Requests and responses

JSON envelopes, response headers, strict input, and pagination.

Envelopes

Single resource:

{ "data": { "...": "..." }, "request_id": "req_…" }

{ "data": { "...": "..." }, "request_id": "req_…" }

{ "data": { "...": "..." }, "request_id": "req_…" }

{ "data": { "...": "..." }, "request_id": "req_…" }

List:

{ "data": [{ "object": "brand", "id": "11111111-1111-4111-8111-111111111111" }], "has_more": true, "next_cursor": "eyJrIjoi…", "request_id": "req_…" }

{ "data": [{ "object": "brand", "id": "11111111-1111-4111-8111-111111111111" }], "has_more": true, "next_cursor": "eyJrIjoi…", "request_id": "req_…" }

{ "data": [{ "object": "brand", "id": "11111111-1111-4111-8111-111111111111" }], "has_more": true, "next_cursor": "eyJrIjoi…", "request_id": "req_…" }

{ "data": [{ "object": "brand", "id": "11111111-1111-4111-8111-111111111111" }], "has_more": true, "next_cursor": "eyJrIjoi…", "request_id": "req_…" }

Error: see errors and retries.

Headers

Response header	When
`X-Request-Id`	Always — quote it to support
`Cache-Control: no-store`	Always
`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`	After quota admission: the tightest per-minute bucket; reset is a Unix timestamp (seconds)
`Retry-After`	On `429`, retryable `409 idempotency_key_reused` (2 s), `503 upstream_unavailable` (5 s)
`Idempotent-Replayed: true`	When an idempotent request returns a stored response
`WWW-Authenticate`	On `401`

CORS: /v1/* allows any origin without credentials and exposes the headers above. /v1/api-keys* only allows approved application origins.

Data conventions

Timestamps are RFC 3339 UTC strings (2026-10-26T12:00:00.000Z).
All request schemas are strict: unknown fields give 400 unknown_field with param naming the field.
Free text is trimmed, control characters are stripped, and length is capped.
No serializer copies a database row wholesale; every field is named.
Credential-like columns (access_token, encrypted_app_pw, token_hash,
config, embedding, raw_response, …) can never appear (enforced by tests).
Request bodies are limited to 1 MB.

Pagination

There are three cursor styles. Always pass next_cursor back unchanged.

Style	Endpoints	`limit`	`cursor`
Keyset (opaque base64url)	All original list endpoints, API keys, `website/resources`	1–100, default 25	≤ 512 chars; malformed → `400 invalid_request`, `param: "cursor"`
Offset (numeric string `0`–`99999`)	Calendar, Results, Website changes/change detail, Local, image bank	1–100, default 50	e.g. `"50"`
Event ID (numeric string, ≤ 18 digits)	`website/activity`	1–100, default 50	last event ID

Keyset lists are sorted newest first (created_at desc, then id). Offset pagination does not exist on keyset endpoints. For current-product pages, has_more and next_cursor are inside data.data (see API reference).

API & MCP overview

Get help