{
  "aod": "0.1",
  "provider": {
    "name": "APIs.io",
    "url": "https://apis.io",
    "portalUrl": "https://apis.io/developer"
  },
  "maturity": "self-serve",
  "account": {
    "required": false,
    "signupUrl": "https://apis.io/developer/account",
    "agentPolicy": "allowed",
    "prerequisites": [],
    "plans": [
      { "name": "Free", "requiredFor": "Keyless discovery — search, providers, APIs, tags, industries and the artifact collections. Keyless callers are limited PER IP at the edge (3,000 per 5 minutes), not by a usage plan: a plan meters per key and every anonymous caller would share one. The 5 req/s + 500/day figures apply to a KEYED free-tier caller, i.e. an AAuth agent principal. Ratings, capabilities, cohorts, insights and the service root are Pro.", "url": "https://apis.io/developer/plans" },
      { "name": "Starter", "requiredFor": "2,000 requests/day at 20 requests/second with an API key — free with a GitHub, Google or LinkedIn sign-in", "url": "https://apis.io/developer/plans" },
      { "name": "Pro", "requiredFor": "Industries, regions, and ratings resources plus 10,000 requests/day at 100 requests/second", "url": "https://apis.io/developer/plans" },
      { "name": "Business", "requiredFor": "25,000 requests/day at 400 requests/second for production workloads", "url": "https://apis.io/developer/plans" }
    ]
  },
  "verification": [],
  "registration": {
    "applicationNoun": "API key",
    "owner": "user",
    "mechanisms": [
      {
        "type": "open",
        "description": "Discovery is keyless: call search, providers, apis, tags, industries and the artifact collections right now with no account, no key and no form. It is not the whole API — the service root, ratings, capabilities, cohorts, insights and the rest are Pro and answer 402, so probe a resource rather than the root to test the door. The MCP server at https://apis.io/mcp shares the same tiering.",
        "baseUrl": "https://apis.io/api/v1",
        "docsUrls": ["https://apis.io/developer/authentication/"],
        "auth": "none"
      },
      {
        "type": "browser-oauth",
        "description": "Sign in with GitHub, Google or LinkedIn to get an API key. Starter is free on sign-in; Pro and Business are self-serve from the account page. A human uses a browser for this — see gaps.",
        "docsUrls": ["https://apis.io/developer/account", "https://apis.io/developer/plans"]
      },
      {
        "type": "dcr",
        "description": "RFC 7591 dynamic client registration against the APIs.io authorization server. Registers an OAuth client for the MCP surface with no human; it does not by itself yield an account or a paid tier.",
        "registrationEndpoint": "https://apis.io/api/v1/auth/register",
        "docsUrls": ["https://apis.io/.well-known/oauth-authorization-server"]
      },
      {
        "type": "cimd",
        "description": "OAuth Client ID Metadata Documents are supported — a client_id that is a URL, with no registration call at all.",
        "docsUrls": ["https://apis.io/.well-known/oauth-authorization-server"]
      },
      {
        "type": "aauth",
        "description": "No registration, and no human at any step. An agent signs the request with its own key (RFC 9421, Ed25519) and presents an aa-agent+jwt in which its agent provider vouches for its aauth:local@domain identifier; we verify both and recognise a caller we have never seen. Signing alone earns ATTRIBUTION — the caller is recognised and audited as its identifier — but no meter of its own yet: until it takes a principal it is still limited per IP like any anonymous caller. To hold an ACCOUNT, POST grant_type=client_credentials to the token endpoint with that same signature: it mints an agent principal with its own API key and quota, scope ceiling apis:read, no refresh token, and no way to self-grant paid data. Anonymous callers are refused, which is the point: the identifier costs an allowlisted agent provider vouching for you, and an account that costs nothing to mint makes reputation over it worthless. Reversible in one request — DELETE /api/v1/auth/me. A bodied request must sign a content-digest; GET and HEAD need none. draft-hardt-oauth-aauth-protocol.",
        "resourceMetadata": "https://apis.io/.well-known/aauth-resource.json",
        "docsUrls": ["https://apis.io/.well-known/aauth-resource.json"]
      }
    ]
  },
  "authentication": {
    "methods": [
      { "id": "none", "type": "none", "bootstrap": "" },
      {
        "id": "api-key",
        "type": "header-env",
        "header": "x-api-key",
        "env": ["APIS_IO_API_KEY"],
        "bootstrap": "Sign in at https://apis.io/developer/account with GitHub, Google or LinkedIn. A Starter key is issued free on sign-in; upgrade to Pro or Business on the same page."
