Developer portal

Authentication and scopes

Use an OncoRadar API key in the Bearer header. This is API-key authentication, not OAuth. Each operation enforces project scopes and current legal acceptance.

Authorization: Bearer okr_your_api_key
Accept: application/json

Core scopes: search:read, studies:read, signals:read, collections:read/write, alerts:read/write, synthesis:write, webhooks:read/write.

REST quickstart

curl -H "Authorization: Bearer $ONCORADAR_API_KEY" \
  "https://api.oncoradar.net/api/v1/search?q=EGFR+lung+cancer&limit=20"

Canonical routes include /api/v1/studies/{id}, /api/v1/trials/{nctId}, signals, collections, alerts and synthesis.

Pagination and errors

Pass the opaque cursor from one search response unchanged to the next request. Do not parse or reuse it with different filters. Errors use {"error":{"code":"…","message":"…"},"requestId":"…"}. SDK retries are limited to safe reads and retryable status codes.

SDKs

Source SDKs are available in sdks/typescript and sdks/python. They are repository artifacts only and are not published packages. Both include API-key auth, safe retries, paginators and REST/MCP helpers.

Signed webhooks

Delivery is at-least-once: verify X-OncoRadar-Signature over the raw timestamp.payload bytes, reject timestamps outside ±5 minutes, and atomically deduplicate with X-OncoRadar-Delivery or Idempotency-Key before applying effects. Valid duplicates should return 2xx.

Destinations must use public HTTPS and cannot resolve to private or reserved networks. See docs/webhooks.md in the repository for receiver examples, retry behavior and versioned key rotation.

MCP 2025-06-18

POST JSON-RPC to /api/mcp using an API key. Tools and oncoradar://study/trial/collection/topic resources are filtered by scopes, bounded and licensing-aware. The endpoint does not advertise OAuth.