product_api
[Requires authentication] This tool needs OAuth. If it returns an authentication error, prompt the user to connect/authenticate this MCP server (OAuth), then retry. Call any 1inch product API endpoint using the authenticated user's credentials (base URL is the unified gateway, e.g. https://api.1i...
This record as markdown: /tools/com-1inch-business-mcp/product-api.md
What product_api does on 1inch MCP
AI agents use product_api to commit financial operations through 1inch MCP, usually the final step of a payment, billing, or trading workflow. A call moves real money.
| Parameter | Type | Required | Description |
|---|---|---|---|
body | object | — | Request body for POST requests |
path | string | Yes | API path (e.g. /portfolio/portfolio/v5.0/general/current_value — unified gateway prefix) |
query | object | — | Query parameters as key-value pairs |
method | string | — | HTTP method |
Parameters from the server's own tool schema.
Why product_api is rated Critical
This tool can call ANY 1inch API endpoint with authenticated user credentials, including swap, limit orders, cross-chain swaps, and other financial operations exposed by 1inch. Given the sibling tools include 'swap', 'orderbook', 'walletconnect', and the server description mentions 'intent & cross-chain swaps, limit orders', this tool could execute financial transactions on behalf of the user.
From the tool's definition Call any 1inch product API endpoint using the authenticated user's credentials
Risk signalsAccepts file system path (path) · Accepts raw HTML/template content (body)
Attacks that exploit this kind of access
The rule that runs product_api safely
PolicyLayer is an MCP gateway: it sits between your AI agents and 1inch MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For product_api, this is the rule to start with:
Any call to product_api is blocked until a human approves it. The rest of the server keeps working.
The button opens the PolicyLayer dashboard: create your workspace, connect 1inch MCP, apply this rule, and every product_api call is checked against it from then on.
Questions about product_api
[Requires authentication] This tool needs OAuth. If it returns an authentication error, prompt the user to connect/authenticate this MCP server (OAuth), then retry. Call any 1inch product API endpoint using the authenticated user's credentials (base URL is the unified gateway, e.g. https://api.1inch.com). Optional: if your client can read MCP resources, file://1inch-mcp/guides/api-index has live Swagger links and extra gateway notes (mirrors business.1inch.com/portal/llms.txt). Common chain IDs: Ethereum=1, BNB=56, Polygon=137, Arbitrum=42161, Optimism=10, Base=8453, Avalanche=43114, Gnosis=100, zkSync=324, Linea=59144, Sonic=146, Unichain=130, Cronos=25, Monad=10143, Solana=501 (where applicable). Gateway products (use these path prefixes with this tool): - Portfolio: /portfolio/portfolio/v5.0/... — example path="/portfolio/portfolio/v5.0/general/current_value", query={"addresses":"0x..."}; token metrics path="/portfolio/portfolio/v5.0/tokens/metrics", query={"addresses":"0x...","timerange":"1year"} - Balance: /balance/v1.2/{chainId}/... — example path="/balance/v1.2/1/balances/0x..." - Spot Price: /price/v1.1/{chainId} — example path="/price/v1.1/1", method="POST", body={"tokens":["0x..."],"currency":"USD"} - Token: /token/v1.4/{chainId}/... — example path="/token/v1.4/1/search", query={"query":"USDC"} (prefer v1.4; older v1.2 chain search is deprecated in OpenAPI) - Token Details: /token-details/v1.0/details/{chain}/{tokenAddress} — example path="/token-details/v1.0/details/1/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48" - Gas Price: /gas-price/v1.6/{chainId} — example path="/gas-price/v1.6/1" - Swap (Classic): /swap/v6.1/{chainId}/... — example path="/swap/v6.1/1/quote", query={"src":"0x...","dst":"0x...","amount":"..."} (exact query names per OpenAPI) - Orderbook: /orderbook/v4.1/{chainId}/... — example path="/orderbook/v4.1/1/all", query={"page":"1","limit":"10"} - Fusion (Intent): /fusion/orders/v2.0/..., /fusion/quoter/v2.0/..., /fusion/relayer/v2.0/... — example path="/fusion/quoter/v2.0/1/quote/receive" with required query params from spec - Fusion+ (Cross-chain): /fusion-plus/orders/..., /fusion-plus/quoter/..., /fusion-plus/relayer/... — example path="/fusion-plus/quoter/v1.2/quote/receive" with required params; equivalent routes also exist under /cross-chain/orders|quoter|relayer - History: /history/v2.0/history/{address}/events — example path="/history/v2.0/history/0x.../events", query={"chainId":"1","limit":"50","tokenAddress":"0x..."} (optional tokenAddress filters by contract; response shape uses items[].details.txHash — not raw event logs) - Traces: /traces/v1.0/chain/{chainId}/block-trace/{blockNumber}/tx-hash/{txHash} — example path="/traces/v1.0/chain/1/block-trace/18000000/tx-hash/0x..." (not /transaction/{hash}) - NFT: /nft/v2/... — example path="/nft/v2/byaddress", query={"chainIds":"1","address":"0x..."} - Charts: /charts/v1.0/chart/line/{token0}/{token1}/{period}/{chainId} — example path="/charts/v1.0/chart/line/0x.../0x.../24H/1" (period: 24H, 1W, 1M, 1Y, AllTime; not a separate timerange query) - Domains: /domains/... — example path="/domains/v2.0/lookup", query={"name":"vitalik.eth"} - Aqua (strategy analytics): /aqua/v1.0/strategies/... — example path="/aqua/v1.0/strategies/opened", query={"limit":"100"}; maker stats path="/aqua/v1.0/strategies/makers/0x.../stats". Prefer the dedicated "aqua" tool when Unleash flag mcp-service.tool.aqua is enabled; otherwise use product_api for raw HTTP. - Tx Gateway: /tx-gateway/... — example path="/tx-gateway/v1.1/1/broadcast", method="POST", body={...} - Web3 RPC: /web3/{chainId}/... — JSON-RPC over HTTP POST to an EVM (or Solana 501) node; Gateway exposes e.g. 1,10,25,56,100,130,137,143,146,324,501,8453,42161,43114,59144 — confirm availability for your org/plan. Example path="/web3/1", method="POST", body={"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]} Gotchas: Portfolio gateway path repeats "portfolio" (/portfolio/portfolio/v5.0/...) because the gateway strips the first segment. Spot Price returns WEI in native currency unless you set currency. Token list responses are large; prefer search. Token Details does not support native ETH pseudo-address 0xeeee...eeee; use WETH. Balance responses may include zero balances—filter client-side. For limit order flows (build, sign, create, cancel), prefer the "orderbook" tool. For swap execution, prefer the "swap" tool. Use product_api for direct REST access to any endpoint. It is categorised as a Financial tool in the 1inch MCP MCP Server, which means it involves financial transactions. Block by default and require explicit approval.
product_api accepts 4 parameters: body, path, query, method. Required: path. The full parameter table on this page comes from the server's own tool schema.
Register the 1inch MCP server in PolicyLayer and add a rule for product_api: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches 1inch MCP. Nothing to install.
product_api is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the product_api rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for product_api. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
product_api is provided by the 1inch MCP server (https://api.1inch.com/mcp/protocol). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on 1inch, and thousands of servers like it.
Across the catalogue