API and MCP server

Would you rather ask Claude, ChatGPT, Gemini or Grok (Microsoft 365 Copilot coming soon) than write code? See Connect your AI. Plans and the free trial are on the pricing page.

On this page: Quick start · Conventions · Endpoints · CSV and bulk files · MCP server · Agent sign-up · Limits and licensing. Machine-readable: OpenAPI 3.1, llms.txt.

Quick start

Create an API key on your account page (this needs the Premium plan or the free trial; see pricing) and send it as a bearer token. Companies are keyed by their SEC CIK, the number the SEC assigns to every filer; a ticker works as a lookup, and responses include both. Members of Congress are keyed by their Bioguide ID.

curl -H "Authorization: Bearer $KEY" \
  "https://13f.ai/api/v1/insider-trades?ticker=NVDA&open_market=true&limit=5"

curl -H "Authorization: Bearer $KEY" \
  "https://13f.ai/api/v1/congress-trades?bioguide_id=P000197&since=2026-01-01"

# what is new since you last looked (poll with the largest first_seen_at you have seen)
curl -H "Authorization: Bearer $KEY" \
  "https://13f.ai/api/v1/events?tickers=NVDA,MSFT&updated_since=2026-10-23T12:00:00Z&order=asc"

Conventions

• Envelope. Every response is { "data": [...], "next_cursor": string | null, "as_of": "2026-10-24T09:30:00.000Z" }. Single-resource endpoints put one object in data.
• Pagination. Opaque cursors: pass next_cursor back as cursor with the same filters. limit defaults to 100, maximum 1000. Cursors are keyset-based, so paging is stable while new rows arrive.
• Formats. snake_case names; numbers are numbers (USD unless the name says otherwise); dates are YYYY-MM-DD; times are ISO 8601 UTC. Ranges are always amount_min and amount_max (amount_max is null for open-ended brackets).
• Provenance on every row. An SEC accession number plus filing_url, or a document id plus source_url. first_seen_at is when we first stored the row; filter with updated_since to poll for what is new.
• Common filters. ticker, cik, since / until (the dataset's event date, stated per endpoint), updated_since (first_seen_at). Unknown parameters are rejected rather than ignored.
• Errors. { "error": { "code", "message", "param?", "hint?" } } with status 400 (invalid request or cursor), 401 (missing or invalid key), 404, 429 (rate limit), 503 (not configured or query timeout).
• Large tables. Some endpoints need a narrowing filter (a ticker, CIK or date window) because the underlying table is large; the error message says which.

Endpoints

All are GET under /api/v1. The tier label is the plan an endpoint belongs to. Every Premium or trial key can call all of them.

CSV and bulk files

Both are part of the Premium plan.

• CSV. Add format=csv to a list endpoint. You get the same filters, page size and cursor as the JSON response, one header row (the documented fields, in order) and one row per result, at most 10,000 rows a download. The headers X-Rows-Returned, X-Row-Limit and X-CSV-Truncated say how many rows you got, and X-Next-Cursor carries the cursor for the next page. Text that a spreadsheet could read as a formula starts with an apostrophe. /companies/{ticker_or_cik} and /stock-splits and /fha-lending and /bank-financials and /consumer-complaints and /card-metrics stay JSON-only, because they carry numbers from licensed market data.
• Bulk files. Every night we write gzip CSV files of the latest 13F filings, the current 13F positions, the 13F history by fund and by stock, Congress trades and insider trades. GET /api/v1/bulk lists them with a download link for each; a link works for 5 minutes and names one file, so ask again for fresh ones. Send your key in the Authorization header only: the links need no key, and there are no public addresses. Add ?dataset=congress_trades for one dataset. Files are split into numbered parts, each with its own header row; sha256 is the checksum of the compressed part.

curl -H "Authorization: Bearer $KEY"   "https://13f.ai/api/v1/congress-trades?since=2026-01-01&format=csv" -o congress.csv

curl -H "Authorization: Bearer $KEY" "https://13f.ai/api/v1/bulk?dataset=congress_trades"
curl -o congress_trades-001.csv.gz "<url from the answer>"

MCP server

The same data as tools for AI assistants, over MCP (Streamable HTTP, stateless, JSON responses) at https://13f.ai/api/mcp. Authentication is signing in with OAuth (below) or an API key as a header: Authorization: Bearer <key>. All tools are read-only.

Basic and Premium tools. Congressional trades, members of Congress, bills in Congress, roll-call votes and corporate PAC donations are free for every account that signs in through OAuth from Claude, ChatGPT, Gemini or Grok, Basic plan included. Tools marked Basic below work for those accounts. Tools marked Mixed return their congressional part and, in place of the rest, a short message that it needs the Premium plan. Tools marked Premium answer with that message.Which apps count as Basic. The Basic plan works when the app that connects is Claude, ChatGPT, Gemini or Grok. We decide that from the redirect address used when the person approves the app (it must be the callback of one of those assistants), not from its name or user agent. A Basic account that signs in from any other client (Claude Code, Cursor, LM Studio, Open WebUI, your own code) is answered with 402 payment_required, which MCP clients show as a message that the app needs the Premium plan; Premium, trial and complimentary accounts work from any client. API keys, on the MCP server and on the REST API, are part of the Premium plan. Basic accounts are limited to 30 requests per minute and 500 calls a UTC day (the day count resets at 00:00 UTC), the minute limit counted separately on each server instance.

