{ "aod": "0.1", "provider": { "name": "APIs.io", "url": "https://apis.io", "portalUrl": "https://apis.io/developer" }, "maturity": "self-serve", "account": { "required": false, "signupUrl": "https://apis.io/developer/account", "agentPolicy": "allowed", "prerequisites": [], "plans": [ { "name": "Free", "requiredFor": "Keyless discovery — search, providers, APIs, tags, industries and the artifact collections. Keyless callers are limited PER IP at the edge (3,000 per 5 minutes), not by a usage plan: a plan meters per key and every anonymous caller would share one. The 5 req/s + 500/day figures apply to a KEYED free-tier caller, i.e. an AAuth agent principal. Ratings, capabilities, cohorts, insights and the service root are Pro.", "url": "https://apis.io/developer/plans" }, { "name": "Starter", "requiredFor": "2,000 requests/day at 20 requests/second with an API key — free with a GitHub, Google or LinkedIn sign-in", "url": "https://apis.io/developer/plans" }, { "name": "Pro", "requiredFor": "Industries, regions, and ratings resources plus 10,000 requests/day at 100 requests/second", "url": "https://apis.io/developer/plans" }, { "name": "Business", "requiredFor": "25,000 requests/day at 400 requests/second for production workloads", "url": "https://apis.io/developer/plans" } ] }, "verification": [ { "facet": "domain_control", "min_grade": "verified", "blocking": true, "description": "To mint an agent principal through grant_type=client_credentials, a caller must present an AAuth-signed request carrying an aa-agent+jwt from an agent provider on our allowlist. That provider vouching for an aauth:local@domain identifier is what establishes domain control, so the requirement is verified rather than attested. Unsigned client_credentials is refused with invalid_client naming exactly what to sign with. Nothing else on this API requires it: open, browser-oauth, dcr and cimd are unaffected.", "vocabulary": "https://apis.io/kya/" } ], "registration": { "applicationNoun": "API key", "owner": "user", "mechanisms": [ { "type": "open", "description": "Discovery is keyless: call search, providers, apis, tags, industries and the artifact collections right now with no account, no key and no form. It is not the whole API — the service root, ratings, capabilities, cohorts, insights and the rest are Pro and answer 402, so probe a resource rather than the root to test the door. The MCP server at https://apis.io/mcp shares the same tiering.", "baseUrl": "https://apis.io/api/v1", "docsUrls": [ "https://apis.io/developer/authentication/" ], "auth": "none" }, { "type": "browser-oauth", "description": "Sign in with GitHub, Google or LinkedIn to get an API key. Starter is free on sign-in; Pro and Business are self-serve from the account page. A human uses a browser for this — see gaps.", "docsUrls": [ "https://apis.io/developer/account", "https://apis.io/developer/plans" ] }, { "type": "dcr", "description": "RFC 7591 dynamic client registration against the APIs.io authorization server. Registers an OAuth client for the MCP surface with no human; it does not by itself yield an account or a paid tier.", "registrationEndpoint": "https://apis.io/api/v1/auth/register", "docsUrls": [ "https://apis.io/.well-known/oauth-authorization-server" ] }, { "type": "cimd", "description": "OAuth Client ID Metadata Documents are supported — a client_id that is a URL, with no registration call at all.", "docsUrls": [ "https://apis.io/.well-known/oauth-authorization-server" ] }, { "type": "aauth", "description": "No registration, and no human at any step. An agent signs the request with its own key (RFC 9421, Ed25519) and presents an aa-agent+jwt in which its agent provider vouches for its aauth:local@domain identifier; we verify both and recognise a caller we have never seen. Signing alone earns ATTRIBUTION — the caller is recognised and audited as its identifier — but no meter of its own yet: until it takes a principal it is still limited per IP like any anonymous caller. To hold an ACCOUNT, POST grant_type=client_credentials to the token endpoint with that same signature: it mints an agent principal with its own API key and quota, scope ceiling apis:read, no refresh token, and no way to self-grant paid data. Anonymous callers are refused, which is the point: the identifier costs an allowlisted agent provider vouching for you, and an account that costs nothing to mint makes reputation over it worthless. Reversible in one request — DELETE /api/v1/auth/me. A bodied request must sign a content-digest; GET and HEAD need none. draft-hardt-oauth-aauth-protocol.", "resourceMetadata": "https://apis.io/.well-known/aauth-resource.json", "docsUrls": [ "https://apis.io/.well-known/aauth-resource.json" ] } ] }, "authentication": { "methods": [ { "id": "none", "type": "none", "bootstrap": "" }, { "id": "api-key", "type": "header-env", "header": "x-api-key", "env": [ "APIS_IO_API_KEY" ], "bootstrap": "Sign in at https://apis.io/developer/account with GitHub, Google or LinkedIn. A Starter key is issued free on sign-in; upgrade to Pro or Business on the same