medianfi-com

medianfi-com MCP API

The MCP API from medianfi-com — 3 operation(s) for mcp.

GitHub OpenAPI

Operations 3

POST /oauth/consent/preview Validate an MCP OAuth consent request #
POST /mcp Median MCP server endpoint #
GET /companies/{companyId}/mcp/connections List recent MCP client activity for a company #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/medianfi-com/openapi/medianfi-com-mcp-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-practice-packet-v1-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-therapist-metrics-envelope-response-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-sub-ledger-liabilities-view-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-quick-books-chart-push-preview-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-books-overview-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-agent-client-facts-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/medianfi-com:medianfi-com-mcp-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

medianfi-com-mcp-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Median MCP API
  version: 0.1.0
  description: Production-grade Node.js + Express API starter template
  license:
    name: Proprietary
servers:
- url: /api/v1
security: []
tags:
- name: MCP
paths:
  /oauth/consent/preview:
    post:
      operationId: previewOAuthConsent
      summary: Validate an MCP OAuth consent request
      description: Requires a signed-in human Bearer session and MCP_OAUTH_ENABLED. Validates the current registered client, exact approved callback, MCP resource and canonical PKCE S256 challenge before returning display metadata. Does not grant access or issue an authorization code. Approval independently checks the request and current company authority again. The stored client_name is a self-asserted connector label, not verified publisher identity.
      tags:
      - MCP
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - client_id
              - redirect_uri
              - code_challenge
              - code_challenge_method
              - resource
              properties:
                client_id:
                  type: string
                  minLength: 1
                redirect_uri:
                  type: string
                  format: uri
                code_challenge:
                  type: string
                  minLength: 43
                  maxLength: 43
                  pattern: ^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$
                code_challenge_method:
                  type: string
                  enum:
                  - S256
                resource:
                  type: string
                  format: uri
                scope:
                  type: string
                state:
                  type: string
      responses:
        '200':
          description: Validated consent display data, with no grant or code created
          headers:
            Cache-Control:
              schema:
                type: string
                enum:
                - no-store
          content:
            application/json:
              schema:
                type: object
                required:
                - success
                - data
                properties:
                  success:
                    type: boolean
                    const: true
                  data:
                    type: object
                    required:
                    - client_name
                    - redirect_uri
                    - issuer
                    - resource
                    - scopes
                    properties:
                      client_name:
                        type:
                        - string
                        - 'null'
                        description: Stored self-asserted DCR label; does not attest publisher identity
                      redirect_uri:
                        type: string
                        format: uri
                      issuer:
                        type: string
                        format: uri
                        description: Exact OAuth metadata issuer, including any trailing slash
                      resource:
                        type: string
                        format: uri
                      scopes:
                        type: array
                        items:
                          type: string
        '400':
          description: Unknown, revoked or unapproved client, callback mismatch or resource mismatch
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiErrorResponse'
        '401':
          description: Missing or invalid human Bearer session
        '403':
          description: API-key authentication cannot authorize a connector
        '404':
          description: MCP OAuth is disabled
        '422':
          description: Missing or invalid consent parameters, including malformed PKCE
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiErrorResponse'
  /mcp:
    post:
      operationId: callMcp
      summary: Median MCP server endpoint
      description: JSON-RPC 2.0 Streamable HTTP endpoint. Default customer API keys and OAuth tokens expose only read tools. A separately scoped forecast:write API key may also expose the Forecast sandbox staging tool, which never changes the live forecast. Tool names and input schemas are documented in openapi/mcp-tools.json. Limits are 30 tool calls per minute and 300 per hour per API key or OAuth user-company identity, with an additional 20 calls per minute for each bulk-read tool. Every tool call in a JSON-RPC batch consumes its own budget. If any item exceeds a limit, the full batch is rejected atomically with HTTP 429, Retry-After, and one JSON-RPC error per request item. A batch may contain at most 20 items; a longer batch is rejected with HTTP 400 and a single JSON-RPC -32600 error before any budget is consumed.
      tags:
      - MCP
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
              - $ref: '#/components/schemas/McpJsonRpcRequest'
              - type: array
                minItems: 1
                maxItems: 20
                items:
                  $ref: '#/components/schemas/McpJsonRpcRequest'
      responses:
        '200':
          description: JSON-RPC result or error
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/McpJsonRpcResponse'
                - type: array
                  minItems: 1
                  items:
                    $ref: '#/components/schemas/McpJsonRpcResponse'
        '400':
          description: Malformed JSON-RPC input, including a batch longer than 20 items; a single JSON-RPC error with code -32600 and a null id, returned before any tool-call budget is consumed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/McpJsonRpcResponse'
        '429':
          description: One or more tool calls exceeded the credential or bulk-tool budget
          headers:
            Retry-After:
              description: Seconds until the exhausted window resets
              schema:
                type: integer
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/McpJsonRpcRateLimitError'
                - type: array
                  minItems: 1
                  items:
                    $ref: '#/components/schemas/McpJsonRpcRateLimitError'
  /companies/{companyId}/mcp/connections:
    parameters:
    - $ref: '#/components/parameters/companyId'
    get:
      operationId: listMcpConnections
      summary: List recent MCP client activity for a company
      tags:
      - MCP
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Recent MCP client activity
components:
  schemas:
    ApiErrorResponse:
      type: object
      required:
      - success
      - error
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          $ref: '#/components/schemas/ProblemDetail'
    ProblemDetail:
      type: object
      properties:
        type:
          type: string
        title:
          type: string
          description: 'For application errors, a stable UPPER_SNAKE machine code (for example `NOT_FOUND`, `FORECAST_NOT_FOUND`, `VALIDATION_ERROR`). Clients branch on this, never on `detail` wording. A few transport level responses use a short human title instead.

