Finds documented REST operations for up to three plain-language tasks in one request.

This endpoint returns HTTP 503 when operation search is not configured for the API deployment. Check search availability before offering operation search in a client.

Each question counts against three fixed UTC-window budgets: 12 questions per Organization per minute, 300 per Organization per day, and 60 per minute across the deployment. A request with three tasks uses three questions from each budget. At most eight provider calls run concurrently across the deployment. These are initial defaults; operators can adjust them with API_DISCOVERY_ORG_QUESTIONS_PER_MINUTE, API_DISCOVERY_ORG_QUESTIONS_PER_DAY, API_DISCOVERY_GLOBAL_QUESTIONS_PER_MINUTE, and API_DISCOVERY_GLOBAL_IN_FLIGHT. All settings must be positive integers. Daily budgets reset at 00:00 UTC; minute budgets reset on UTC minute boundaries, which can allow a short burst across adjacent minutes. Calls rejected by a limit return HTTP 429 with a Retry-After header in seconds. A submitted call still counts if the provider fails. If admission is unavailable, the endpoint returns HTTP 503 instead of contacting the provider.

Pass operationIds to rank only those documented operations. The list must contain at least one unique, known METHOD /api/path ID. If you omit it, Polytomic ranks all documented operations. Every ranking also includes the no-match option. The response's sourceSha256 is the SHA-256 of the internal processed MCP spec artifact used to build the operation catalog. It is not the digest of the public OpenAPI document. Treat it as an opaque catalog version for detecting drift between the API and MCP deployments.

Each task has its own ranking in the same order as queries. The scores within one task describe the relative probability of choosing each operation as the single best option, including the no-match option. They are not independent relevance scores and cannot be compared across tasks.

If no documented operation is the best choice, matches is empty. Results come from the public API contract, not your Organization's data. Finding an operation does not authorize you to call it; the operation's own authentication and permissions still apply.