GET. Metered endpoints (screening, VPN, geolocation) require a bearer API token — or, with no token at all, x402 pay-per-request. The public data feeds (/stats, /delisted, /screen/lists) are unauthenticated and free.
Requests and quota
Each metered request costs one credit against your organization’s monthly quota, regardless of how many lists match. Over quota you get402 with the option to pay per request or upgrade; burst limits return 429 with a Retry-After header. Every request is written to your audit trail.
Rate-limit headers
Every metered response (and the free/search) reports its burst window in the standard IETF draft RateLimit headers, so clients and agents can self-throttle instead of waiting for a 429:
Both
429 variants carry Retry-After: on a burst 429 it is seconds until the window frees; on a monthly-quota 429 it points at the period roll (paying per request via x402 or upgrading works sooner).
Versioning
The API is versioned in the URL path (/api/v1); see the versioning and deprecation policy for what can change without notice and how deprecations are signaled.
Response conventions
Screening responses share one envelope:sanctioned is true only for government sanctions-list hits, flagged is true for any hit (sanctions, crime-intelligence, or risk-exposure), and every match names the list that produced it. All timestamps are UTC ISO-8601.
The same endpoints are also exposed as MCP tools for AI agents.