Mcp

MCP tools (JSON-RPC 2.0, stateless 2026-07-28) — call tools; only tools/call is billable.

JSON Web Key Set (JWKS)

GET/.well-known/jwks.json

Response Body

`application/json`

curl -X GET "https://example.com/.well-known/jwks.json"

{
  "keys": [
    {
      "alg": "string",
      "e": "string",
      "kid": "string",
      "kty": "string",
      "n": "string",
      "use": "string"
    }
  ]
}

{
  "error": "string",
  "error_description": "string"
}

OAuth authorization-server metadata (RFC 8414)

GET/.well-known/oauth-authorization-server

Response Body

`application/json`

curl -X GET "https://example.com/.well-known/oauth-authorization-server"

{
  "authorization_endpoint": "string",
  "code_challenge_methods_supported": [
    "string"
  ],
  "grant_types_supported": [
    "string"
  ],
  "issuer": "string",
  "jwks_uri": "string",
  "response_types_supported": [
    "string"
  ],
  "scopes_supported": [
    "string"
  ],
  "token_endpoint": "string",
  "token_endpoint_auth_methods_supported": [
    "string"
  ]
}

OAuth protected-resource metadata (RFC 9728)

GET/.well-known/oauth-protected-resource

Response Body

`application/json`

curl -X GET "https://example.com/.well-known/oauth-protected-resource"

{
  "authorization_servers": [
    "string"
  ],
  "bearer_methods_supported": [
    "string"
  ],
  "scopes_supported": [
    "string"
  ]
}

OAuth login+consent page (Authorization Code + PKCE)

GET/authorize

Query Parameters

client_id*string

Buyer API key (vnb-sk-* / vai-sk-*)

redirect_uri*string

Exact-match http/https callback URL

response_type*string

Must be 'code'

scope?string

Requested scope

state?string

Opaque client state, round-tripped to the callback

code_challenge*string

43-char base64url PKCE challenge (mandatory)

code_challenge_method*string

Must be 'S256'

Response Body

`text/html`

curl -X GET "https://example.com/authorize?client_id=string&redirect_uri=string&response_type=code&code_challenge=string&code_challenge_method=S256"

"string"

{
  "error": "string",
  "error_description": "string"
}

{
  "error": "string",
  "error_description": "string"
}

Submit login+consent, issue authorization code

POST/authorize

Request Body

application/x-www-form-urlencoded

TypeScript Definitions

Use the request body type in TypeScript.

email*string

Console account email

password*string

Console account password

client_id*string

Buyer API key carried from the GET request

redirect_uri*string

Exact-match http/https callback URL

scope?string

Requested scope

state?string

Opaque client state, round-tripped to the callback

code_challenge*string

PKCE challenge carried from the GET request

code_challenge_method*string

Must be 'S256'

Response Body

`text/html`

curl -X POST "https://example.com/authorize" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'email=string&password=string&client_id=string&redirect_uri=string&code_challenge=string&code_challenge_method=string'

"string"

"string"

{
  "error": "string",
  "error_description": "string"
}

{
  "error": "string",
  "error_description": "string"
}

Request an OAuth 2.0 access token (MCP clients)

POST/oauth/token

Request Body

application/x-www-form-urlencoded

TypeScript Definitions

Use the request body type in TypeScript.

grant_type*string

OAuth grant type

client_id*string

Your API key (vnb-sk-* / vai-sk-* / vnp-sk-*)

client_secret?string

Must match client_id if provided (API key is its own secret)

scope?string

Requested scope (mcp:* for tools, llm:* for models)

code?string

Authorization code (required for authorization_code grant)

redirect_uri?string

Redirect URI (required for authorization_code grant)

code_verifier?string

PKCE code verifier (required for authorization_code grant)

refresh_token?string

Refresh token (required for refresh_token grant)

Response Body

`application/json`

curl -X POST "https://example.com/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'grant_type=string&client_id=string'

{
  "access_token": "string",
  "expires_in": 0,
  "refresh_token": "string",
  "scope": "string",
  "token_type": "string"
}

{
  "error": "string",
  "error_description": "string"
}

{
  "error": "string",
  "error_description": "string"
}

{
  "error": "string",
  "error_description": "string"
}

{
  "error": "string",
  "error_description": "string"
}

Call an MCP tool (stateless 2026-07-28)

POST/v1-beta/mcp/{username}/{appname}

Path Parameters

username*string

Publisher username (the developer's public identifier)

appname*string

App name, unique per publisher

Header Parameters

Authorization*string

Bearer credential — API key (vnb-sk-* / vai-sk-*) or JWT access token (scope mcp:tools)

MCP-Protocol-Version*string

Must be 2026-07-28

Mcp-Method*string

JSON-RPC method name (e.g., tools/call)

Mcp-Name*string

Tool/resource/prompt name for routing

Request Body

application/json

JSON-RPC 2.0 request to proxy to the publisher

TypeScript Definitions

Use the request body type in TypeScript.

id?string

jsonrpc?string

method?string

params?

Response Body

`application/json`

curl -X POST "https://example.com/v1-beta/mcp/string/string" \  -H "Authorization: string" \  -H "MCP-Protocol-Version: 2026-07-28" \  -H "Mcp-Method: tools/call" \  -H "Mcp-Name: tools/call" \  -H "Content-Type: application/json" \  -d '{}'

{}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0
  }
}

200application/json

404application/json

200application/json

200application/json

200text/html

400text/html

405text/html

200text/html

302text/html

405text/html

500text/html

200application/json

400application/json

401application/json

405application/json

500application/json

200application/json

400application/json

401application/json

402application/json

403application/json

404application/json

405application/json

429application/json

502application/json

504application/json

`application/json`

`application/json`

`application/json`

`application/json`

`text/html`

`text/html`

`text/html`

`text/html`

`text/html`

`text/html`

`text/html`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`