HTTP behavior

Call the API from your server or scripts. Browsers block calls from other websites because CORS is not enabled.

Each endpoint accepts only the methods shown in the reference. Other methods return 405 with an Allow header that lists the supported ones. The MCP endpoint and the OAuth token, registration and revocation endpoints accept POST only.

Request bodies can be up to 1,048,576 bytes. Larger requests return 413.

Send each query parameter only once. Repeated parameters are rejected.