Portal para desarrolladores

Autenticación y permisos

Usa una API key de OncoRadar en la cabecera Bearer. Es autenticación por API key, no OAuth. Cada operación aplica permisos del proyecto y exige aceptación legal vigente.

Authorization: Bearer okr_your_api_key
Accept: application/json

Core scopes: search:read, studies:read, signals:read, collections:read/write, alerts:read/write, synthesis:write, webhooks:read/write.

Inicio rápido REST

curl -H "Authorization: Bearer $ONCORADAR_API_KEY" \
  "https://api.oncoradar.net/api/v1/search?q=EGFR+lung+cancer&limit=20"

Canonical routes include /api/v1/studies/{id}, /api/v1/trials/{nctId}, signals, collections, alerts and synthesis.

Paginación y errores

Pass the opaque cursor from one search response unchanged to the next request. Do not parse or reuse it with different filters. Errors use {"error":{"code":"…","message":"…"},"requestId":"…"}. SDK retries are limited to safe reads and retryable status codes.

SDKs

Source SDKs are available in sdks/typescript and sdks/python. They are repository artifacts only and are not published packages. Both include API-key auth, safe retries, paginators and REST/MCP helpers.

Webhooks firmados

Delivery is at-least-once: verify X-OncoRadar-Signature over the raw timestamp.payload bytes, reject timestamps outside ±5 minutes, and atomically deduplicate with X-OncoRadar-Delivery or Idempotency-Key before applying effects. Valid duplicates should return 2xx.

Destinations must use public HTTPS and cannot resolve to private or reserved networks. See docs/webhooks.md in the repository for receiver examples, retry behavior and versioned key rotation.

MCP 2025-06-18

POST JSON-RPC to /api/mcp using an API key. Tools and oncoradar://study/trial/collection/topic resources are filtered by scopes, bounded and licensing-aware. The endpoint does not advertise OAuth.