product_api
[Requires authentication] Call the authenticate tool first to start or confirm 1inch Business login (initialize 200 is still anonymous). If authenticate or this tool returns HTTP 401, complete OAuth, then retry. Call any 1inch product API endpoint using the authenticated user's credentials (base ...
This record as markdown: /tools/com-1inch-business-mcp/product-api.md
What product_api does on 1inch MCP
AI agents call product_api to permanently remove resources in 1inch MCP, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.
| Parameter | Type | Required | Description |
|---|---|---|---|
body | object | — | Request body for POST requests |
path | string | Yes | API path (e.g. /portfolio/portfolio/v5.0/general/current_value — unified gateway prefix) |
query | object | — | Query parameters as key-value pairs |
method | string | — | HTTP method |
Parameters from the server's own tool schema.
Why product_api is rated Critical
An AI agent that decides to call product_api doesn't hesitate, doesn't double-check, and doesn't stop at one. Whatever it removes from 1inch MCP is gone. There is no undo for destructive operations.
Risk signalsAccepts file system path (path) · Accepts raw HTML/template content (body)
Attacks that exploit this kind of access
The rule that runs product_api safely
PolicyLayer is an MCP gateway: it sits between your AI agents and 1inch MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For product_api, this is the rule to start with:
product_api is removed from the agent's tool list entirely, so the agent never calls it. The rest of the server keeps working.
The button opens the PolicyLayer dashboard: create your workspace, connect 1inch MCP, apply this rule, and every product_api call is checked against it from then on.
Questions about product_api
[Requires authentication] Call the authenticate tool first to start or confirm 1inch Business login (initialize 200 is still anonymous). If authenticate or this tool returns HTTP 401, complete OAuth, then retry. Call any 1inch product API endpoint using the authenticated user's credentials (base URL is the unified gateway, e.g. https://api.1inch.com). Call authenticate first. Anonymous sessions get HTTP 401 (OAuth), not x402. After a real org login, quota-exhausted routes may return a PaymentRequired tool result; retry with a signed payment in _meta["x402/payment"] (batch-settlement scheme only — see file://1inch-mcp/guides/x402-payments). Do not treat PaymentRequired as login. Optional: if your client can read MCP resources, file://1inch-mcp/guides/api-index has live Swagger links and extra gateway notes (mirrors business.1inch.com/portal/llms.txt). Common chain IDs: Ethereum=1, BNB=56, Polygon=137, Arbitrum=42161, Optimism=10, Base=8453, Avalanche=43114, Gnosis=100, zkSync=324, Linea=59144, Sonic=146, Unichain=130, Cronos=25, Monad=10143, Solana=501 (where applicable). Gateway products (use these path prefixes with this tool): - Portfolio: /portfolio/portfolio/v5.0/... — example path="/portfolio/portfolio/v5.0/general/current_value", query={"addresses":"0x..."}; token metrics path="/portfolio/portfolio/v5.0/tokens/metrics", query={"addresses":"0x...","timerange":"1year"} - Balance: /balance/v1.2/{chainId}/... — example path="/balance/v1.2/1/balances/0x..." - Spot Price: /price/v1.1/{chainId} — example path="/price/v1.1/1", method="POST", body={"tokens":["0x..."],"currency":"USD"} - Token: /token/v1.4/{chainId}/... — example path="/token/v1.4/1/search", query={"query":"USDC"} (prefer v1.4; older v1.2 chain search is deprecated in OpenAPI) - Token Details: /token-details/v1.0/details/{chain}/{tokenAddress} — example path="/token-details/v1.0/details/1/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48" - Gas Price: /gas-price/v1.6/{chainId} — example path="/gas-price/v1.6/1" - Swap (Classic): /swap/v6.1/{chainId}/... — example path="/swap/v6.1/1/quote", query={"src":"0x...","dst":"0x...","amount":"..."} (exact query names per OpenAPI) - Orderbook: /orderbook/v4.1/{chainId}/... — example path="/orderbook/v4.1/1/all", query={"page":"1","limit":"10"} - Fusion (Intent): /fusion/orders/v2.0/..., /fusion/quoter/v2.0/..., /fusion/relayer/v2.0/... — example path="/fusion/quoter/v2.0/1/quote/receive" with required query params from spec - Fusion+ (Cross-chain): /fusion-plus/orders/..., /fusion-plus/quoter/..., /fusion-plus/relayer/... — example path="/fusion-plus/quoter/v1.2/quote/receive" with required params; equivalent routes also exist under /cross-chain/orders|quoter|relayer - History: /history/v2.0/history/{address}/events — example path="/history/v2.0/history/0x.../events", query={"chainId":"1","limit":"50","tokenAddress":"0x..."} (optional tokenAddress filters by contract; response shape uses items[].details.txHash — not raw event logs) - Traces: /traces/v1.0/chain/{chainId}/block-trace/{blockNumber}/tx-hash/{txHash} — example path="/traces/v1.0/chain/1/block-trace/18000000/tx-hash/0x..." (not /transaction/{hash}) - NFT: /nft/v2/... — example path="/nft/v2/byaddress", query={"chainIds":"1","address":"0x..."} - Charts: /charts/v1.0/chart/line/{token0}/{token1}/{period}/{chainId} — example path="/charts/v1.0/chart/line/0x.../0x.../24H/1" (period: 24H, 1W, 1M, 1Y, AllTime; not a separate timerange query) - Domains: /domains/... — example path="/domains/v2.0/lookup", query={"name":"vitalik.eth"} - Aqua (strategy analytics): /aqua/v1.0/strategies/... — example path="/aqua/v1.0/strategies/opened", query={"limit":"100"}; maker stats path="/aqua/v1.0/strategies/makers/0x.../stats". Prefer the dedicated "aqua" tool when Unleash flag mcp-service.tool.aqua is enabled; otherwise use product_api for raw HTTP. - Tx Gateway: /tx-gateway/... — example path="/tx-gateway/v1.1/1/broadcast", method="POST", body={...} - Web3 RPC: /web3/{chainId}/... — JSON-RPC over HTTP POST to an EVM (or Solana 501) node; Gateway exposes e.g. 1,10,25,56,100,130,137,143,146,324,501,8453,42161,43114,59144 — confirm availability for your org/plan. Example path="/web3/1", method="POST", body={"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]} Gotchas: Portfolio gateway path repeats "portfolio" (/portfolio/portfolio/v5.0/...) because the gateway strips the first segment. Spot Price returns WEI in native currency unless you set currency. Token list responses are large; prefer search. Token Details does not support native ETH pseudo-address 0xeeee...eeee; use WETH. Balance responses may include zero balances—filter client-side. For limit order flows (build, sign, create, cancel), prefer the "orderbook" tool. For swap execution, prefer the "swap" tool. Use product_api for direct REST access to any endpoint. It is categorised as a Destructive tool in the 1inch MCP MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.
product_api accepts 4 parameters: body, path, query, method. Required: path. The full parameter table on this page comes from the server's own tool schema.
Register the 1inch MCP server in PolicyLayer and add a rule for product_api: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches 1inch MCP. Nothing to install.
product_api is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the product_api rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for product_api. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
product_api is provided by the 1inch MCP server (https://api.1inch.com/mcp/protocol). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on 1inch, and thousands of servers like it.
Across the catalogue