page." }, { "id": "oauth2", "type": "oauth-pkce-browser", "authorizationUrl": "https://apis.io/api/v1/auth/authorize", "tokenUrl": "https://apis.io/api/v1/auth/token", "grantTypes": [ "authorization_code", "refresh_token", "client_credentials" ], "scopes": [ "apis:read", "apis:pro" ], "bootstrap": "Register a client via RFC 7591 or a Client ID Metadata Document, then run authorization-code + PKCE. The authorize step renders a consent page against a logged-in session, so a human is present — see gaps." }, { "id": "aauth", "type": "request-signing", "headers": [ "Signature-Key", "Signature-Input", "Signature" ], "algorithms": [ "Ed25519" ], "resourceMetadata": "https://apis.io/.well-known/aauth-resource.json", "bootstrap": "No bootstrap step and no human: hold an Ed25519 keypair, get an aa-agent+jwt from an agent provider we allowlist, and sign each request per RFC 9421 covering at least @method, @path, @authority and signature-key." } ] }, "credentials": [ { "type": "api-key", "fields": { "api_key": "x-api-key" }, "oneTimeDisplay": false, "rotation": "Rotate or revoke from https://apis.io/developer/account. There is no key-management endpoint in v1." }, { "type": "oauth2-client", "fields": { "client_id": "client_id", "client_secret": "client_secret" }, "oneTimeDisplay": false, "rotation": "Re-register through the RFC 7591 endpoint." } ], "scopes": { "model": "product-tiers", "notes": "Tiers gate RESOURCES, not scopes, and the boundary moved on 2026-08-31 — read it from the live API or from https://apis.io/developer/plans/ rather than from any list written down here. Keyless reaches search, providers, apis, tags, industries and the artifact collections; ratings, capabilities, cohorts, insights, resolve, enrich, the playground and the service root are Pro; agent-readiness in bulk is Business. A request above your tier returns 402 Payment Required — not 403, and not 429." }, "flow": { "args": [], "steps": [ { "id": "probe", "description": "Prove the door is open: an unauthenticated call to a keyless resource. NOT the service root — /api/v1/ itself is Pro-gated and answers 402, so probing it would prove the opposite.", "auth": "none", "request": { "method": "GET", "url": "https://apis.io/api/v1/search?q=sms" } } ], "outputs": { "query": "{steps.probe.query}" } }, "economics": { "freeTier": "Keyless costs nothing and needs no account; it is limited per IP at the edge (3,000 requests / 5 minutes) rather than by a usage plan, so your limit does not move with anyone else's traffic. A caller holding a key is metered per key on two limits at once — a sustained rate and a rolling daily quota — and every response carries RateLimit-Policy, X-RateLimit-Limit, X-RateLimit-Window and X-RateLimit-Tier, so a caller reads its own budget rather than guessing. Exceeding either returns 429; an above-tier resource returns 402, or 401 without a key.", "pricingUrl": "https://apis.io/developer/plans", "perCallPayment": "x402, no account needed. A resource sold per call answers its 401 or 402 with an x402 payment requirement (the accepts array in the body for v1, the PAYMENT-REQUIRED header for v2) priced in USDC on Base mainnet (eip155:8453) at the same number the body quotes as price_usd. Sign it, send it in X-PAYMENT or PAYMENT-SIGNATURE, and retry the same request. Bulk export (priced per row) and human-worked requests are never sold this way." }, "gaps": [ "Only a paid SUBSCRIPTION still requires a human. An agent can go from cold discovery to an authorized call with no human at any step: sign with AAuth, POST grant_type=client_credentials, and it holds an account, an API key and its own quota. The scope ceiling for an agent principal is apis:read, so a plan cannot be bought that way — but paid data can be, one call at a time, with x402 and no account at all (economics.perCallPayment, api-evangelist/roadmap#417).", "The aauth mechanism has exactly one agent provider in its allowlist, and we run it. A probe of 1,486 hosts on 2026-08-30 found no other AAuth resource document anywhere in the catalog, so this is a worked example rather than an interoperating ecosystem — read it that way. draft-hardt-oauth-aauth-protocol expires 2027-02-21.", "maturity reads self-serve because that is the highest rung the AOD 0.1 enum has. It does not distinguish a stranger with a browser from a stranger with no human at all, and those are now two different doors here — api-evangelist/roadmap#117.", "This descriptor previously advertised console-only issuance and an info@apis.io address after self-serve sign-in had already shipped. Corrected 2026-08-31.", "A consumer can now READ its own KYA record here. verification[] above states what apis.io requires, and as of 2026-09-19 the consumer half answers: /api/v1/kya/rubric is public and returns 200, and /api/v1/kya/me and /api/v1/agents/{sub} return 401 naming what an enrolled caller needs rather than the 404 they gave while dark. A caller can learn what is demanded of it and check whether it holds it. Stating the requirement before the record answered was deliberate — api-evangelist/roadmap#110, #112." ] }