Research, connected.

01

Your first research query

Search the catalog and follow each result back to its scientific source. Keep your key on your server, outside browser code.

curl -H "Authorization: Bearer $ONCORADAR_API_KEY" \
  "https://api.oncoradar.net/api/v1/search?q=EGFR+lung+cancer&limit=20"

The original scientific source remains the authority. Search order and similarity do not measure clinical evidence.

02

Authentication and scopes

Authenticate with an OncoRadar API key in the Bearer header. Every operation checks project permissions and current legal acceptance.

Authorization: Bearer okr_your_api_key
Accept: application/json

Core scopes

Resource routes

The API exposes studies, clinical trials, signals, collections, alerts and research synthesis.

GET /api/v1/studies/{id}
GET /api/v1/trials/{nctId}

03

Pagination and errors

Pass the opaque cursor from a response unchanged to the next request. Use a new search when filters change. SDK retries are limited to safe reads and retryable responses.

{
  "error": { "code": "…", "message": "…" },
  "requestId": "…"
}

04

Signed webhooks

Delivery is at least once. Verify the signature over the raw timestamp.payload bytes, reject timestamps outside a five-minute window, and atomically deduplicate the delivery before applying effects. Valid duplicates should return 2xx.

X-OncoRadar-Signature
X-OncoRadar-Delivery
Idempotency-Key

Destinations must use public HTTPS and must not resolve to private or reserved networks. The repository webhook guide covers receiver examples, retries and versioned key rotation.

05

MCP for research tools

Send JSON-RPC requests using your API key. Tools and resources are filtered by scopes, bounded and licensing-aware. The endpoint does not advertise OAuth.

Protocol version: 2025-06-18

POST /api/mcp

oncoradar://study/{id}
oncoradar://trial/{nctId}
oncoradar://collection/{id}
oncoradar://topic/{id}

06

SDKs

TypeScript and Python SDK source lives in the repository. These are source artifacts, not published packages. They include API-key authentication, safe retries, paginators and REST/MCP helpers.