Base URL and content type
All requests go to:application/json. Set Content-Type: application/json on requests that include a body.
Authentication
Send your Platform API key as a Bearer token on every request:OpenAPI specification
The machine-readable contract is published at every platform deploy:searchProducts, moreLikeThisProducts, lookupProduct, refreshProducts, startVoyage, getVoyage, listVoyages, createUrlList, listUrlLists, getUrlList, deleteUrlList, addUrlListUrls, removeUrlListUrls, checkUrlListUrls, and listUrlListUrls, full request and response schemas, and example error bodies. Most ecosystems can generate a typed client from it - for example openapi-generator, openapi-typescript, or oapi-codegen.
Endpoints
The public reference currently documents these endpoints.Error model
All error responses carry a top-leveldetail field.
String detail (auth, authorization, and not-found errors):
Error status codes
Retry transient network errors,
5xx responses, and 429 (after waiting Retry-After). The other 4xx codes listed above require a change in the caller.
Rate limits
Requests are rate limited per organization — one budget shared across all of your API keys and MCP sessions. The cap is a generous safety ceiling set well above normal traffic and is not published as a fixed number; read your current allowance from theX-RateLimit-Limit response header.
Every response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. When you exceed the limit, the API returns 429 Too Many Requests with detail: "rate_limit_exceeded" and a Retry-After header. See the Rate Limits guide for the headers, backoff code, and the MCP equivalent.