Command Center API

The health of your Salesforce orgs as data. Read the Org Health Index and grade, every issue with its history, reviews, monitoring, compliance evidence and activity; work issues from your own tools; stop a deployment when an org's health drops; get events by webhook; and let AI assistants use it all through the MCP server.

The API comes with the Professional and Enterprise plans at no extra charge. Version 1.0.0. Base URL:

https://health.dream.cloud/v1

Quick start

1. In the Command Center, open Admin > API access (owners and admins) and make a token. Copy it: it is shown only once.
2. Call the API with the token in the Authorization header:

curl -s -H "Authorization: Bearer $DREAM_TOKEN" "https://health.dream.cloud/v1/orgs"

Then the health of one org (the ids come from /orgs):

curl -s -H "Authorization: Bearer $DREAM_TOKEN" "https://health.dream.cloud/v1/health?org=12"

{
  "ok": true,
  "data": {
    "org": {
      "id": 12,
      "name": "Example Co Production"
    },
    "index": 74.6,
    "grade": "C",
    "healthy_at": 80,
    "review": {
      "id": 311,
      "run_id": "RUN-2026-0311",
      "finished_at": "2026-10-01T06:02:11Z"
    },
    "areas": [
      {
        "area": "Security",
        "area_name": "Security",
        "score": 68.2,
        "checks": 14
      },
      {
        "area": "Cost Efficiency",
        "area_name": "Licenses and cost",
        "score": 81.0,
        "checks": 9
      }
    ],
    "projection": {
      "base": 74.6,
      "quick": {
        "n": 6,
        "gain": 9.1,
        "to": 83.7
      }
    }
  },
  "request_id": "req_2c7e4a9f0b1d3e5a6c8b"
}

Tokens and scopes

A token looks like drm_3f9c...: drm_ and 40 hexadecimal characters, the last 8 a checksum, so a mistyped token is refused at once and secret scanners can recognize one. We keep only a fingerprint of it; if a token is lost, replace it.

• Expiry: 30, 90, 180, 365 days (90 by default). The owners get an email and the token.expiring event 14 and 3 days before.
• Replace: gives a new token with the same access; the old one keeps working for 24 hours so you can switch without downtime. Revoke: stops a token at once.
• Orgs: a token works for all orgs of the account, or only the ones you choose.
• Allowed IP addresses (optional): single IPv4 addresses and ranges ending in /8, /16 or /24.

Each token has scopes. Choose a preset or pick scopes one by one:

Answers and errors

Every answer is JSON (UTF-8). A success has "ok": true and the result in data; an error has "ok": false and an error with a code, the HTTP status it stands for and a message you can show. Every answer carries a request_id; send it to us if something looks wrong.

{
  "ok": false,
  "error": {
    "code": "insufficient_scope",
    "status": 403,
    "message": "This token does not have the issues:write scope."
  },
  "request_id": "req_0f2d4b6a8c1e3a5c7e9b"
}

Send parameters of a GET in the query string. Send a POST as JSON (Content-Type: application/json) with an action and its fields; org may go in the query string or the body. Times are ISO 8601 in UTC. Issue ids look like FND-12 (a finding of a review) or ALR-7 (a monitoring alert); orgs, reviews, endpoints and deliveries have numeric ids.

Limits and paging

Over a limit, the answer is rate_limited with retry_after in seconds. Reviews started with POST reviews share their limits with the Run review button: over one of them the answer is limit_reached, also with retry_after, and while a review of that org is running it is conflict. The review that runs by itself each month never counts, and Enterprise limits can be set in your agreement. Lists return up to limit items (1 to 200, 50 by default) and a next_cursor; pass it as cursor to get the next page. It is null on the last page.

Reference

Every operation, its scope and its parameters. The OpenAPI file has the full response schemas.

