API docs (beta)

Base URL

https://api.unbyte.dev

• Every answer is JSON. It carries Unbyte-Registry-Version, the IDL registry release it was decoded with, and Unbyte-Schema: 1.0.
• POST bodies are JSON with a Content-Length header, up to 256 KB.
• CORS is open to every origin, so a browser can call the API directly.
• The same routes are described for tools as OpenAPI 3.1 at https://api.unbyte.dev/openapi.json.

Authentication

Every endpoint works without a key. Anonymous calls are limited per IP: 60 requests a minute, and 30 a minute to MCP. With a key, calls count against your plan and get its limits.

Authorization: Bearer ub_live_…

• A key is ub_live_ followed by 32 base58 characters. You create keys after signing in with a Solana or EVM wallet.
• A key is shown once, when it is created: store it as a secret. Unbyte keeps only a hash of it.
• A key can be limited to the scopes decode, verify and idl, and given an expiry. A revoked key stops working within a minute.
• An Authorization header that is not a valid key is 401 invalid_key; leave the header out to call anonymously.

The examples below read your key from UNBYTE_API_KEY; drop the -H "Authorization: …" line to try them anonymously.

Endpoints

curl https://api.unbyte.dev/v1/health

curl "https://api.unbyte.dev/v1/tx/$SIGNATURE" \
  -H "Authorization: Bearer $UNBYTE_API_KEY"

curl https://api.unbyte.dev/v1/decode/tx \
  -H "Authorization: Bearer $UNBYTE_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transaction\": \"$TX_BASE64\"}"

curl https://api.unbyte.dev/v1/verify \
  -H "Authorization: Bearer $UNBYTE_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transaction\": \"$TX_BASE64\", \"intent\": {\"max_slippage_bps\": 100}}"

curl https://api.unbyte.dev/v1/programs/JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4 \
  -H "Authorization: Bearer $UNBYTE_API_KEY"

curl https://api.unbyte.dev/v1/programs/pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA/idl \
  -H "Authorization: Bearer $UNBYTE_API_KEY"

Errors

A failed call answers with an HTTP error status and one envelope. The message is fixed per code and never repeats your input. 429 and most 503 answers carry Retry-After, in seconds.

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests; retry later."
  }
}

Rate limits

Each key gets its plan's rate and monthly allowance. Prices and overage are on the pricing page.

• Past the monthly allowance, Free stops with 402 quota_exceeded. Paid plans pay overage from credits, per call, and get 402 insufficient_credits when the balance runs out.
• Over the rate, a call gets 429 rate_limited with Retry-After. Calls that read from Solana, such as a transaction by signature, can be limited further per IP or per key.
• Calls rejected as malformed and 304 answers are not counted.

MCP for agents

The same calls as tools for an AI agent, over MCP's Streamable HTTP transport. The server is stateless: no session, one JSON-RPC message per POST (no batches).

https://api.unbyte.dev/mcp

• A result is at most 256 KB: a longer decode keeps the first instructions and says so with truncated and instructions_omitted.
• A failed tool call returns isError: true with the same error envelope.
• Results are on-chain data: token names, memos and IDL names are third-party text. Have your agent treat them as data, never as instructions.
• Without a key, MCP allows 30 requests a minute per IP.

Most MCP clients take a remote server in this shape; leave out headers to connect anonymously.

{
  "mcpServers": {
    "unbyte": {
      "type": "http",
      "url": "https://api.unbyte.dev/mcp",
      "headers": {
        "Authorization": "Bearer ub_live_…"
      }
    }
  }
}