Skip to main content
POST
Call the MCP server

Authorizations

Authorization
string
header
required

For apps that other people connect to their StockShift account. Use the OAuth 2.1 authorization code flow with PKCE (S256); there is no client secret. Discover the endpoints at /.well-known/oauth-authorization-server (RFC 8414) and register your app at POST /oauth/register (RFC 7591). The member chooses the organization and approves the scopes on the consent page, and the token can never do more than the member could. Send it as Authorization: Bearer <token>, as you would an API key. Access tokens last an hour; each refresh returns a new refresh token, so store it.

Body

application/json
jsonrpc
enum<string>
required
Available options:
2.0
method
string
required

Such as initialize, tools/list or tools/call.

id
any

A number or a string. Absent on a notification.

params
object

The method's parameters. A tool call names the tool and its arguments.

Response

The JSON-RPC answer, as JSON or as a server-sent event stream.

jsonrpc
enum<string>
required
Available options:
2.0
method
string
required

Such as initialize, tools/list or tools/call.

id
any

A number or a string. Absent on a notification.

params
object

The method's parameters. A tool call names the tool and its arguments.