A diagram is one of those artifacts that should update itself. The architecture changes on every merge, the docs page lags a release behind, and someone eventually opens a drawing tool to fix it by hand. LetDraw has an API and an MCP server so a script or an AI agent can do that work instead, and keep doing it every time the source changes.
If you already generate diagrams from a Compose file or a spec, the next step is to stop pressing the button yourself. A personal API token turns that same generation into a call any machine can make: a build step, a nightly job, or an assistant that reads your request and draws the result. The token carries only the permissions you grant it, so automation stays least-privilege by default.
Personal API tokens and scopes
You create a token in Developer settings, give it a name, and pick its scopes. That is the whole setup. The name is there so you can tell tokens apart later; call one "CI script" and another after whatever assistant will hold it, and a revoked token takes down exactly one caller and nothing else.
Scopes are how a token stays least-privilege. Rather than one all-powerful key, each token gets only the abilities its job needs:
- Read diagrams for a job that only pulls the current state of a drawing
- Create and edit diagrams for automation that produces or updates canvases
- Export to Mermaid, D2 or SVG for a docs pipeline that needs a file to commit
- Generate from a prompt for the AI path, where a request becomes a diagram
One token, one job, one name you can revoke. That is the difference between automation you trust and a key you are afraid to hand out.
Call it from CI or cron
The REST API is a plain HTTP endpoint. Authenticate with a bearer token, send a JSON body, and get a diagram back. Here is the generate-from-a-prompt path, the kind of call you would drop into a build step so architecture is drawn from a spec on every push:
# $LD_TOKEN holds a token scoped to "generate from a prompt" curl https://letdraw.com/api/v1/diagrams/generate \ -H "Authorization: Bearer $LD_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "prompt": "web -> api -> postgres, redis cache on api", "format": "svg" }'
Put that behind a cron job and a stale docs diagram simply stops existing. The job runs, the diagram regenerates from whatever the input says today, and the picture your teammates open is the one that matches reality. Swap "format" for mermaid or d2 when you want text to commit next to the code instead of an image.
A pipeline that stays fresh
The shape of it is the same whether the trigger is a merge or a schedule: something changes, the pipeline calls the API, and the diagram is rebuilt. Nobody remembers to re-export anything, because there is nothing to remember.
Wire it into an AI assistant with MCP
The same abilities are exposed over the Model Context Protocol, so an AI assistant can draw and edit diagrams for you in conversation. You register LetDraw as an MCP server once, hand it a token, and the assistant gains the tools its scopes allow: it can create a canvas, edit what is there, export to Mermaid or D2, or generate a diagram from a description you type in plain language.
{
"mcpServers": {
"letdraw": {
"url": "https://letdraw.com/api/mcp",
"headers": {
"Authorization": "Bearer $LD_TOKEN"
}
}
}
}
Because the assistant only ever holds the token you gave it, its reach is capped at that token's scopes. Give a drafting assistant create-and-edit plus generate, and it can build and revise diagrams all day; give a reviewer assistant read and export only, and it can look and produce a file but never change your canvas. Name the token after the client that holds it, and if you ever want to cut it off, you revoke one token and that assistant loses access on the next call.
Revoke, rotate, repeat
Every token is revocable from the same Developer settings page where you made it. That is what makes handing tokens to scripts and assistants comfortable: nothing you grant is permanent, and nothing is entangled with anything else. A leaked CI variable, a client you stopped using, a scope you granted too generously; in each case the fix is to revoke that one token and mint a fresh one with the scopes you actually meant.
Put together, it is a small surface with a clear rule. Machines and assistants get diagrams the same way you do, through named tokens that carry only the permissions their job needs, and you can pull any of them back the moment you want to. The diagram stops being a thing you maintain and becomes a thing your pipeline produces.