Your token

Orgs

Org Health

Deploy gate

Reviews

Checks of a review

Review documents

Issues

Monitoring

Security Health Check

Deploy windows

Compliance

Evidence exports

Verify an export

Access reviews

Savings and capacity

Improvement plan

Accepted exceptions

Activity

Webhooks

Webhook deliveries

Webhooks

Add an endpoint on the API access page or with POST /v1/webhooks (action create). The URL must use https and a public host name. You get the endpoint's signing secret once; a new one replaces it at once (rotate).

We POST each event as JSON with these headers: Dream-Event (the type), Dream-Event-Id, Dream-Delivery, Dream-Timestamp and Dream-Signature: t=<unix time>,v1=<hex>, where v1 is the HMAC-SHA256 of <t>.<body> with the endpoint's secret. Check it on the exact bytes you received, and refuse a timestamp older than five minutes.

import hashlib, hmac, time

def dream_signature_ok(secret: str, header: str, body: bytes, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t", ""), parts.get("v1", "")
    if not t.isdigit() or abs(time.time() - int(t)) > tolerance:
        return False
    want = hmac.new(secret.encode(), t.encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(want, v1)

const crypto = require("crypto");

function dreamSignatureOk(secret, header, rawBody, tolerance = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = parts.t || "", v1 = parts.v1 || "";
  if (!/^\d+$/.test(t) || Math.abs(Date.now() / 1000 - Number(t)) > tolerance) return false;
  const want = crypto.createHmac("sha256", secret).update(t + "." + rawBody).digest("hex");
  return want.length === v1.length && crypto.timingSafeEqual(Buffer.from(want), Buffer.from(v1));
}

Answer with any 2xx within 10 seconds. Otherwise we try again after 1, 5, 30, 120, 360 and 720 minutes, then daily, for 3 days; after that the delivery is marked failed. You can send any delivery again from the API access page or with redeliver. A delivery can arrive twice or out of order: use Dream-Event-Id to skip one you have seen.

{
  "id": "evt_6b1f0c9e2d4a8b3f7e5c1a0d",
  "type": "issue.opened",
  "created_at": "2026-10-02T09:14:05Z",
  "api_version": "v1",
  "account": {
    "id": 42,
    "name": "Example Co"
  },
  "data": {
    "issue": {
      "id": "ALR-318",
      "kind": "alert",
      "org": 12,
      "title": "Users with Modify All Data",
      "check": "sec.modify_all_users",
      "area": "Security",
      "area_name": "Security",
      "severity": "critical",
      "status": "open",
      "value_text": "9 users have Modify All Data",
      "opened_at": "2026-10-02T09:14:02Z",
      "resolved_at": null,
      "resolved_by": null,
      "due_at": "2026-10-05T09:14:02Z",
      "owner": null,
      "ticket": null,
      "verify_state": null,
      "link": "https://health.dream.cloud/app/issue.html?id=ALR-318"
    },
    "org": {
      "id": 12,
      "name": "Example Co Production"
    },
    "note": null
  }
}

MCP server

AI assistants that speak the Model Context Protocol can use the Command Center through its MCP server: streamable HTTP with JSON answers, protocol versions 2025-06-18, 2025-03-26 and 2024-11-05. Send the API token as a header; the assistant sees only the tools the token's scopes allow.

https://health.dream.cloud/v1/mcp

Claude Code

claude mcp add --transport http dream https://health.dream.cloud/v1/mcp --header "Authorization: Bearer drm_your_token"

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "dream": {
      "url": "https://health.dream.cloud/v1/mcp",
      "headers": {
        "Authorization": "Bearer drm_your_token"
      }
    }
  }
}

VS Code (.vscode/mcp.json; VS Code asks for the token once and stores it)

{
  "inputs": [
    {
      "type": "promptString",
      "id": "dream-token",
      "description": "Dream API token",
      "password": true
    }
  ],
  "servers": {
    "dream": {
      "type": "http",
      "url": "https://health.dream.cloud/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${input:dream-token}"
      }
    }
  }
}

Custom connectors in Claude.ai and ChatGPT sign in with OAuth, which the Command Center does not offer yet; use an assistant that can send a header, such as the ones above.

