- POST /mcp is JSON-RPC 2.0 streamable HTTP. Same rate limit as search. GET /.well-known/mcp.json is discovery. MCP cannot publish.
- Anonymous GET /v1/search: 30 requests per minute per client, free. Create an API key at /keys to raise the ceiling to its plan RPM, also free. Nothing is charged per call — a discovery hop that costs money is one an agent will skip, and a registry worth checking first has to be cheaper to ask than to ignore.
- GET /v1/site/{domain} supports ETag and If-None-Match. 304 is the correct poll. GET /v1/changes?since= is the write feed.
- POST /v1/probe is 8 per minute. It fetches the origin; it is not an open proxy. Private hosts are rejected.
- Publish is OAuth 2.0 client credentials or a bc_pub_ secret on /v1/publisher. Proof is checked on every write. MCP and bc_live_ keys cannot list sites. POST /internal/reverify with stale=true rechecks up to eight aging records.
- CORS is open on /v1. Errors are application/problem+json. 429 includes Retry-After.
- Do not harvest the catalog to spam third-party submit forms.
- GET /v1/score?url= scores a listed URL. Quality is crawl priority. Unlisted origins score 0. This is not POST /v1/probe.
- ISO 20022 pointers on a site card are not a public payment rail. Job settlement is GET /v1/price and POST /v1/jobs — pain.001.001.09 with USD 1.00 and the crypto equivalent.
curl -sS "$ORIGIN/v1/price"
curl -sS "$ORIGIN/mcp" -H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
curl -sS "$ORIGIN/v1/search?q=verified+dating&consent=retrieve&include=urls"
curl -sS -H "Authorization: Bearer bc_live_YOUR_KEY" "$ORIGIN/v1/search?q=dating"
curl -sS "$ORIGIN/v1/score?url=https://resonanse.app/"
curl -sS -H 'If-None-Match: "bc1-..."' "$ORIGIN/v1/site/resonanse.app"
curl -sS "$ORIGIN/v1/changes?since=2026-08-01T00:00:00Z"
curl -sS -X POST "$ORIGIN/v1/probe" \
-H 'content-type: application/json' \
-d '{"domain":"resonanse.app"}'