# product_api

[Requires authentication] This tool needs OAuth. If it returns an authentication error, prompt the user to connect/authenticate this MCP server (OAuth), then retry. Call any 1inch product API endpoint using the authenticated user's credentials (base URL is the unified gateway, e.g. https://api.1inch.com). Optional: if your client can read MCP resources, file://1inch-mcp/guides/api-index has live Swagger links and extra gateway notes (mirrors business.1inch.com/portal/llms.txt). Common chain IDs: Ethereum=1, BNB=56, Polygon=137, Arbitrum=42161, Optimism=10, Base=8453, Avalanche=43114, Gnosis=100, zkSync=324, Linea=59144, Sonic=146, Unichain=130, Cronos=25, Monad=10143, Solana=501 (where applicable). Gateway products (use these path prefixes with this tool): - Portfolio: /portfolio/portfolio/v5.0/... — example path="/portfolio/portfolio/v5.0/general/current_value", query={"addresses":"0x..."}; token metrics path="/portfolio/portfolio/v5.0/tokens/metrics", query={"addresses":"0x...","timerange":"1year"} - Balance: /balance/v1.2/{chainId}/... — example path="/balance/v1.2/1/balances/0x..." - Spot Price: /price/v1.1/{chainId} — example path="/price/v1.1/1", method="POST", body={"tokens":["0x..."],"currency":"USD"} - Token: /token/v1.4/{chainId}/... — example path="/token/v1.4/1/search", query={"query":"USDC"} (prefer v1.4; older v1.2 chain search is deprecated in OpenAPI) - Token Details: /token-details/v1.0/details/{chain}/{tokenAddress} — example path="/token-details/v1.0/details/1/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48" - Gas Price: /gas-price/v1.6/{chainId} — example path="/gas-price/v1.6/1" - Swap (Classic): /swap/v6.1/{chainId}/... — example path="/swap/v6.1/1/quote", query={"src":"0x...","dst":"0x...","amount":"..."} (exact query names per OpenAPI) - Orderbook: /orderbook/v4.1/{chainId}/... — example path="/orderbook/v4.1/1/all", query={"page":"1","limit":"10"} - Fusion (Intent): /fusion/orders/v2.0/..., /fusion/quoter/v2.0/..., /fusion/relayer/v2.0/... — example path="/fusion/quoter/v2.0/1/quote/receive" with required query params from spec - Fusion+ (Cross-chain): /fusion-plus/orders/..., /fusion-plus/quoter/..., /fusion-plus/relayer/... — example path="/fusion-plus/quoter/v1.2/quote/receive" with required params; equivalent routes also exist under /cross-chain/orders|quoter|relayer - History: /history/v2.0/history/{address}/events — example path="/history/v2.0/history/0x.../events", query={"chainId":"1","limit":"50","tokenAddress":"0x..."} (optional tokenAddress filters by contract; response shape uses items[].details.txHash — not raw event logs) - Traces: /traces/v1.0/chain/{chainId}/block-trace/{blockNumber}/tx-hash/{txHash} — example path="/traces/v1.0/chain/1/block-trace/18000000/tx-hash/0x..." (not /transaction/{hash}) - NFT: /nft/v2/... — example path="/nft/v2/byaddress", query={"chainIds":"1","address":"0x..."} - Charts: /charts/v1.0/chart/line/{token0}/{token1}/{period}/{chainId} — example path="/charts/v1.0/chart/line/0x.../0x.../24H/1" (period: 24H, 1W, 1M, 1Y, AllTime; not a separate timerange query) - Domains: /domains/... — example path="/domains/v2.0/lookup", query={"name":"vitalik.eth"} - Aqua (strategy analytics): /aqua/v1.0/strategies/... — example path="/aqua/v1.0/strategies/opened", query={"limit":"100"}; maker stats path="/aqua/v1.0/strategies/makers/0x.../stats". Prefer the dedicated "aqua" tool when Unleash flag mcp-service.tool.aqua is enabled; otherwise use product_api for raw HTTP. - Tx Gateway: /tx-gateway/... — example path="/tx-gateway/v1.1/1/broadcast", method="POST", body={...} - Web3 RPC: /web3/{chainId}/... — JSON-RPC over HTTP POST to an EVM (or Solana 501) node; Gateway exposes e.g. 1,10,25,56,100,130,137,143,146,324,501,8453,42161,43114,59144 — confirm availability for your org/plan. Example path="/web3/1", method="POST", body={"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]} Gotchas: Portfolio gateway path repeats "portfolio" (/portfolio/portfolio/v5.0/...) because the gateway strips the first segment. Spot Price returns WEI in native currency unless you set currency. Token list responses are large; prefer search. Token Details does not support native ETH pseudo-address 0xeeee...eeee; use WETH. Balance responses may include zero balances—filter client-side. For limit order flows (build, sign, create, cancel), prefer the "orderbook" tool. For swap execution, prefer the "swap" tool. Use product_api for direct REST access to any endpoint.

Agent View of the PolicyLayer registry record for `product_api`. HTML page: https://policylayer.com/tools/com-1inch-business-mcp/product-api

## Facts

- Tool: `product_api`
- Server: 1inch MCP (`https://api.1inch.com/mcp/protocol`) — https://policylayer.com/tools/com-1inch-business-mcp.md
- Homepage: https://github.com/1inch/1inch-ai
- Risk category: Financial (Critical risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 4 (1 required)
- Recommended policy verdict: Approval-gated

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `body` | object | no | Request body for POST requests |
| `path` | string | yes | API path (e.g. /portfolio/portfolio/v5.0/general/current_value — unified gateway prefix) |
| `query` | object | no | Query parameters as key-value pairs |
| `method` | string | no | HTTP method |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "product_api",
    "arguments": {
      "path": "<path>"
    }
  }
}
```

## Why product_api is rated Critical

This tool can call ANY 1inch API endpoint with authenticated user credentials, including swap, limit orders, cross-chain swaps, and other financial operations exposed by 1inch. Given the sibling tools include 'swap', 'orderbook', 'walletconnect', and the server description mentions 'intent & cross-chain swaps, limit orders', this tool could execute financial transactions on behalf of the user.

From the tool's own definition: "Call any 1inch product API endpoint using the authenticated user's credentials"

Risk signals: Accepts file system path (path) · Accepts raw HTML/template content (body)

## Use case

AI agents use product_api to commit financial operations through 1inch MCP, usually the final step of a payment, billing, or trading workflow. A call moves real money.

## Recommended policy (PolicyLayer)

Verdict: **Approval-gated**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches 1inch MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "product_api": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}
```

## Other tools on 1inch MCP (8)

- `orderbook` — Financial — https://policylayer.com/tools/com-1inch-business-mcp/orderbook.md
- `swap` — Financial — https://policylayer.com/tools/com-1inch-business-mcp/swap.md
- `walletconnect` — Financial — https://policylayer.com/tools/com-1inch-business-mcp/walletconnect.md
- `aqua` — Read — https://policylayer.com/tools/com-1inch-business-mcp/aqua.md
- `debug` — Read — https://policylayer.com/tools/com-1inch-business-mcp/debug.md
- `get_example` — Read — https://policylayer.com/tools/com-1inch-business-mcp/get-example.md
- `list_examples` — Read — https://policylayer.com/tools/com-1inch-business-mcp/list-examples.md
- `search` — Read — https://policylayer.com/tools/com-1inch-business-mcp/search.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-1inch-business-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-1inch-business-mcp