find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/hedgr-app:hedgr-app-oauth-discovery-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: HEDGR public OAuth discovery API
  version: 1.0.0
  description: HEDGR is the AI FX agent for SME finance teams. This document covers the genuinely public, unauthenticated surface (health checks, public rates, OAuth discovery metadata) plus the MCP endpoint agents use to call Hedgr's read-only dashboard tools. The authenticated /api/* dashboard namespace used by the Hedgr web app is intentionally not enumerated here - see https://hedgr.app/developer-docs for why.
  contact:
    name: HEDGR support
    email: support@hedgr.app
    url: https://hedgr.app/support
  termsOfService: https://hedgr.app/terms
  x-logo:
    url: https://hedgr.app/hedgr-logo-icon.svg
  x-api-version: '2026-08-22'
  x-versioning-policy:
    strategy: header
    header: Hedgr-API-Version
    current_version: '2026-08-22'
    supported_versions:
    - '2026-08-22'
    response_header: Every /api response carries `Hedgr-API-Version` naming the contract that answered it.
    request_pinning: A client MAY pin by sending `Hedgr-API-Version`. An unrecognised value is rejected with 400 and a typed ApiError rather than silently served the current shape, so a pin is never quietly ignored.
    mcp: The MCP endpoint versions separately, per request, via the JSON-RPC `protocolVersion` field. GET /mcp lists every accepted version in `protocolVersions`; POST /mcp with method=initialize negotiates one and echoes the agreed value.
    deprecation: A version being retired is announced on its responses with the standard `Deprecation` (RFC 9745) and `Sunset` (RFC 8594) headers before removal, and in CHANGELOG.md. Versions are added append-only; an older version keeps serving until its Sunset date passes.
    breaking_change_definition: Removing or renaming a field, narrowing a type, or changing an existing status code. Adding a new optional field is not breaking and does not bump the version.
servers:
- url: https://hedgr.app
  description: Production
security:
- mcpOAuth:
  - fx:read
tags:
- name: OAuth discovery
  description: RFC 8414 / RFC 9728 metadata used to authenticate against the MCP endpoint.
paths:
  /.well-known/oauth-protected-resource:
    get:
      operationId: getOAuthProtectedResourceMetadata
      tags:
      - OAuth discovery
      summary: RFC 9728 protected-resource metadata for the MCP endpoint
      security: []
      responses:
        '200':
          description: Protected-resource metadata.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResourceMetadata'
  /.well-known/oauth-authorization-server:
    get:
      operationId: getOAuthAuthorizationServerMetadata
      tags:
      - OAuth discovery
      summary: RFC 8414 authorization-server metadata for the MCP OAuth flow
      security: []
      responses:
        '200':
          description: Authorization-server metadata.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationServerMetadata'
  /.well-known/api-catalog:
    get:
      operationId: getApiCatalog
      tags:
      - OAuth discovery
      summary: RFC 9727 API catalog
      description: Linkset document naming every HEDGR API surface, with service-desc, service-doc, and status relations (RFC 8631). Served as application/linkset+json.
      security: []
      responses:
        '200':
          description: RFC 9727 linkset.
          content:
            application/linkset+json:
              schema:
                $ref: '#/components/schemas/ApiCatalog'
components:
  schemas:
    ProtectedResourceMetadata:
      type: object
      properties:
        resource:
          type: string
          format: uri
          example: https://hedgr.app/mcp
        authorization_servers:
          type: array
          items:
            type: string
            format: uri
        scopes_supported:
          type: array
          items:
            type: string
          example:
          - fx:read
        bearer_methods_supported:
          type: array
          items:
            type: string
          example:
          - header
        resource_documentation:
          type: string
          format: uri
    ApiCatalog:
      type: object
      description: RFC 9727 API catalog in RFC 9264 linkset format.
      required:
      - linkset
      properties:
        linkset:
          type: array
          items:
            type: object
            properties:
              anchor:
                type: string
                format: uri
              item:
                type: array
                items:
                  type: object
                  properties:
                    href:
                      type: string
                      format: uri
                    title:
                      type: string
              service-desc:
                type: array
                items:
                  type: object
                  additionalProperties: true
              service-doc:
                type: array
                items:
                  type: object
                  additionalProperties: true
              status:
                type: array
                items:
                  type: object
                  additionalProperties: true
    AuthorizationServerMetadata:
      type: object
      properties:
        issuer:
          type: string
          format: uri
        authorization_endpoint:
          type: string
          format: uri
        token_endpoint:
          type: string
          format: uri
        registration_endpoint:
          type: string
          format: uri
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
        scopes_supported:
          type: array
          items:
            type: string
  securitySchemes:
    mcpOAuth:
      type: oauth2
      description: OAuth 2.1 authorization-code flow with PKCE and dynamic client registration. See /.well-known/oauth-authorization-server.
      flows:
        authorizationCode:
          authorizationUrl: https://hedgr.app/mcp/oauth/authorize
          tokenUrl: https://hedgr.app/mcp/oauth/token
          scopes:
            fx:read: Read-only access to FX exposure, cash position, hedge portfolio, P&L, policy, and related dashboard data via MCP tools.
    partnerKey:
      type: http
      scheme: bearer
      bearerFormat: hpk_live_...
      description: 'Partner API key issued by Hedgr to a broker firm. Send as Authorization: Bearer <key>. See https://hedgr.app/partner-api.'
externalDocs:
  description: Developer boundary summary
  url: https://hedgr.app/developer-docs