Skip to main content

MCP JSON-RPC Endpoint

POST 
/v1/mcp

The Model Context Protocol endpoint (Streamable HTTP transport). Point an MCP client at this URL and it discovers everything else on its own — the 401 below starts the OAuth flow described under OAuth Discovery.

Authentication is Authorization: Bearer <access token>, not X-Open-Api-Token. This is the only endpoint in the API that works that way, because MCP clients are standard OAuth clients. The token must carry the PERMISSION_OPEN_API_MCP:READ grant.

The body is a JSON-RPC 2.0 message and is passed through unchanged — the tools, their names and their arguments are defined by the core service, so they are not enumerated here. Call initialize, then tools/list, to discover what the connected company exposes. Set Accept: application/json, text/event-stream; the response is JSON or an SSE stream depending on the call.

The endpoint is stateless: it issues no Mcp-Session-Id, and GET (opening a server-initiated stream) and DELETE (closing a session) both answer 405, which the specification allows and which tells the client to stay in plain POST mode.

Rate limiting applies twice — once per client IP before the token is read, and once per token, sharing the same 60-requests-per-minute budget as the REST endpoints.

Request​

Responses​

The JSON-RPC response, relayed verbatim from the core service. Content-Type is application/json or text/event-stream, mirroring what the upstream returned.