Skip to main content
POST
cURL
Use this when your agent runs somewhere it cannot start a local process, such as a serverless function or a browser. Each POST carries one JSON-RPC 2.0 message, and each tool runs the matching /api/v1 route behind the same key, rate limits, and quota. A client that can run a process should use the @0xinsider/mcp package over stdio instead: see MCP server.

Methods

Send an id on any request whose result you need. The server echoes a string, a number, or an explicit null back to you. Three messages may leave out the id, and they are the three notifications above. Any other message without an id answers HTTP 400 with an empty body, before anything runs. So does a message carrying result or error, because this server never sends a request that could have a response.

Headers

Credentials

Errors

A transport failure carries a JSON-RPC error object. Each one that answers 400 or 401 repeats its code in an X-Mcp-Error-Code response header. A credential that is present but invalid never reaches the transport. 401 invalid_api_key, 402, a tier 403, and 429 all come from the same middleware as REST, in the REST error envelope. A tool that fails is not a transport failure. It answers 200, with result.isError set to true and result.content[0].text saying what went wrong. tools/call arguments are checked against the tool’s inputSchema from tools/list before anything runs. A non-object, an unknown key, a wrong type, a number out of range, a value outside an enum, or a combination outside a oneOf answers that tool error. The query never runs with only the arguments that happened to fit. Each fault is named by its JSON Pointer inside arguments, as in at /limit: 500 is greater than the maximum of 100. An absent arguments is read as the empty object. An explicit null is not. The same failure comes back as fields under result.structuredContent.error, so a client can branch on it without parsing the text. It carries the REST error’s code, reason, param, doc_url, and retry_at unchanged, plus retry_after_seconds from the route’s Retry-After, request_id, and status. Invalid arguments are bad_request with param set to the first fault’s JSON Pointer, and a token without the scope is insufficient_scope with param set to the scope.

Tool results

result.structuredContent is the route’s payload, and result.content[0].text is the same JSON as text. Every result carries the route’s meta beside the payload: request_id, cached, cache_age_s, cost, and whatever provenance the route adds. That includes source and completeness on get_whale_trades_history, and ranking_source and directional_source on get_sports_edge_signals. The meta is copied, never invented, so a degraded ranking or a best-effort replay reads the same over MCP as over REST. A list result also carries has_more, next_cursor, and total when the route sends them.

Example

What it does not do

  • Write anything. Creating, updating, deleting, verifying, and rotating a webhook are deliberately not tools.
  • Serve resources or prompts. resources/* and prompts/* are not implemented.
  • Push anything to you. A GET on this endpoint answers 405, which Remote MCP GET explains.
  • Reshape a payload. A tool returns what its route returns, plus the route’s meta.

Authorizations

Authorization
string
header
required

Legacy default or named integration API key, or OAuth 2.1 access token, in the Authorization header as Bearer oxi_sk_live_... or Bearer oxi_at_.... Default keys retain full access; integration keys are limited to their approved read, webhooks, export and usage scopes and expire within 90 days. All credentials share the owner's account limits. Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728).

Headers

X-Query-Validation
enum<string>

Opt into strict query-name validation. The default is compatible: unknown names are ignored and reported in X-Query-Ignored. With strict, an unknown name returns 400 bad_request with error.reason unknown_query_parameter before the handler runs, including when its percent escape is incomplete.

Available options:
strict
Mcp-Session-Id
string

Session ID minted by the server on initialize; echoed on every subsequent request.

MCP-Protocol-Version
enum<string>

The negotiated MCP protocol revision, sent on every request after initialize (MCP Streamable HTTP transport). Accepted values: 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. Any other value answers HTTP 400 with JSON-RPC error -32600. Absent, the request is served as 2025-03-26.

Available options:
2025-11-25,
2025-06-18,
2025-03-26,
2024-11-05

Body

application/json

MCP JSON-RPC 2.0 request or notification envelope. Omit id for supported notifications.

jsonrpc
string
required

JSON-RPC protocol version; this server accepts 2.0.

Allowed value: "2.0"
method
enum<string>
required

MCP method to invoke.

Available options:
initialize,
notifications/initialized,
notifications/cancelled,
ping,
tools/list,
tools/call
id

Request identifier echoed exactly in one JSON-RPC response; supported notifications omit it and receive an empty HTTP 202.

params
object

Method-specific MCP parameters.

Response

JSON-RPC response

jsonrpc
string
required
Allowed value: "2.0"
id
required
result
object
error
object