HEDGR API documentation and developer resources

HEDGR developer documentation: the HEDGR OpenAPI specification, the HEDGR MCP server, OAuth 2.1 authentication, API versioning, and the typed error model. Every public HEDGR API surface, at a predictable URL.

HEDGR OpenAPI specification

OpenAPI 3.0 specification: https://hedgr.app/openapi.json
Covers the public REST surface (health checks, public FX reference rates, OAuth discovery metadata) and the MCP endpoint.
Every operation has a unique operationId, a description, and named component schemas, so it works directly with LLM function-calling toolchains and OpenAPI generators.
The full HEDGR MCP tool list, with input schemas, is embedded on the POST /mcp operation as x-mcp-tools.
RFC 9727 API catalog listing every HEDGR API surface: https://hedgr.app/.well-known/api-catalog

HEDGR MCP server

Endpoint: https://hedgr.app/mcp. Transport: Streamable HTTP (JSON-RPC 2.0).
Discovery: GET https://hedgr.app/mcp returns capabilities, supported protocol versions, the tool list, and the MCP Apps surface. No authentication required.
Well-known aliases: https://hedgr.app/.well-known/mcp and https://hedgr.app/.well-known/mcp/server-card.json
The handshake is anonymous: initialize, ping, tools/list, resources/list, and resources/read all answer without a token, so an agent can evaluate the server before asking a user for consent.
27 read-only tools covering FX exposure, cash position, hedge portfolio, P&L attribution, market regimes, policy, cashflow timing and forecasting, and data quality.
MCP Apps (SEP-1865): get_fx_exposure renders an interactive exposure radar via the ui://hedgr/fx-exposure-radar resource in supporting hosts.
Human-readable MCP documentation: https://hedgr.app/docs/mcp

HEDGR API authentication

Calling an MCP tool (tools/call) requires OAuth 2.1: authorization code flow with PKCE (S256) and dynamic client registration (RFC 7591).
Scope: fx:read. Read-only. No HEDGR tool executes a trade, moves funds, or writes to an accounting system.
Authorization server metadata (RFC 8414): https://hedgr.app/.well-known/oauth-authorization-server
Protected resource metadata (RFC 9728): https://hedgr.app/.well-known/oauth-protected-resource/mcp
Registration endpoint: https://hedgr.app/mcp/oauth/register. Self-serve, no sales contact required.
An unauthenticated tools/call returns 401 with a WWW-Authenticate header naming the protected-resource metadata, so a client can bootstrap the flow from any failed call.

HEDGR API versioning and errors

Every /api response carries a Hedgr-API-Version header naming the contract that answered it. The current version is 2026-08-22.
Clients may pin by sending the same header. An unrecognised version is rejected with 400 rather than silently served the current shape.
Retirement is signalled with the standard Deprecation (RFC 9745) and Sunset (RFC 8594) response headers before removal.
Errors use a consistent typed object: {"error": "human-readable message"}, documented as the ApiError schema in the OpenAPI specification.
The MCP endpoint versions separately, per request, via the JSON-RPC protocolVersion field.

Machine-readable HEDGR resources

Agent instructions: https://hedgr.app/agent.txt
Agent index: https://hedgr.app/llms.txt
Structured product facts: https://hedgr.app/product-facts.json
Pricing in markdown: https://hedgr.app/pricing.md
Documentation home: https://hedgr.app/docs

Scope of the public API

The surface documented above is the whole public HEDGR API: the MCP endpoint, the public health and reference-rate routes, and the discovery metadata.
/api/* is otherwise the authenticated namespace behind the Hedgr web app, not an open public API, and is excluded from indexing. It carries session-specific behaviour and is not needed for integration or evaluation.
Webhooks at HEDGR are inbound integrations from connected providers. HEDGR does not currently offer outbound webhook subscriptions to customers.
Integrate through the MCP endpoint, or contact [email protected] to discuss an authenticated partner workflow.

Boundary: HEDGR provides analytics and planning visibility. It does not execute trades, move funds, provide investment advice, or guarantee financial outcomes.