API documentation

Authentication

Authenticate with an API key issued in your account dashboard. Send it on every request using either the x-api-key header or Authorization: Bearer <key>. Keep keys server-side — never ship them in client-side code — and rotate a key immediately if it is exposed. Keys carry scopes (for example monitoring:read); an endpoint that needs a scope your key lacks returns 403. Revoked or expired keys return 401.

curl https://api.example.com/api/v1/products \
  -H "x-api-key: YOUR_API_KEY"

Market Access Check

Run a market-access check for a product and destination: the rule engine matches verified regulations and returns requirements, evidence and sources with a confidence level.

Products

Manage the product catalog the API assesses: create products with their attributes and categories, then reference them from checks and monitoring.

Assessments

Full assessments go beyond the quick check: staged evaluation, follow-up questions for missing attributes, requirement-level results and review state.

Reports

Generate shareable market-access reports from assessments and export them for stakeholders, auditors or customs brokers.

Documents

Upload evidence documents (certificates, test reports, declarations) and have them analyzed against the requirements they support.

Monitoring

Subscribe products to regulatory change monitoring. When a verified regulation changes, subscribers are alerted and affected rules are re-verified.

Webhooks

Subscribe to outbound events instead of polling. Deliveries are signed with HMAC-SHA256 (header x-map-signature, format t=<timestamp>,v1=<signature> over <timestamp>.<raw JSON body>) and retried up to 5 times with doubling backoff from 30 seconds. Events: assessment.completed, assessment.review_needed, report.ready, document.analyzed, alert.created, monitoring.change_detected, subscription.updated.

Rate limits

Two layers protect the API. Short-window sliding limits apply per API key (or per IP for anonymous traffic); a breach returns 429 with a rate_limited code and the message “Rate limit exceeded. Slow down and retry.” Monthly quotas come from your plan and are enforced per API key.

Short-window limits

Monthly quotas by plan

Quotas are defined by the plan limits and may change with plan updates; the dashboard always shows your current usage. Need higher throughput? Talk to sales about an enterprise plan.

Errors

Errors use standard HTTP status codes with a JSON body describing the problem. Authentication failures return 401, authorization failures 403, validation problems 422, and rate-limit breaches 429.

Versioning

The API is versioned in the request path (currently v1). Breaking changes ship as a new version with a migration window; additive fields and endpoints are added without a version bump and are safe to ignore.

Examples

Run a market-access check for a product against a destination market:

curl -X POST https://api.example.com/api/v1/market-access/check \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "product": { "name": "Bluetooth speaker", "category": "consumer-electronics" },
    "destination": "DE"
  }'

List your monitored products and their latest alerts:

curl "https://api.example.com/api/v1/monitoring?alerts=true" \
  -H "Authorization: Bearer YOUR_API_KEY"

SDKs

No official SDKs are published yet. The API is plain REST over HTTPS with JSON bodies, so any HTTP client works — the curl examples above translate directly. SDKs for popular languages are on the roadmap; until then, the OpenAPI spec at /api/openapi.json can generate a client for your stack.