docs: document the Context Management API in the API and MCP guides

docs/en-US/overview/for-coding-agents.mdx

@@ -373,7 +373,9 @@ To add the docs as context, paste a docs URL or the `llms.txt` link into your ag
 
 ## MCP server [#mcp]
 
-Use the hosted [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server at `https://api.gtx.dev/mcp` for live project information. It uses streamable HTTP.
+Use the hosted [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server at `https://api.gtx.dev/mcp` for live project information and Context Management. It uses streamable HTTP.
+
+The server's Context Management tools list, create, and update Context Groups, their Glossary terms and Custom Prompts, imports and exports, and project assignments. They mirror the [Context Management API](/docs/platform/openapi/reference/context-management/list-groups).
 
 The hosted server also provides [Google Drive MCP tools](/docs/integrations/google-drive/reference/mcp-tools) for finding connected projects, translating Google Docs and Google Slides, and polling translated-copy progress.
 
@@ -396,6 +398,8 @@ Connect through your MCP client's OAuth sign-in flow, or configure `Authorizatio
 
 Use `list_projects` to find a project ID, then pass it as `projectId` to the project tools. A project key can omit `projectId` to use its own project.
 
+Context Management tools require **Context** permissions on an Organization key, or a signed-in user; project keys cannot use them. Pass the `orgId` from `list_projects` to `list_context_groups` and `create_context_group`, and a `groupId` to the tools that act on an existing group.
+
 Once connected, ask your agent to use the `generaltranslation` MCP server. Try: "List my projects and show the locale settings for one of them."
 
 ## Editor-specific tips [#editor-tips]

docs/en-US/platform/dashboard/guides/defining-context-for-translations.mdx

@@ -98,6 +98,10 @@ When you create a Context Group from a project, it is still created at the Organ
 
 *Use the import/export flow to manage existing Context Groups.*
 
+<Callout type="info">
+  **Developers:** To automate imports, exports, or any other Context Group change, use the [Context Management API](/docs/platform/openapi/reference/context-management/list-groups) or its MCP tools with an Organization key that has **Context** permissions.
+</Callout>
+
 In most cases, you should directly assign or reassign projects to Context Groups.
 
 However, for major changes, you can also use **Export** to download a group's Glossary and Custom Prompts. **Import** accepts CSV, TSV, JSON, and text files. Its preview skips existing Custom Prompts, definitions, and translations, but can include missing translations for an existing term.

docs/en-US/platform/dashboard/reference/api-keys.mdx

@@ -34,6 +34,8 @@ In these Dashboard controls, permissions are configured per resource. `Write` in
 
 Enable **Project creation** for automation that calls the [Create a project](/docs/platform/openapi/reference/project/create-project) endpoint. Its `org:projects:create` permission also allows creation with CDN delivery enabled; **Project settings** (`project:write`) is needed only for later settings updates. Grant each key only the permissions it needs.
 
+Set **Context** to **Read** or **Write** for automation that calls the [Context Management API](/docs/platform/openapi/reference/context-management/list-groups) (`org:context:read` / `org:context:write`). Project keys cannot manage Context Groups.
+
 Set **Project API keys** to **Write** for automation that calls [Create a project API Key](/docs/platform/openapi/reference/project/create-api-key). Use an Organization key with the required permissions for a project in that Organization. Project keys cannot create other keys.
 
 When creating keys through the [HTTP API](/docs/platform/openapi/reference/project/create-api-key), select permissions explicitly or omit the selection to grant all project permissions you can delegate. Unlike the Dashboard controls, explicit HTTP Write grants do not include Read.

docs/en-US/platform/dashboard/reference/api-reference.mdx

@@ -5,7 +5,7 @@ description: Find the public General Translation API endpoints, authentication d
 
 ---
 
-The General Translation API lets you upload source content and translated files, download translations, queue translation jobs, manage branches and tags, and read project and job status.
+The General Translation API lets you create projects and project API keys, upload source content and translated files, download translations, queue translation jobs, translate content at runtime, generate context, manage Context Groups with their Glossary and Custom Prompts, manage branches and tags, and read project and job status.
 
 Most SDK and CLI workflows call these endpoints for you. However, the API allows you to call these endpoints directly if you need:
 

docs/en-US/platform/openapi/overview.mdx

@@ -9,6 +9,7 @@ related:
     - /docs/platform/core/reference/api-client
     - /docs/platform/openapi/reference/files/upload-source
     - /docs/platform/openapi/reference/context/generate-context
+    - /docs/platform/openapi/reference/context-management/list-groups
     - /docs/platform/openapi/reference/translation/translate-runtime
     - /docs/platform/openapi/reference/project/create-project
 
@@ -42,15 +43,15 @@ Choose the key scope that matches your workflow:
 - **Project** with prefix `gtx-api-`: bound to one project and usable in any environment, subject to its permissions
 - **Organization** with prefix `gtx-org-`: works across projects in its bound Organization, subject to its permissions
 
-For project-scoped endpoints with a project ID in the path, that ID selects the project. An optional `gt-project-id` must match or the request fails with `403`. Without a path target, project keys use their bound project; Organization keys must send `gt-project-id`. Project and Organization discovery need no project target. Organization-scoped routes with a path target use that Organization.
+For project-scoped endpoints with a project ID in the path, that ID selects the project. An optional `gt-project-id` must match or the request fails with `403`. Without a path target, project keys use their bound project; Organization keys must send `gt-project-id`. Project and Organization discovery need no project target. Organization-scoped routes with a path target use that Organization, and Context Group routes (`/v2/context-groups/{groupId}`) use the Organization that owns the group.
 
