Developer Portal

Developers

RRM Academy runs a free, public API surface for AI agents and developers: a research library search, a grounded question-answering endpoint, OpenAPI 3.1 documentation, machine-readable discovery files, and a no-auth sandbox for integration testing.

Quickstart

Three steps from zero to your first authenticated call. Everything below is self-service and free.

  1. Step 1: Create a free account. Visit /signup. Email and password, or sign in with Google. Free for clinicians, researchers, and developers.
  2. Step 2: Generate an API key. Once signed in, open /account/mcp-keys and click Generate new key. Copy the token immediately, it is shown only once. Use it as an HTTP Authorization: Bearer YOUR_API_KEY header.
  3. Step 3: Make your first request. No key is needed to reach the liveness probe. Confirm connectivity first, then call an authenticated endpoint.

The unauthenticated health check returns the literal string ok:

curl https://rrmacademy.org/health
# ok

An authenticated search call against the MCP server:

curl -X POST https://mcp.rrmacademy.org/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0", "id": 1, "method": "tools/call",
    "params": {
      "name": "search",
      "arguments": { "query": "endometriosis excision outcomes" }
    }
  }'

API keys

Keys are self-service. Issue and revoke them yourself at /account/mcp-keys. There is no approval step and no support ticket.

  • Auth model - Bearer token in the HTTP Authorization header. Free with any RRM Academy account.
  • Issuance - Self-service at /account/mcp-keys. Label each key for where you use it.
  • Rotation - Generate or revoke any time. Revocation is immediate; other keys keep working.

The full authentication flow, scopes, and code samples for curl, Python, and Node.js are in the agent auth guide.

Documentation

The API is documented for both humans and machines. Every surface below is public and stable.

Sandbox

The API includes a no-auth sandbox endpoint for the question-answering contract at POST /api/ask/sandbox. It returns a canned, deterministic response with no authentication, no rate limit, no LLM invocation, and no data mutation, so it is safe to call from any client any number of times. It accepts the same JSON shape as /api/ask but ignores the request body. Use it to validate that your client correctly parses the answer shape before you integrate with the authenticated endpoint.

curl -X POST https://rrmacademy.org/api/ask/sandbox \
  -H "Content-Type: application/json" \
  -d '{ "message": "test" }'

# {
#   "sandbox": true,
#   "answer": "Sandbox response. ...",
#   "citations": [ ... ]
# }

Every sandbox response carries an X-Sandbox: true header. Set Accept: text/event-stream for the Server-Sent Events variant, which emits the same payload followed by a [DONE] event. The sandbox is also described under info.x-sandbox in the OpenAPI spec.

Rate limits

Authenticated API responses carry standard rate-limit headers so your client can pace itself without guessing:

  • RateLimit-Limit - requests allowed in the current window.
  • RateLimit-Remaining - requests left in the current window.
  • RateLimit-Reset - seconds until the window resets.

A 429 response means you have hit the limit. Back off and retry with exponential jitter. The no-auth sandbox is not rate limited.

Related developer pages