Add it to Claude, ChatGPT, Gemini or Grok by signing in

Add https://13f.ai/api/mcp as a custom connector in Claude (Customize, Connectors, Add custom connector), as a custom MCP server in ChatGPT (Plugins, +, Add custom MCP server) as a custom app in Gemini (Settings, Connected Apps, Add a custom app) or as a custom connector in Grok (grok.com/connectors, New Connector, Custom). The app sends the user to 13F.ai to sign in and approve (OAuth 2.1 with PKCE; MCP authorization spec revision 2026-07-28), and no key is copied. The server advertises its metadata at /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server, supports Client ID Metadata Documents and dynamic client registration (/oauth/register), issues one-hour access tokens and rotating refresh tokens, and supports revocation (/oauth/revoke). Users manage and disconnect apps on their account page. See Connect your AI. An OAuth access token works on the MCP endpoint only, not on the REST API.

Microsoft 365 Copilot

The server is built to be listed as a federated connector in Microsoft 365 Copilot, for work accounts: Streamable HTTP, every tool read-only and titled, and the two document tools Microsoft lists, search (a name or a question, ranked results with id, title, url and text) and fetch (an id from search, one readable document). They follow the same plans as the other tools. The listing is coming soon; see how it will work. It works with work or school accounts only, for people with a Microsoft 365 Copilot license, after a Microsoft 365 administrator turns it on; it is not available with a personal Microsoft account or the free Copilot app.

Prefer an API key? You can connect that way instead.

Claude Code: claude mcp add --transport http 13f-ai https://13f.ai/api/mcp, then /mcp to sign in. Or send a key in a header:

claude mcp add --transport http 13f-ai https://13f.ai/api/mcp \
  --header "Authorization: Bearer <your key>"

Claude Desktop through the mcp-remote bridge, which can send the header (add to claude_desktop_config.json and restart):

{
  "mcpServers": {
    "13f-ai": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://13f.ai/api/mcp", "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer <your key>" }
    }
  }
}

A key placed in the address (https://13f.ai/api/mcp/k/<key>) is an older fallback for clients that can neither sign in nor send a header. It is off by default, because addresses end up in logs and browser history. If you must use it, create a separate key for it and revoke that key afterwards. Signing in, as described above, is the better choice.

To test any client, call tools/list first, then for example get_company_overview with {"ticker": "NVDA"}, get_crypto_overview with {} for the crypto briefing, or get_theme with {"slug": "ai-chips"} for a published theme.

Agents can sign up themselves

An AI agent can start a Premium sign-up through the API. It sends the person's email, gets a Stripe checkout link and gives the link to the person, who pays. The agent then collects its API key. No form on this site is filled in by anyone. Premium starts with the 7-day free trial, so the card is added today and charged $29 a month after the trial unless the person cancels.

1. POST /api/v1/agent/signup with { "email": "person@example.com" }. The answer has checkout_url, poll_url, expires_at (24 hours) and a claim_secret that is shown once. If the email already has an account the answer is 409: the person signs in at /login and creates a key on the account page.
2. The person opens checkout_url and pays. We create their account for that email, and they can sign in later with an email link.
3. GET poll_url with Authorization: Bearer <claim_secret> until status is paid (the other values are pending and expired). The first poll of a paid sign-up returns api_key. It is shown once and is not stored in readable form. Later polls return the status only; keys are managed on the account page.

curl -X POST https://13f.ai/api/v1/agent/signup   -H "Content-Type: application/json"   -d '{"email": "person@example.com"}'

# give checkout_url to the person, then poll:
curl -H "Authorization: Bearer $CLAIM_SECRET"   "https://13f.ai/api/v1/agent/signup/$SIGNUP_ID"

Sign-up requests are limited per address. Temporary-mailbox addresses are not accepted. The Terms apply to the person who pays.

Limits and licensing

• License: personal, non-commercial use only, under Sections 5 and 6 of the Terms of Service (https://13f.ai/terms). Keys, tokens and connector access are for one person and may not be shared. Powering a site, app, bot, agent, newsletter or any tool that other people use counts as redistribution, even if they never see the raw data. Data responses carry an X-License header that says so. For commercial use, display or redistribution, see commercial licensing.
• Rate limit: the limits below are part of the Terms; do not work around them with more keys, accounts or addresses. 60 requests per minute per key on the Premium plan, counted separately on each server instance. Basic accounts using the MCP server for congressional data have 30 requests per minute and 500 calls per UTC day per account; the daily count is shared by all our servers and resets at 00:00 UTC, and the error says when. The per-minute limit is best effort (with several instances running, the real ceiling is higher). Responses carry X-RateLimit-* and Retry-After headers.
• No raw prices. Our market-data licence does not cover daily price history through the API. The company endpoint returns our estimated market capitalization only (shares from the latest SEC filing x last close from Tiingo; market_cap_basis is estimated).
• Data quality. Everything comes from public filings, and we match filings to companies automatically; the link_method and match_method fields say how each match was made. Check the source link before relying on a single row. Information, not investment advice.
• Versioning. Existing field names are stable and safe to build on. The version reads 1.0.0-preview because we are still adding fields and endpoints.