Authentication
Spot’s public profile API and public knowledge MCP server are anonymous and read-only. No API key or OAuth token is required. Send GET requests to https://spot.insure/api/v1/profile or connect a Streamable HTTP client to https://spot.insure/mcp. These interfaces expose published information only and are separate from customer account access at app.spot.insure.
Anonymous public access
GET https://spot.insure/api/v1/profile returns Spot’s published company and product profile as JSON. The https://spot.insure/mcp endpoint accepts MCP JSON-RPC messages over Streamable HTTP. See https://spot.insure/developers for connection examples.
This access is read-only. It cannot retrieve private company records or customer documents, prepare submissions, issue certificates, or buy, bind, or change insurance. It is not the authentication flow for app.spot.insure customer accounts.
Profile API limits and errors
The profile API applies a best-effort limit of 60 requests per minute for each client on each running server instance. Its RateLimit headers describe only the responding instance’s current window, not a deployment-wide quota. When the responding instance’s limit is exceeded, it returns HTTP 429 with Retry-After and a JSON error containing error, message, and resolution fields.
The optional include_pricing query parameter accepts true or false. Any other value returns HTTP 400 with error invalid_parameter.
MCP protocol and service limits
The MCP endpoint requires valid Streamable HTTP protocol headers and JSON-RPC messages. Legacy initialization is version-specific, so use the developer examples for the applicable connection flow. Spot validates Host and browser Origin headers, rejects request bodies larger than 64 KiB with HTTP 413, and returns protocol errors for invalid requests.
Retrieval tools remain available if answer generation is unavailable. ask_spot generation is limited to 10 attempts per minute per client and 1,000 attempts per UTC day across the deployment. It returns explicit limited or unavailable results for quota, configuration, generation, and timeout failures while retaining retrieved public sources.
Examples
Get the Public Spot Profile
curl --fail-with-body --silent --show-error \
--request GET 'https://spot.insure/api/v1/profile' \
--header 'Accept: application/json'