            '
        status:
          type: integer
        detail:
          type: string
          description: 'Human-readable explanation; correlate a failure with `traceId`. A NOT_FOUND-family 404 names the resource type (for example "Company not found"), not its id. Some legacy messages still include an id (tracked in #2666).

            '
        instance:
          type: string
        traceId:
          type: string
        retryAfter:
          type: integer
          minimum: 0
          description: Whole seconds until retry is allowed for a 429 response
        errors:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
              message:
                type: string
        extensions:
          type: object
          additionalProperties: true
    McpJsonRpcRateLimitError:
      type: object
      required:
      - jsonrpc
      - id
      - error
      properties:
        jsonrpc:
          type: string
          enum:
          - '2.0'
        id:
          oneOf:
          - type: string
          - type: integer
          - type: 'null'
        error:
          type: object
          required:
          - code
          - message
          properties:
            code:
              type: integer
              enum:
              - -32000
            message:
              type: string
    McpJsonRpcRequest:
      type: object
      required:
      - jsonrpc
      - method
      properties:
        jsonrpc:
          type: string
          enum:
          - '2.0'
        id:
          oneOf:
          - type: string
          - type: integer
          - type: 'null'
        method:
          type: string
          description: MCP request or notification method.
        params:
          type: object
          additionalProperties: true
    McpJsonRpcResponse:
      type: object
      required:
      - jsonrpc
      - id
      properties:
        jsonrpc:
          type: string
          enum:
          - '2.0'
        id:
          oneOf:
          - type: string
          - type: integer
          - type: 'null'
        result:
          type: object
          additionalProperties: true
        error:
          type: object
          properties:
            code:
              type: integer
            message:
              type: string
  parameters:
    companyId:
      name: companyId
      in: path
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    serviceApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'Persistent credential for the configured cloud-bookkeeping service principal. The key must carry accountant:* and is accepted only on accountant operations that explicitly list this scheme. Ordinary API keys, and service keys presented to bearer-only operations, are denied.