      },
      {
        "id": "oauth2",
        "type": "oauth-pkce-browser",
        "authorizationUrl": "https://apis.io/api/v1/auth/authorize",
        "tokenUrl": "https://apis.io/api/v1/auth/token",
        "grantTypes": ["authorization_code", "refresh_token", "client_credentials"],
        "scopes": ["apis:read", "apis:pro"],
        "bootstrap": "Register a client via RFC 7591 or a Client ID Metadata Document, then run authorization-code + PKCE. The authorize step renders a consent page against a logged-in session, so a human is present — see gaps."
      },
      {
        "id": "aauth",
        "type": "request-signing",
        "headers": ["Signature-Key", "Signature-Input", "Signature"],
        "algorithms": ["Ed25519"],
        "resourceMetadata": "https://apis.io/.well-known/aauth-resource.json",
        "bootstrap": "No bootstrap step and no human: hold an Ed25519 keypair, get an aa-agent+jwt from an agent provider we allowlist, and sign each request per RFC 9421 covering at least @method, @path, @authority and signature-key."
      }
    ]
  },
  "credentials": [
    {
      "type": "api-key",
      "fields": { "api_key": "x-api-key" },
      "oneTimeDisplay": false,
      "rotation": "Rotate or revoke from https://apis.io/developer/account. There is no key-management endpoint in v1."
    },
    {
      "type": "oauth2-client",
      "fields": { "client_id": "client_id", "client_secret": "client_secret" },
      "oneTimeDisplay": false,
      "rotation": "Re-register through the RFC 7591 endpoint."
    }
  ],
  "scopes": {
    "model": "product-tiers",
    "notes": "Tiers gate RESOURCES, not scopes, and the boundary moved on 2026-08-31 — read it from the live API or from https://apis.io/developer/plans/ rather than from any list written down here. Keyless reaches search, providers, apis, tags, industries and the artifact collections; ratings, capabilities, cohorts, insights, resolve, enrich, the playground and the service root are Pro; agent-readiness in bulk is Business. A request above your tier returns 402 Payment Required — not 403, and not 429."
  },
  "flow": {
    "args": [],
    "steps": [
      {
        "id": "probe",
        "description": "Prove the door is open: an unauthenticated call to a keyless resource. NOT the service root — /api/v1/ itself is Pro-gated and answers 402, so probing it would prove the opposite.",
        "auth": "none",
        "request": {
          "method": "GET",
          "url": "https://apis.io/api/v1/search?q=sms"
        }
      }
    ],
    "outputs": {
      "query": "{steps.probe.query}"
    }
  },
  "economics": {
    "freeTier": "Keyless costs nothing and needs no account; it is limited per IP at the edge (3,000 requests / 5 minutes) rather than by a usage plan, so your limit does not move with anyone else's traffic. A caller holding a key is metered per key on two limits at once — a sustained rate and a rolling daily quota — and every response carries RateLimit-Policy, X-RateLimit-Limit, X-RateLimit-Window and X-RateLimit-Tier, so a caller reads its own budget rather than guessing. Exceeding either returns 429; an above-tier resource returns 402.",
    "pricingUrl": "https://apis.io/developer/plans"
  },
  "gaps": [
    "Only a PAID tier still requires a human. An agent can now go from cold discovery to an authorized call with no human at any step: sign with AAuth, POST grant_type=client_credentials, and it holds an account, an API key and its own quota. What it cannot do is buy anything — the scope ceiling for an agent principal is apis:read, and Pro data answers 402. Machine payment is a separate problem and is deliberately not solved here.",
    "The aauth mechanism has exactly one agent provider in its allowlist, and we run it. A probe of 1,486 hosts on 2026-08-30 found no other AAuth resource document anywhere in the catalog, so this is a worked example rather than an interoperating ecosystem — read it that way. draft-hardt-oauth-aauth-protocol expires 2027-02-21.",
    "maturity reads self-serve because that is the highest rung the AOD 0.1 enum has. It does not distinguish a stranger with a browser from a stranger with no human at all, and those are now two different doors here — api-evangelist/roadmap#117.",
    "No machine-readable way for a consumer to present who it is in place of that browser sign-in. The verification[] block above is empty for that reason; the KYA work that would fill it is unbuilt — api-evangelist/roadmap#110.",
    "This descriptor previously advertised console-only issuance and an info@apis.io address after self-serve sign-in had already shipped. Corrected 2026-08-31."
  ]
}