 Legacy API-key headers remain supported and take precedence over the bearer header. Keep API keys out of deployed browser and mobile bundles.
 
 (See [API keys](/docs/platform/dashboard/reference/api-keys) for how to create and scope API keys).
 
 ### Permissions
 
-Most endpoints require a permission on the request identity. [List Organizations](/docs/platform/openapi/reference/project/list-orgs) returns the key's own Organization without additional permissions. Both Organization and project keys support **All** or **Custom** permissions in the Dashboard, limited to permissions the creator can grant. The [project API-key endpoint](/docs/platform/openapi/reference/project/create-api-key) lets you select permissions or omit the selection to grant all delegable project permissions. Explicit HTTP Write grants do not implicitly include Read.
+Most endpoints require a permission on the request identity. [List Organizations](/docs/platform/openapi/reference/project/list-orgs) returns the key's own Organization without additional permissions. Both Organization and project keys support **All** or **Custom** permissions in the Dashboard, limited to permissions the creator can grant. The [project API-key endpoint](/docs/platform/openapi/reference/project/create-api-key) lets you select permissions or omit the selection to grant all delegable project permissions. Explicit HTTP Write grants do not implicitly include Read. Context Management endpoints require Organization permissions, so they need an Organization key; project keys cannot call them.
 
 Common permissions:
 
@@ -60,8 +61,9 @@ Common permissions:
 - `project:files:write` for uploading files, translations, and assets; submitting diffs; publishing; creating branches and tags; and moving files.
 - `project:translations:enqueue` for queuing files for translation.
 - `project:translations:generate` for runtime translation.
-- `project:context:read` for reading project context.
 - `project:context:write` for generating context.
+- `org:context:read` for reading Context Groups, their Glossary and Custom Prompts, project assignments, and exports.
+- `org:context:write` for creating, updating, and deleting Context Groups and their content, importing content, and assigning, unassigning, and reordering groups on projects.
 - `project:write` for updating project settings.
 
 ### Versioning
@@ -92,14 +94,18 @@ Rate limiting uses 60-second windows at two layers:
 Post-authentication limits vary by endpoint:
 
 - **Heavy:** 30 requests/minute for queueing translations.
-- **Medium:** 120 requests/minute for uploads, diffs, context, moves, orphaned files, and publishing.
+- **Medium:** 120 requests/minute for uploads, diffs, context generation, moves, orphaned files, and publishing.
 - **Light:** 300 requests/minute for file downloads.
-- **Default:** 200 requests/minute for project and Organization discovery, project and project API-key creation, branches, tags, project info, job info, file info, translation status, and runtime translation.
+- **Default:** 200 requests/minute for project and Organization discovery, project and project API-key creation, branches, tags, project info, job info, file info, translation status, runtime translation, and Context Management.
 
 Project and Organization discovery and project/key creation share a request limit.
 
 Exceeding a post-authentication limit returns `429` with `RateLimit-*` headers. Organization token quotas return `402` from `POST /v2/translate`.
 
+### Pagination
+
+List endpoints return one page of results as `{ "items": [...], "nextCursor": ... }`. Pass `limit` (1 to 100, default 50) to set the page size. When `nextCursor` is a string, send it as `cursor` to fetch the next page; when it is `null`, there are no more results. A cursor works only for the list and filters that issued it. Pages are read independently, so items that change between requests may be missed or repeated.
+
 ### Errors
 
 Authenticated application errors return an `error` message. For API version `2026-02-18.v1` and later, the body is JSON; earlier versions, including the default used when no `gt-api-version` header is sent, return the message as plain text. Parsing, payload-limit, and rate-limit failures can return plain text before authentication runs.
@@ -117,8 +123,8 @@ Common status codes:
 - `402` when an Organization token quota is exceeded (`POST /v2/translate`).
 - `403` when the request identity lacks permission or the action is not allowed on the current plan.
 - `404` when the resource is not found.
-- `409` when project creation exceeds the Organization's project limit.
-- `413` when the request body exceeds the endpoint limit.
+- `409` for a conflict, such as project creation over the Organization's project limit or a rename that collides with an existing Glossary term or Custom Prompt.
+- `413` when the request body exceeds the endpoint limit, or when a Context Management response would exceed 1 MiB (request a smaller `limit`).
 - `425` when a requested translated file is still processing.
 - `429` when a rate limit is exceeded.
 - `500` for an internal server error.