        '
    refreshSessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_refresh
      description: 'Exact production HttpOnly refresh-session cookie. Local non-secure development uses median_refresh.

        '
    passkeyEnrollmentGrantCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_passkey_enrollment
      description: 'Exact production HttpOnly passkey-enrollment grant cookie. Local non-secure development uses median_passkey_enrollment.

        '
    webAuthnCeremonyCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_webauthn
      description: 'Exact production HttpOnly WebAuthn ceremony cookie. Local non-secure development uses median_webauthn.

        '
x-median-quarantined-authorities:
  decision: ADR-0001-model-a
  runtimeStatus: unmounted
  description: 'Migrations 267-272 modeled legal entities as separate company tenants. These paths are not runtime API authority while their preserved accounting math is re-keyed to legal entities inside one company workspace.

    '
  paths:
  - /companies/{companyId}/consolidation-groups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups/{rollupId}
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments/{adjustmentId}
x-median-demo-parity-customer-surface:
  runtimeStatus: mounted-lifecycle-only
  description: 'v2 customer-app capabilities available to JWT-authenticated members of any active or test company — the v2 app is the product, not a rollout cohort, so no allowlist applies to the markerless path. Production customer calls omit X-Median-App-Surface. Test-company calls may carry X-Median-App-Surface: qa to select the QA bundle; that marker branch alone still requires membership in CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS. An API key, unknown marker, malformed company id, inactive company, missing gate dependency, or failed company lookup receives the standard hidden-resource 404 contract. The held surfaces riding these prefixes (AR/AP, Forecast, Insights) carry their own additional allowlist gate — see x-median-forecast-hold and x-median-ar-ap-hold.

    '
  headerContract: '#/components/parameters/demoParityCustomerAppSurface'
  routePrefixes:
  - /companies/{companyId}/ar
  - /companies/{companyId}/ap
  - /companies/{companyId}/customers
  - /companies/{companyId}/vendors
  - /companies/{companyId}/contracts
  - /companies/{companyId}/receivables
  - /companies/{companyId}/entities
  - /companies/{companyId}/currencies
  - /companies/{companyId}/reporting-scopes
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/rollups
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/translation-adjustments
  - /companies/{companyId}/presentation-report-snapshots
  - /companies/{companyId}/reporting-trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/intercompany
  - /companies/{companyId}/weekly-email
  - /companies/{companyId}/forecast
  - /companies/{companyId}/books
  - /companies/{companyId}/sub-ledgers
x-median-forecast-hold:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Forecast is held. Beyond the lifecycle-only customer surface above, every operation under the prefix below also requires the company to appear in the held-surface allowlist CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS — the one operator-set list that opens AR/AP, Forecast and Insights (the legacy CUSTOMER_APP_FORECAST_COMPANY_IDS variable is no longer consulted). It is empty by default, so the v2 rollout alone never exposes Forecast. A company off the list receives the same hidden-resource 404 contract as one for which the surface does not exist. The auth-context featureFlags key `forecast` mirrors this verdict for the customer app shell.

    '
  featureFlag: forecast
  routePrefixes:
  - /companies/{companyId}/forecast
x-median-ar-ap-hold:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Receivables/Payables are held behind TWO required authorities. Beyond the lifecycle-only customer surface above, every operation under the prefixes below requires the company to appear in the held-surface allowlist CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS (requireDemoParityAllowlistedCompany) AND to satisfy the company_subledger_flags conversion chain (requireArApItemsEnabled — the same authority the public /pay page, aging and the accountant portal consult); failing either answers the opaque 404. The auth-context featureFlags key `arApItems` mirrors exactly that conjunction, resolved server-side, so the customer shell hides the Receivables/Payables nav and pages instead of offering menu entries these routes 404. Default is FALSE for every company while the list is empty or the conversion has not run.

