comments and checklists, all filed under the project they belong to. List, create and update projects, attach a photo from a hosted URL or a document as a base64 file, add labels and tags, and manage who is assigned to or invited into a project.
Beyond projects, manage the company’s users and groups, and read or maintain the webhook subscriptions that notify your systems when something changes. A workflow can search for an existing project before creating a duplicate, and every list of photos or videos supports the cursor pagination CompanyCam’s API expects.
CompanyCam’s own documentation marks this API surface for depreciation in early 2027 with a successor API in development; this app targets the current, fully live surface.
Three routes to the same 62 actions. The Workflow tab is generated from CompanyCam's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
checklist-list List the company's checklists, sorted by last updated, optionally by completion.
checklist-template-list List the company's checklist templates, for use with Create Project Checklist.
group-update Rename a group or replace its member list. Members are replaced, not appended.
photo-comment-create Post a comment on a photo, optionally credited to another user.
photo-description-update Replace a photo's description. Plain text, or HTML from the vendor's tag list.
photo-list List photos across the company, filtered by capture window, project, user, group or tag.
photo-tag-add Apply one or more tags to a photo by display value, creating any that are new.
photo-update Set a photo's internal-only flag. This endpoint changes nothing else — use Update Photo Description for the text.
project-archive Archive a project, keeping its photos and documents. Reversible with Restore.
project-assigned-user-list List the users of this company assigned to a project.
project-checklist-create Create a checklist on a project from a checklist template.
project-checklist-get Fetch one checklist on a project, with its sections, tasks and sub-tasks.
project-checklist-list List a project's checklists in full, including sections, tasks and sub-tasks. Takes no pagination.
project-collaborator-list List the outside companies collaborating on a project.
project-comment-create Post a comment on a project, optionally credited to another user.
project-create Create a project, optionally with an address, geofence and primary contact.
project-delete Permanently delete a project and its photos, documents and comments. Prefer Archive Project unless deletion is really what is wanted.
project-document-create Attach a document to a project. The file is sent as base64 text in JSON, with a 30 MB limit on the decoded file.
project-document-list List the documents attached to a project, with their download URLs and sizes.
project-get Fetch a single project by id, including its notepad, contact and integrations.
project-invitation-create Mint a collaboration invite URL for a project. CompanyCam does not send it — the workflow delivers the link.
project-invitation-list List a project's collaboration invitations. Each carries an invite_url that grants access.
project-label-add Apply one or more labels to a project by display value, creating any that are new.
project-label-delete Remove one label from a project by label id. The label itself is not deleted.
project-label-list List the labels applied to a project. Labels use the same Tag shape as photos.
project-list List projects, optionally filtered by name/address, status or modification time.
project-notepad-update Replace a project's notepad text. Read the project first to append rather than overwrite.
project-photo-create Add a photo to a project from a publicly reachable URL. CompanyCam fetches and processes it asynchronously.
project-photo-list List the photos captured at a project, with cursor pagination.
project-user-remove Remove a user's assignment from a project. Does not delete the user.
project-video-list List the videos captured at a project. Treat playback_url as valid only once status is processed.
user-current-get Fetch the user this connection acts as, which is who writes are credited to.
video-get Fetch one video. Poll until status is processed before using playback_url or format.
video-list List videos across the company. playback_url is only meaningful once status is processed.
webhook-create Subscribe a URL to CompanyCam events. Supply a token to make deliveries verifiable; the response never carries it back.
webhook-delete Delete a webhook subscription. Disable it instead to pause deliveries reversibly.
webhook-list List the company's webhooks. The signing token is removed from every row before it is returned.
webhook-update Change a webhook's URL, scopes, signing token or enabled flag. Scopes are replaced, not merged.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying CompanyCam's real ids.
{
"manifestVersion": "2",
"name": "companycam-example",
"steps": [
{
"id": "group-create",
"uses": {
"app": "io.w6w.companycam",
"action": "group-create",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"name": "<name>"
}
}
]
}group-create checklist-list checklist-template-list company-get group-get +57 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for CompanyCam, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to CompanyCam. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "project-create",
payload: {
name: "<value>",
// address: "<value>",
// lat: "<value>",
// lon: "<value>",
// geofence: "<value>",
// primaryContact: "<value>",
// actAs: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value); npm install -g @w6w/cli w6w run conn_YOUR_CONNECTION_ID --action project-create --payload '{"name":"<value>"}' Give an AI agent CompanyCam — without giving it CompanyCam's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.companycam#group-create",
"input": {
"name": "<name>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's CompanyCam connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
CompanyCam's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. CompanyCam itself is MIT, and the runtime that executes it is source-available (FSL).
CompanyCam declares its own checks, so its health is a property of the app rather than something the host guesses at.
Component status from status.companycam.com. Covers the API, Web App, Uploads & Processing, Search, Mobile App, Integrations and Notifications.
CompanyCam publishes no rate-limit or quota signal: no rate-limit response headers on the wire, none declared in the OpenAPI document, no documented limit or 429, and no usage-reporting endpoint.