---
title: "Send one MCP JSON-RPC message"
method: POST
path: "/v1/commerce/mcp"
---

# Send one MCP JSON-RPC message

`POST /v1/commerce/mcp`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/commerce/mcp`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`

Every request authenticates through the Decionis authority, which checks
Accounts-issued OAuth access against current source authority. Caller
organization headers cannot establish authority. Query credentials and
browser Origin headers are rejected. Supply exactly one Authorization or
x-api-key header. Requests
have a 100 KiB body limit and finite processing, authority and rate-store
bounds. This transport does not support batch messages, GET event streams
or resumable sessions. Notifications return 202 without a response body.

## Headers

- `MCP-Protocol-Version` '2025-03-26' | '2025-06-18' | '2025-11-25'

## Request body

- object
  - `jsonrpc` '2.0', required
  - `id` union
    - string
    - number
  - `method` string, required
  - `params` object

## Response `200`

JSON-RPC result or protocol error

- object
  - `jsonrpc` '2.0', required
  - `id` union, required
    - string
    - number
  - `result` unknown
  - `error` object

## Other responses

- `202`: Accepted notification; empty body
- `400`: Malformed, unsupported or out-of-bounds request
- `401`: Missing, invalid or revoked credential
- `403`: Origin, organization, role, scope, tool or OAuth resource denied
- `413`: Request body exceeds 100 KiB
- `415`: Content-Type must be application/json
- `429`: Rate limit exceeded; Retry-After and X-RateLimit headers included
- `503`: Authority, durable limiter or storage unavailable, or capacity exhausted

---

[API](https://skmtc.dev/decionis/apis/decionis-commerce-gate-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-commerce-gate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-commerce-gate-api/revisions/9fecb7109bf8?raw)