The TokenRoster API.
A public, read-only REST API for the TokenRoster registry — companies, DAOs, nonprofits, accelerators, incubators, VCs, tokens, people, and assessment programs. No API key, no authentication, no rate-limit paperwork.
The base URL is https://tokenroster.com. Every endpoint is an unauthenticated GET returning JSON in a { data, pagination? } envelope. The full machine-readable contract lives at /openapi.json.
curl "https://tokenroster.com/api/v1/companies?page=1&pageSize=5"
{
"data": [
{ "id": "example-co", "name": "Example Co", "symbol": "EXC", ... }
],
"pagination": { "page": 1, "pageSize": 5, "pageCount": 12, "total": 58 }
}curl "https://tokenroster.com/api/v1/companies/example-co"
{
"data": {
"company": { "id": "example-co", "name": "Example Co", ... },
"distribution": { ... },
"proposals": [ ... ],
"positions": [ ... ],
"capTable": [ ... ]
}
}TokenRoster runs an MCP (Model Context Protocol) server over the Streamable HTTP transport at https://tokenroster.com/api/mcp — no authentication required. It exposes the registry as tools: list_companies, get_company, list_people, get_person, list_frameworks, get_framework (plus list_scoring_frameworks, get_scoring_framework, list_program_frameworks, and get_program_framework for one kind), and get_registry_stats. The manifest lives at /.well-known/mcp.json.
A second, authenticated MCP server at https://tokenroster.com/api/manage/mcp covers manage flows for your own listings: list_my_companies, list_my_documents, get_credits, upload_document, and running assessment reports (start_report_run, execute_report_run, get_report_run_status, get_report). It requires a Authorization: Bearer header with a personal access token — create one at /manage/tokens; see the authentication guide.
{
"mcpServers": {
"tokenroster": {
"type": "streamable-http",
"url": "https://tokenroster.com/api/mcp"
},
"tokenroster-manage": {
"type": "streamable-http",
"url": "https://tokenroster.com/api/manage/mcp",
"headers": {
"Authorization": "Bearer trpat_..."
}
}
}
}Every non-2xx response is structured JSON — never an HTML error page. Branch on error.code (bad_request, not_found, method_not_allowed, internal_error); error.hint says how to resolve it.
curl "https://tokenroster.com/api/v1/companies/does-not-exist"
{
"error": {
"code": "not_found",
"message": "No company with slug \"does-not-exist\".",
"hint": "List valid slugs with GET /api/v1/companies — the `id` field of each item is its slug."
}
}The v1 API and registry MCP server are read-only and serve only public registry data, so they require no credentials of any kind. Owner-scoped access — your companies, documents, and report runs — goes through the manage MCP server at /api/manage/mcp with a personal access token created at /manage/tokens, sent as Authorization: Bearer. The authentication guide has the details. OAuth 2.0 for API clients is planned as an issuance layer on top of the same tokens.
The API is versioned in the URL (/api/v1). Within v1, changes are additive only — new fields and endpoints may appear, but existing fields, parameters, and response shapes will not change or disappear. Breaking changes ship as a new version (/api/v2) with v1 kept running in parallel. If an endpoint is ever deprecated, its responses will carry Deprecation and Sunset headers at least 90 days before removal, and the change will be noted here and in the OpenAPI spec.
Found a gap in the docs or need an endpoint that isn’t here yet? Get in touch.