Connect AWS Marketplace to Permit Sheriff.

1. Subscribe and register

1. Subscribe to Permit Sheriff from its AWS Marketplace product page.
2. Select Launch product or Sign in or register with vendor.
3. AWS sends you to Permit Sheriff's registration flow. Sign in with an existing Permit Sheriff account or create the requested account.
4. Confirm the Permit Sheriff organization that should be linked to the AWS Marketplace purchase.
5. Permit Sheriff keeps the purchase pending until the authoritative AWS Marketplace lifecycle event confirms activation.
6. After activation, use the issued organization-scoped integration credential for MCP/API access.

Do not email or paste AWS registration tokens, Permit Sheriff API keys, or other secrets into support tickets.

2. Prerequisites

• An active Permit Sheriff subscription purchased through AWS Marketplace.
• A Permit Sheriff organization linked to that AWS purchase.
• An integration credential issued for that organization.
• An MCP-capable client or an HTTPS client that can send JSON-RPC 2.0 requests.

Credentials are tenant-scoped. A client cannot choose a different organization by changing request arguments or headers.

3. Authentication and protocol

Send the Permit Sheriff integration credential as a Bearer token:

Authorization: Bearer psk_<key-id>_<secret>
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28

Supported JSON-RPC methods are server/discover, initialize,notifications/initialized, tools/list, and tools/call. Modern tools/call requests also bind Mcp-Method and Mcp-Nameheaders to the JSON-RPC method and requested tool.

Remote MCP client configuration

Clients that support remote HTTP MCP servers can use the following shape. The exact settings-file location varies by client; keep the Bearer credential in that client's protected secret/configuration store rather than source control.

{
  "mcpServers": {
    "permit-sheriff": {
      "url": "https://permitsheriff.com/api/agent/v1/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_PERMIT_SHERIFF_KEY",
        "MCP-Protocol-Version": "2026-07-28"
      }
    }
  }
}

4. Discover available tools

Call tools/list after authentication. The server returns the current input schema and annotations for every tool available to the credential. This is the canonical way to discover the live schema rather than hard-coding an old copy.

curl -X POST "https://permitsheriff.com/api/agent/v1/mcp"   -H "Authorization: Bearer YOUR_PERMIT_SHERIFF_KEY"   -H "Content-Type: application/json"   -H "MCP-Protocol-Version: 2026-07-28"   -H "Mcp-Method: tools/list"   --data '{"jsonrpc":"2.0","id":"tools-1","method":"tools/list","params":{}}'

5. Supported tools

Tool availability also depends on the scopes attached to the integration credential. Read access does not automatically grant analysis or contractor-verification authority.

6. Example analysis request

Before sending a large document, use preflight_permit_package when appropriate. A new analysis requires a stable idempotency key so retries cannot create duplicate commercial work.

{
  "jsonrpc": "2.0",
  "id": "analysis-1",
  "method": "tools/call",
  "params": {
    "name": "analyze_permit_package",
    "arguments": {
      "document_base64": "<BASE64_DOCUMENT>",
      "filename": "permit-package.pdf",
      "content_type": "application/pdf",
      "project_name": "Example Project",
      "jurisdiction": "Example jurisdiction",
      "property_address": "Example project address",
      "page_count": 42,
      "idempotency_key": "project-revision-001"
    }
  }
}

Send matching headers Mcp-Method: tools/call andMcp-Name: analyze_permit_package. A successful request returns structured MCP content including an analysis_id and processing status. Pollget_analysis_status using that identifier.

Response schema

MCP responses use JSON-RPC 2.0. Tool output is returned in result.content; failures use either the JSON-RPC error object or a structured tool result marked as an error.tools/list is the canonical source for each tool's live input schema.

{
  "jsonrpc": "2.0",
  "id": "analysis-1",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "{\"analysis_id\":\"...\",\"processing_status\":\"queued\"}"
      }
    ]
  }
}

7. Billing on AWS Marketplace

AWS Marketplace is the billing authority for organizations linked through this purchase channel. Permit Sheriff reports usage quantities to AWS; AWS applies the price and terms of the offer you accepted.

Permit Sheriff's AWS offer uses contract-with-consumption semantics. Purchased Permit Analysis units returned by AWS Marketplace GetEntitlements are consumed first. Only completed analyses above that purchased quantity are staged for BatchMeterUsage against the exact agreement LicenseArn. Retries use idempotency controls to prevent duplicate billing for the same commercial work. Canceling or deprovisioning the AWS purchase stops future authorized usage after the applicable Marketplace lifecycle transition.

8. Limits and safe retry behavior

The remote MCP endpoint allows 60 requests per minute per API key, with a burst of up to 60 requests. Exceeding that limit returns HTTP 429 Too Many Requests with structured MCP error code -32029 and retry guidance. Contract capacity, document-size, page, storage, permission, and safety controls are enforced separately. Use tools/list for live schemas and preflight_permit_package before analysis when you need intake validation. If a request fails, keep the same idempotency key when retrying the same commercial operation; use a new key only for genuinely new work. For throttling or transient service-unavailable responses, honor the provided retry interval and use exponential backoff.

9. Error reference

Protocol-level errors use JSON-RPC error codes. Examples include -32700 for invalid JSON,-32600 for an invalid request, -32601 for an unknown method,-32602 for invalid parameters, and -32022 for an unsupported MCP protocol version.

10. Security and credential management

• Use a separate organization-scoped integration credential for each external system or agent.
• Do not reuse browser-session credentials for machine access.
• Permit Sheriff stores integration credentials using its digest-based credential system rather than retaining the issued plaintext token.
• Marketplace Quick Launch credentials expire on a maximum 90-day rotation window or at contract end, whichever comes first.
• Organization owners and administrators can rotate the Marketplace-managed key from Billing & Subscription. Rotation updates the AWS Marketplace deployment parameter and invalidates the prior Permit Sheriff key.
• Marketplace deprovisioning revokes Marketplace-provisioned access, including replacement keys created during rotation.
• All protected customer access remains server-authorized and organization-scoped.

See the Privacy Policy for customer-data handling information.

11. Troubleshooting

• Registration is pending: wait for AWS Marketplace activation to complete, then retry account access.
• Permission denied: confirm that the integration credential has the scope required by the requested tool.
• Analysis not found: confirm the analysis belongs to the organization bound to the credential.
• Idempotency conflict: do not reuse one idempotency key for different documents or commercial operations.
• Document rejected: run preflight and confirm the active document type, size, and page limits.

12. Support

Customer support: support@permitsheriff.com
Security reports: support@permitsheriff.com

For AWS Marketplace billing-account or invoice questions, use AWS Marketplace billing support. If the billing issue also affects Permit Sheriff access, contact Permit Sheriff support with the affected organization and approximate time—but never include credentials or registration tokens.

View the full Permit Sheriff support policy →

Additional resources: data handling and privacy, product FAQ, and subscription and usage status.