Skip to main content
All endpoints live under a single base URL:
Everything is a GET. Metered endpoints (screening, VPN, geolocation) require a bearer API token — or, with no token at all, x402 pay-per-request. The public data feeds (/stats, /delisted, /screen/lists) are unauthenticated and free.

Requests and quota

Each metered request costs one credit against your organization’s monthly quota, regardless of how many lists match. Over quota you get 402 with the option to pay per request or upgrade; burst limits return 429 with a Retry-After header. Every request is written to your audit trail.

Rate-limit headers

Every metered response (and the free /search) reports its burst window in the standard IETF draft RateLimit headers, so clients and agents can self-throttle instead of waiting for a 429: Both 429 variants carry Retry-After: on a burst 429 it is seconds until the window frees; on a monthly-quota 429 it points at the period roll (paying per request via x402 or upgrading works sooner).

Versioning

The API is versioned in the URL path (/api/v1); see the versioning and deprecation policy for what can change without notice and how deprecations are signaled.

Response conventions

Screening responses share one envelope: sanctioned is true only for government sanctions-list hits, flagged is true for any hit (sanctions, crime-intelligence, or risk-exposure), and every match names the list that produced it. All timestamps are UTC ISO-8601. The same endpoints are also exposed as MCP tools for AI agents.