Why every call is a POST

Every endpoint of this API takes a POST with a JSON body, including the ones that only read. That is deliberate.

One operation, two ways in

Each operation is declared once and offered twice: as an MCP tool for agents and as a REST endpoint for your programs. A tool takes its arguments as one JSON object. The endpoint takes exactly the same object as its body. There is no second shape to learn, and nothing to translate between query strings, path parameters and a body.

Nothing worth hiding in a URL

URLs end up in places a body does not: proxy and server logs, browser history, monitoring, error reports. A domain name, a customer number or a search term is safer in a body. The path only names the operation (/v1/domain/list), never the subject.

What the method does not tell you, the operation does

GET vs. POST is a coarse promise: "reads" or "may change something". Each operation here states more than that, on its page and in the description:

• Side effect: read, write or destructive.
• Idempotent: whether calling it twice changes nothing more than calling it once.

A reading operation stays safe to repeat, even though it is a POST.

In practice

• Send Content-Type: application/json. A missing body counts as {}.
• A field the operation does not know is refused, with its path, instead of being ignored.
• Clients and proxies do not cache a POST, so every answer is current.