Connected apps are how you authorise external systems and AI tools to access your Legatics environment. Each connected app represents a single integration (such as a reporting tool, a practice management system, or an AI assistant) and defines exactly what that integration is allowed to do.
Note: Connected apps are managed by system admins from the Administration System.
Overview
What a connected app is
A connected app is a named, scoped authorisation that allows an external system to authenticate with Legatics using OAuth 2.0. When you create a connected app, you define:
What it is: a name and description that identifies the integration
How it authenticates: the authentication type. Most integrations use the default, which uses a client ID and client secret. Some AI tools can't store a client secret and connect as a public client instead
What it can access: the scopes (permissions) granted to the app
The connected app generates the credentials the external system uses to request access tokens: a client ID and, unless the app is set up as a public client, a client secret. Those tokens allow the system to make authenticated requests to the Legatics API or MCP server.
How it fits into the access model
Legatics uses a three-layer model for API and MCP access:
Role | Responsibility |
System admin | Creates and manages connected apps. Defines what each app can access. |
Matter admin | Controls who can access each matter and what they can do in it. These permissions cap everything a connected app can do: an AI assistant or integration can never read or change more than the authenticating member could themselves in Legatics. |
Member | Authenticates through a connected app to grant it access to their data. |
This means an external system can only access data that a member has explicitly authorised, and never more than that member's own permissions allow. A connected app cannot access data beyond the scopes assigned to it, and cannot access data from members who haven't authenticated through it.
Two ways to connect: the API and MCP
Once a connected app is set up, it can be used to access Legatics in two ways: the API or the MCP server. Both require a connected app, but they serve different purposes and different audiences:
API: the external system calls Legatics endpoints directly, using the access token to read and write data. Read Legatics API explained
MCP: an AI assistant uses the connected app credentials to read and write Legatics data in real time during a conversation. Read Legatics MCP explained
In both cases, the connected app is created and managed in the same way, and what each one can write to is governed by the same scopes.
Scopes
Scopes define what data a connected app can access, and whether it can write as well as read. When you create a connected app, you select the scopes appropriate for the integration.
Note: The read_only scope keeps a connected app read-only regardless of its other scopes — it can query Legatics data but never create, update, or delete anything. This is the scope to add for any integration, including an AI assistant, that should never change your Legatics data.
Scopes follow a least-privilege model: you should only grant the scopes the integration actually needs. You can update scopes on an existing connected app at any time.
Note: A full list of available scopes and their descriptions is available in the Administration System when creating or editing a connected app.
Managing connected apps
You can create, edit, disable, and delete connected apps from Integrations > Connected apps in the Administration System.
Before you set one up, keep in mind:
There's no per-user access list. Once a connected app is set up, anyone at your firm with a valid Legatics login can authenticate through it. What each member can then do is still limited by the app's scopes and their own Legatics permissions
Disabling or deleting an app affects everyone. It stops the integration for every member using it. Members can't disconnect just themselves
Read Create and manage connected apps for full instructions.
Next step: Create and manage connected apps