Manage protected content by API and AI tools

You can manage protected content from your own system or an AI assistant. The BCL API and the BCL MCP server list your content, show who has access, and change a content’s status, title and access rules. Creating content, uploading files and linking content to items are done in the dashboard.

Before you start

You need an API token. Create one under Platform Setup → Integrations, on the API Token tab. See Create an API token.

Use	Token permissions
Read content and buyers by API	API Read
Change content by API	API Write
AI agent through MCP	MCP Read, and MCP Write to make changes

Send these headers with every API request:

• Authorization: Bearer <your token>
• Accept: application/json
• A User-Agent that names your app, such as KopiKampung/1.0. Requests with the default user agent of curl or Python are refused.

The base URL is https://api.bcl.my/v1. The API only sees the content of the team the token belongs to.

API endpoints

These are the protected content endpoints:

Method and path	What it does	Parameters
GET /protected-contents	Lists your content	search (title), status (active, inactive, all), content_type (video, text, file, redirect), access_type (immediate, scheduled, duration), sort_by (title, created_at, updated_at), sort_order, page, per_page (up to 100, default 15)
GET /protected-contents/{id}	One content with its settings and stats: buyers, accessible now, total views and downloads	-
GET /protected-contents/{id}/customers	The buyers who have access	status (active, expired, revoked, all), page, per_page
PATCH /protected-contents/{id}/status	Turns the content on or off	is_active (true or false)
PATCH /protected-contents/{id}/title	Renames the content, and optionally its name in the access email	title (required, up to 255 characters), email_title
PATCH /protected-contents/{id}/access	Changes the access rules	access_type (required); scheduled_start_at (required for scheduled), scheduled_end_at; access_duration_days (required for duration); max_devices (1 or more); max_downloads; show_on_receipt

{id} is the content ID from the list, the same code that appears in the content’s dashboard address. Each content in the responses has an access_url: the content’s Access Finder link.

For example, to switch off a content:

curl -X PATCH "https://api.bcl.my/v1/protected-contents/7XBRVXK4/status" \
  -A "KopiKampung/1.0" \
  -H "Authorization: Bearer $BCL_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"is_active": false}'

A successful change returns "success": true with the new values. Sending a value that is already set returns HTTP 422, for example “The protected content is already inactive.” An unknown ID returns 404 “Protected content not found”.

Things to know

Keep these limits in mind:

• Access changes apply to new buyers. Like the dashboard, PATCH .../access does not change the dates of people who already have access. Use Sync Access Dates on the content’s Customer Access page afterwards.
• max_devices must be 1 or more by API. To allow unlimited devices, set Maximum Devices to 0 in the dashboard.
• There is no endpoint to grant or revoke one buyer. Use Grant Buyer Access and the other Customer Access actions in the dashboard.

Use an AI agent (MCP)

The BCL MCP server lets AI assistants such as Claude, ChatGPT or Cursor work with your account. Set it up under Platform Setup → Connect AI Agent. These tools cover protected content:

Tool	Needs	Does the same as
list_protected_contents	MCP Read	GET /protected-contents
get_protected_content	MCP Read	GET /protected-contents/{id}
get_protected_content_customers	MCP Read	GET /protected-contents/{id}/customers
update_protected_content_status	MCP Write	PATCH .../status
update_protected_content_title	MCP Write	PATCH .../title
update_protected_content_access	MCP Write	PATCH .../access

You can then ask in plain words, for example “Which Kopi Kampung courses have the most buyers?” or “Turn off the Live Cupping Session content”.

Access links in webhooks and automations

When an order unlocks protected content, the payment webhook lists it under each item’s protected_content, with the content title, the buyer’s access link (url) and the access_finder_url. Automations have matching variables, so you can send the buyer’s access link by WhatsApp. See Payment form webhook.

Common issues

Can I create protected content through the API?

Not yet. The API and MCP tools read content and buyers, and change status, title and access settings. Create the content and link it to items in the BCL dashboard.

Can my system find out who has access to a course?

Yes. Call GET /protected-contents/{id}/customers. It returns each buyer's name, email, phone, order number, status, access dates, views and downloads.

Can I ask an AI assistant to switch my content off after a promotion ends?

Yes. Connect the assistant to BCL through MCP with a token that has MCP Write, and ask it. It uses the update_protected_content_status tool.

Related articles

• Create an API token
• Manage who has access
• Control who can open your content
• Payment form webhook payload