We can get the rpc methods like this:

curl -sS -H "Content-Type: application/json" -d '{"id":1, "jsonrpc":"2.0", "method": "rpc_methods"}' http://localhost:9933/

I don't think there's a way in polkadot at the moment to get the same list of method strings that one can feed into the state_call rpc method. We suggest that people do state call runtime functions rather than doing custom rpc calls because you can add them via a runtime upgrade without needing to update the node. But they are not as discoverable at the moment.