curl and direct HTTP

Use direct HTTP when you control the API-key call path. Use MCP at https://mcp.assets.hoistai.com/mcp when a host needs OAuth consent and tool discovery.

REST health probe

terminal

curl https://api.assets.hoistai.com/v1/_health

REST authenticated call

terminal

export HOIST_API_KEY=ha_live_xxxxxxxxxxxxxxxxxxxxxxxx

curl https://api.assets.hoistai.com/v1/abn/11695718659 \
  -H "Authorization: Bearer $HOIST_API_KEY"

PPSR contracts

PPSR preview and paid-search contracts are documented but not currently customer-accessible. Preview requests fail closed with 503, no price, and no register dispatch. Hoist does not publish a runnable PPSR command while preview and paid search are unavailable; use AFSA direct for a PPSR search today.

MCP endpoint

MCPhttps://mcp.assets.hoistai.com/mcp

MCP calls require an OAuth token with the matching scopes. If you are building a custom host, discover metadata at https://mcp.assets.hoistai.com/.well-known/oauth-authorization-server.

Troubleshooting

• 401 without a token is expected on protected REST routes.
• 401 with a token usually means the token is expired, malformed, or issued for the wrong audience.
• 403 usually means the token is valid but lacks scope, account access, or source readiness.