    '
  featureFlag: arApItems
  routePrefixes:
  - /companies/{companyId}/ar
  - /companies/{companyId}/ap
  - /companies/{companyId}/customers
  - /companies/{companyId}/vendors
  - /companies/{companyId}/contracts
  - /companies/{companyId}/receivables
x-median-demo-parity-qa-only:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Strict test-company-only routes. Every interactive call requires X-Median-App-Surface: qa in addition to JWT authentication, the server allowlist, and persisted client_status=test. A copied header, API key, active company, missing gate dependency, or failed company lookup receives the standard hidden-resource 404 contract.

    '
  headerContract: '#/components/parameters/qaAppSurface'
  routePrefixes:
  - /companies/{companyId}/gl-accounts/{id}/monetary-classification
  - /companies/{companyId}/fx-account-roles
  - /companies/{companyId}/gl-periods/{periodId}/fx-revaluation
  - /accountant/companies/{customerId}/gl-accounts/{id}/monetary-classification
  - /accountant/companies/{customerId}/fx-account-roles
  - /accountant/companies/{customerId}/gl-periods/{periodId}/fx-revaluation
  - /accountant/companies/{customerId}/ar/{id}
  - /accountant/companies/{customerId}/ap/{id}
x-median-onboarding-v3-surface:
  runtimeStatus: promoted
  promotionFlag: ONBOARDING_V3_QA_ONLY=false
  description: 'Promoted. The deployment this contract describes runs ONBOARDING_V3_QA_ONLY=false, so none of the onboarding-v3 auth, pricing, or setup paths below requires X-Median-App-Surface: qa. An unmarked request is served and reaches ordinary authentication, so an unauthenticated call now answers 401 rather than the hidden-resource 404. Mounting is still conditional: with ONBOARDING_V3_ENABLED false every path below returns the hidden-resource 404 before body parsing or authentication. The header stays defined and is still honoured, because a deployment left at ONBOARDING_V3_QA_ONLY=true keeps requiring it on every path below and 404s unmarked traffic; setting that flag back to true is the rollback. On either setting the header is a pre-company bundle marker, never tenant authorization.

    '
  headerContract: '#/components/parameters/onboardingV3QaSurface'
  routePaths:
  - /auth/otp/start
  - /auth/otp/verify
  - /auth/passkeys/register/options
  - /auth/passkeys/register/verify
  - /auth/passkeys/assert/options
  - /auth/passkeys/assert/verify
  - /onboarding/v3/quote
  - /onboarding/v3/offer/resolve
  - /onboarding/v3/flow
  - /onboarding/v3/setup-intent
  - /onboarding/v3/subscribe
  - /onboarding/v3/test-account-activation
  - /onboarding/v3/checkout-session
  - /onboarding/v3/checkout-session/complete
  - /onboarding/v3/setup-state
  - /onboarding/v3/delegate-invites
  - /onboarding/v3/delegate-invites/{inviteId}
  - /onboarding/v3/delegate/resolve
  - /onboarding/v3/delegate
  - /onboarding/v3/task-context
  - /onboarding/v3/delegate/task-context
  - /onboarding/v3/banks/plaid/link-token
  - /onboarding/v3/banks/plaid/exchange
  - /onboarding/v3/banks/commit
  - /onboarding/v3/documents/google-workspace/auth-url
  - /onboarding/v3/documents/google-workspace/callback
  - /onboarding/v3/books/quickbooks/auth-url
  - /onboarding/v3/books/quickbooks/callback
  - /onboarding/v3/books/xero/auth-url
  - /onboarding/v3/books/xero/callback
  - /onboarding/v3/welcome-call
  - /onboarding/v3/welcome-call/embed
  - /onboarding/v3/books-progress
  - /onboarding/v3/books/open
  - /companies/{companyId}/onboarding/v3/questions
  - /companies/{companyId}/onboarding/v3/questions/{questionId}/answer
  - /companies/{companyId}/onboarding/v3/review-items