API & MCP reference

Auth

Every request - REST or MCP - authenticates with an API key as a bearer token:

Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Create a key from Settings → API keys. The full secret is shown exactly once, at creation time - Reconmark stores only a hash, so if you lose it you'll need to revoke it and create a new one. API access is a paid-plan feature.

A missing or invalid key returns 401 with error.code = "invalid_api_key". A key that's over its rate limit returns 429 - see Rate limits.

Envelope & errors

Every list endpoint returns data plus a meta pagination block:

{
  "data": [ { "id": "SAM-2026-00123", "title": "IT Support Services", ... } ],
  "meta": { "page": 1, "pageSize": 10, "total": 342, "totalPages": 35 }
}

Single-resource endpoints (e.g. GET /opportunities/{id}) return just data, no meta. Every error - on any 4xx/5xx, from any endpoint - has the same shape, never a bare string:

{ "error": { "code": "rate_limited", "message": "Rate limit exceeded. Retry after 12 seconds." } }

Rate limits

Every key has a per-minute limit - 60 requests/min by default, shown per-key in Settings. Every response carries the current state:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 47
X-RateLimit-Reset: 1751500860

X-RateLimit-Resetis unix seconds for the start of the next window. When you're over the limit you get 429 plus a Retry-After header (seconds). The limit is a fixed one-minute window shared across REST and MCP - calling a tool over MCP counts against the same budget as calling the equivalent REST route.

Endpoints

All routes are under /api/v1, read-only, paginated with page (default 1) and pageSize (default 20, max 100).

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/opportunities?naics=541512&setAside=8A&sort=closes&dir=asc&pageSize=10"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/opportunities/cd997119e32f4adfbcfc2dfbb6f2812a"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/recompetes?months=12&naics=541512&sort=ends"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/agencies?sort=activeSolicitationsCount&dir=desc"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/agencies/097.97AS"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/companies?q=lockheed"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/companies/G4KDGE4JFFK7"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/vehicles?naics=541512&sort=ceiling"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/vehicles/80JSC023DA004"

curl -H "Authorization: Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  "https://reconmark.io/api/v1/pipeline?status=bidding"

MCP setup

Reconmark also exposes an MCP server at /api/mcp (Streamable HTTP transport) with five tools that wrap the same query functions as the REST API above - no separate data path, same API key, same rate limit.

{
  "mcpServers": {
    "reconmark": {
      "url": "https://reconmark.io/api/mcp",
      "headers": { "Authorization": "Bearer rm_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" }
    }
  }
}

That's Claude Desktop's remote-MCP config shape - other Streamable HTTP clients use the same URL + header. Reconmark doesn't ship a stdio bridge, so a stdio-only client would need its own local proxy.