# The JQ API > The best free JQ REST and MCP server in the world. Hosted jq 1.8.2 compiled to WebAssembly on Cloudflare Workers. ## Start here - [REST OpenAPI 3.1 contract](https://thejqapi.com/openapi.json): request/response schemas, authentication, limits, payment and error handling. - [REST documentation](https://thejqapi.com/api): examples and jq options. - [MCP endpoint](https://thejqapi.com/mcp): stateless Streamable HTTP; POST JSON-RPC, Accept application/json, text/event-stream. - [MCP server card](https://thejqapi.com/mcp/server-card): draft MCP Server Card; runtime tool discovery remains authoritative. - [AI catalog](https://thejqapi.com/.well-known/ai-catalog.json): domain discovery. This is an MCP/REST service, not an A2A agent. - [Pricing](https://thejqapi.com/pricing): live purchase availability and payment requirements. - [Private checkout and client setup](https://thejqapi.com/access): wallet selection, key backup, and private MCP settings. - [Privacy](https://thejqapi.com/privacy): exact logging, billing, hosting, and upload boundaries. - [Status](https://thejqapi.com/status.json): public synthetic check results, not customer usage. ## First successful query POST https://thejqapi.com/process with Content-Type: application/json and body {"input":{"name":"Alice"},"filter":".name"}. The result is "Alice". MCP: process_json({"input":{"name":"Alice"},"filter":".name"}). Choose exactly one of input, url, or upload_id. Use upload_json only to reuse a document. get_upload inspects availability; delete_upload removes it. get_quota reads allowance without consuming a call. options.modules supplies request-local modules. ## Quota and payments Free daily shared REST/MCP allowance: 100 calls per IP or 1,000 per secret UUID bearer token; resets at midnight UTC. Discovery, metadata reads, and deletion are free. 429 means free quota exhausted. Read reset_at, Retry-After, and upgrade links instead of repeatedly retrying. REST same-request upgrade: explicitly add X-JQ-Payment: pass and a saved UUID bearer token to POST /process or upload creation. The response is a standard x402 402 challenge for the 2-USDC / 30-day pass. Retry with PAYMENT-SIGNATURE under an authorized spending policy; the pass activates before processing and bypasses quota tracking. Keep the header on signed retries. A 202 means pending settlement and no processing; check the returned purchase_id without another payment. Active passes never charge again. This buys a pass, not a single query. Optional per-query REST: POST /process with a secret UUID bearer, X-JQ-Payment: query and Idempotency-Key: a fresh UUID per logical query. x402 returns a 402 for exactly 5000 atomic units (0.005 native USDC on Base). Keep the same key, body and payment mode on the signed retry. Active passes bypass this fee. Structural validation happens first; payment precedes execution and jq/runtime or remote-fetch errors remain chargeable. Optional per-query MCP: process_json tools/call params._meta["com.thejqapi/payment"] = {"mode":"query","idempotency_key":"a-new-UUID"}; signed retry adds _meta["x402/payment"]. Arguments remain only JSON processing arguments. An x402-capable client must explicitly allow 0.005 USDC. Per-query recovery: GET /access/purchases/{idempotency_key} with the same bearer UUID. A 202/pending means no execution; check without paying again. A settled payment includes at most three identical delivery attempts within 15 minutes, including the first; results are not cached and URL content may change. Changed requests return 409; expired delivery returns 410. Do not create a new key/payment to recover an uncertain payment. Per-query privacy: no JSON, filter, source URL, result, IP quota or source analytics is retained. One payment receipt per logical query plus a keyed fingerprint and bounded retry counter are retained; retry data expires after the delivery window (cleanup every five minutes). Resolved receipts are retained up to 365 days and pending orders for recovery. This is weaker than the pass’s absence of per-query records. Paid UUIDs never fall back to tracked free calls. Upload creation uses free access or a pass, not per-query billing. A 2 USDC payment buys 30 days of unlimited queries for a UUID, not a recurring subscription. Native USDC on Base only. Check /pricing; use /access or MCP purchase_access. Save the UUID privately before purchasing. Send Authorization: Bearer YOUR_UUID; never put credentials, wallet keys, or payment signatures in URLs or MCP tool arguments. x402 v2 purchase flow: POST /access/purchases with {}; POST checkout_url to receive 402 and PAYMENT-REQUIRED; an authorized wallet client signs exactly 2 USDC and retries with PAYMENT-SIGNATURE. A successful receipt is in PAYMENT-RESPONSE. Pending/uncertain settlement: GET /access/purchases/{purchase_id}; never pay a second time. An active pass returns access without another payment. Use X-JQ-Privacy: required persistently. Previously paid UUIDs reject ordinary queries without an active pass; explicit per-query payment is also available. They and never fall back to tracked free access, even after billing cleanup. ## Data boundaries Free queries already keep JSON, filters, outputs, and source URLs out of application logs. Paid passes additionally skip IP/UUID quota counters, query counts, last-used records, and source analytics. Cloudflare processes hosted requests and network/security metadata. USDC payments are public on Base; minimal billing records and a keyed-hash privacy preference are retained separately. Inline/direct-URL processing is transient. Explicit uploads use private R2 storage, accessible for 15 minutes; physical cleanup can occur later. Anyone holding an upload ID can access or delete it. Document limit: 5 MiB. URL inputs: public HTTPS on port 443, no caller credentials or private networks, at most three redirects and ten seconds. jq execution limits still apply to unlimited passes. No shell or local filesystem access. ## Evidence and support - [Engine capabilities](https://thejqapi.com/engine.json) - [Registry manifest](https://thejqapi.com/server.json) - [Public documentation and checks](https://github.com/cardmagic/thejqapi): documentation only; hosted source is private. Operator: Craftsman Founder LLC; maintainer Lucas Carlson; contact@thejqapi.com.