CoverageUnlocked API

API Reference

Denial pattern data and appeal economics over MCP (JSON-RPC over HTTP) with OAuth 2.1 authentication. 17,440 CPT codes, 482 hand-curated denial profiles, 20+ payer behavioral profiles, 15 state regulatory profiles. Every response carries a data-provenance block.

Quick Start

# Look up denial data for a CPT code

curl -X POST https://app.coverageunlocked.com/api/mcp \

-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \

-H "Content-Type: application/json" \

-d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "denial_lookup", "arguments": {"cpt_code": "27447", "payer_id": "uhc"}}}'

Authentication

OAuth 2.1 — dynamic client registration, PKCE required

OAuth 2.1 (primary)

Register a client at /api/oauth/register (RFC 7591, anonymous registration permitted), then run the authorization-code flow with PKCE S256 at /api/oauth/authorize and exchange the code at /api/oauth/token. Access tokens live 1 hour; refresh tokens rotate on each use. Consent approval is currently manual — email ned@coverageunlocked.com after registering and you'll have it same-day. Revoke at /api/oauth/revoke (RFC 7009).

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Discovery metadata: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource. MCP clients that support the spec's auth flow can connect by URL alone.

Legacy bearer keys (cu_*)

Earlier enterprise integrations authenticate with cu_* bearer keys. These still work but are on a deprecation runway — new integrations should use OAuth. Legacy keys are not tier-metered and cannot use the self-serve upgrade flow.

Endpoints

These two tools are the v1 surface. Additional tools ship behind the same endpoint as they clear production validation — the tool list is discoverable at runtime via the standard MCP tools/list method, so your client picks them up without a code change. Prefer a local server for development? npx coverageunlocked-mcp runs the same two tools over stdio.

Rate Limits

Tiers differ on volume and rate only — every tier queries the full 17,440-code denial database. No data paywall. Exceeding your per-minute rate or monthly cap returns a JSON-RPC error with a Retry-After header.

Free

100 calls/mo · 10/min · 30 days

Starter

1,000 calls/mo · 30/min · $99/mo

Pro

10,000 calls/mo · 100/min · $199/mo

Scale

100,000 calls/mo · 300/min · $499/mo

Above 100K calls/month? Enterprise adds self-hosted deployment, white-label, BAA execution, and custom SLA.

Ready to integrate? Register a client — Free tier, no sales call.

Get Started