Skip to content

Overview

REST v1 for hosted hyperresearch runs, vault access, verification, and billing. Times are RFC 3339 UTC; ids are prefixed ULIDs.

Authentication. Send an API key as Authorization: Bearer hr_live_…. Each operation lists the scope it needs (x-hr-scope, and in its security requirement). OAuth 2.1 (authorization code + PKCE, oauth2 scheme) issues tokens for the hosted MCP server at https://mcp.hyperresearch.ai/mcp; REST calls use an API key.

Errors. Every 4xx/5xx body is the ErrorEnvelope: error.type, a stable error.code, a human message, the offending param when there is one, and the request_id to quote to support. Branch on code, never on message.

Rate limits. Responses carry RateLimit-Policy and RateLimit (draft-ietf-httpapi-ratelimit-headers) alongside the older X-RateLimit-* headers. A 429 always carries Retry-After (seconds) and error.retry_after.

Versioning. The version is in the path. /v1 is stable: within it, changes are additive only (new operations, new optional request fields, new response fields, new enum values a client must tolerate). A breaking change ships only under a new path version. A deprecated operation is marked deprecated: true here and answers with Deprecation (RFC 9745) and Sunset (RFC 8594) headers and Link: rel="deprecation" at least six months before it is removed, and is listed under Deprecations on the policy page: https://hyperresearch.ai/docs/versioning

hyperresearch API documentation

Information

  • OpenAPI version: 3.1.0

An API key: hr_live_… (billed), hr_test_… (fixture mode, free), or hr_chat_… (vault chat only).

Security scheme type: http

Console session cookie (HttpOnly, set by POST /v1/auth/clerk/exchange). Mutations also require an allowlisted Origin and the X-CSRF-Token header. The requirement list names the workspace-role scope the session must carry.

Security scheme type: apiKey

Cookie parameter name: hr_session