Recipes

Stop a deployment when an org's health drops

Call /gate before you deploy. It answers pass with the rules you set: min_grade, min_index, max_critical, max_new_critical, max_drop. Open a deploy window around the deployment so the changes it makes count as expected, not as changes outside your release windows; closing it re-checks security and sends deploy_window.closed with a summary.

# GitHub Actions: a step before the deploy (the token is a repository secret)
- name: Check org health
  env:
    DREAM_TOKEN: ${{ secrets.DREAM_TOKEN }}
    DREAM_API: https://health.dream.cloud/v1
  run: |
    curl -s -H "Authorization: Bearer $DREAM_TOKEN" "$DREAM_API/gate?org=12&min_grade=B&max_new_critical=0" > gate.json
    jq -e '.ok and .data.pass' gate.json || { jq '.data.reasons // .error' gate.json; exit 1; }
    curl -s -X POST -H "Authorization: Bearer $DREAM_TOKEN" -H "Content-Type: application/json" \
      -d '{"action": "open", "org": 12, "minutes": 60, "reference": "release ${{ github.sha }}"}' "$DREAM_API/windows"

The same two calls work from Gearset, Copado, Azure Pipelines or any tool that can run a script or an HTTP request. Close the window with {"action": "close", "org": 12} when the deployment ends.

Tickets in Jira, ServiceNow or Azure DevOps

The Command Center already creates Jira Cloud and ServiceNow tickets from the Issues page (Settings). To run your own flow instead: subscribe an endpoint to issue.opened, create the ticket, then link it back with POST /v1/issues action link (ticket_ref, ticket_url). Resolve the issue with action resolve when the ticket closes: the next check confirms the fix (issue.fix_confirmed) or reopens the issue (issue.reopened).

Slack and Microsoft Teams

Alerts can go to Slack and Teams without code (Settings > Notifications). For your own messages, send webhook events through a small relay (for example a serverless function) that checks the signature and posts to your channel.

Power BI, Tableau and spreadsheets

Point a web data source at /health, /reviews or /issues with the header Authorization: Bearer ... and a read-only token. In Power BI: Get data > Web > Advanced, add the header, then expand data.

Splunk and Microsoft Sentinel

Poll /activity?since=... every few minutes for the audit trail (who did what, and when), or relay webhook events to your HTTP event collector.

Compliance tools such as Drata and Vanta

/evidence returns the evidence for SOC 2, HIPAA, ISO 27001, Ontario PHIPA, PIPEDA, GDPR, UK GDPR or Quebec Law 25 (by default the first that fits the org) with its sha256; anyone can check an export with /verify?hash=..., no token needed. Attach the export and the verification link to your control.

Salesforce External Services

Use the API from Salesforce Flow without code. Import openapi-salesforce.json, a subset (orgs, health, gate, issues) written for External Services.

1. External Credential (Setup > Named Credentials > External Credentials): authentication protocol Custom. Add a principal with an authentication parameter named token holding your API token, and a custom header Authorization with the value {!'Bearer ' & $Credential.Dream_API.token} (use your External Credential's API name).
2. Named Credential: URL https://health.dream.cloud/v1, the External Credential above, Allow Formulas in HTTP Header on and Generate Authorization Header off.
3. Give the users or the flow's running user access to the principal in a permission set (External Credential Principal Access).
4. External Services: add a service from the API specification file, choose the Named Credential and the operations. They then appear as actions in Flow Builder.

Every answer has ok: branch on it in the flow, because errors also come back as success at the HTTP level.

Files

• openapi.json: OpenAPI 3.0, every operation with its response schema, and the webhook events
• openapi-salesforce.json: the subset for Salesforce External Services
• postman.json: a Postman collection; set the token and org variables
• llms.txt: a short index for AI tools

Versions

The version is in the path (/v1). We add fields, operations and events without notice, so ignore what you do not know. Anything that would break a client comes in a new version, announced here in advance.

Version 1.0.0 · Questions: contact us · Terms · Privacy Policy