AI Law Tracker Report API

openapi: 3.2.0
info:
  title: AI Law Tracker — Public Laws Report API
  version: v1
  description: Read-only, versioned JSON API over the audited AI-regulation dataset (US state + federal, EU, and global). FREE beta. Data is CC BY 4.0 — attribution required. Informational only, not legal advice.
  license:
    name: CC BY 4.0
    url: https://creativecommons.org/licenses/by/4.0/
servers:
- url: https://ai-law-tracker.com/api/v1
security:
- {}
- ApiKeyAuth: []
- BearerAuth: []
tags:
- name: Report
paths:
  /report:
    post:
      summary: On-demand AI compliance report (PDF or signed link) — the $79 report engine as…
      description: 'Generate the personalized, source-grounded AI-law compliance report for a business profile — the SAME deterministic engine behind the $79 /compliance-report product (no LLM in the grounded path — it cannot invent a statute, deadline, or penalty). POST state + sector (+ optional AI-use profile). Default response is JSON: the risk assessment (1–10 score + obligations) plus a signed `report.download_url` for the rendered PDF. Pass `format:"pdf"` (or send `Accept: application/pdf`) to stream the PDF binary inline instead. Paid feature (Pro+) with a monthly report quota per tier (Pro 5/mo, Business 25/mo); when the quota is exhausted the endpoint returns 402 with an upgrade / single-report hint. Lower tiers receive a preview (risk band + counts + one sample obligation) with the PDF/download withheld behind an upgrade hint. Informational only — NOT legal advice.'
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - state
              - sector
              properties:
                state:
                  type: string
                  description: US state slug (e.g. california). `jurisdiction` is accepted as an alias.
                jurisdiction:
                  type: string
                  description: Alias for `state` (US state slug).
                sector:
                  type: string
                  description: Sector slug (see /sectors).
                aiUse:
                  type: array
                  items:
                    type: string
                    enum:
                    - hiring
                    - customer
                    - content
                    - analytics
                    - product
                    - other
                ai_decision_impact:
                  type: string
                  enum:
                  - hiring_firing
                  - credit_insurance
                  - healthcare
                  - housing
                  - internal_only
                  - not_sure
                countries:
                  type: array
                  items:
                    type: string
                  description: EU/global country slugs also operated in/served.
                bias_audit:
                  type: string
                  enum:
                  - recent
                  - old
                  - never
                  - unknown
                ai_policy:
                  type: string
                  enum:
                  - formal
                  - informal
                  - none
                  - developing
                ai_source:
                  type: string
                  enum:
                  - custom
                  - third_party
                  - embedded
                  - combination
                  - not_sure
                size:
                  type: string
                  description: Company size band (e.g. startup, small, medium, enterprise).
                company:
                  type: string
                  description: Company name printed on the report (optional).
                email:
                  type: string
                  format: email
                  description: Delivery email printed on the report footer (optional).
                format:
                  type: string
                  enum:
                  - json
                  - pdf
                  description: json (default) → summary + signed download link; pdf → stream the PDF binary.
      responses:
        '200':
          description: 'The report — JSON (assessment + download link) or, with format=pdf/Accept: application/pdf, the PDF binary.'
          content:
            application/json:
              schema:
                type: object
                properties:
                  api_version:
                    type: string
                  data:
                    type: object
                    properties:
                      risk:
                        $ref: '#/components/schemas/Risk'
                      applicable_law_count:
                        type: integer
                      jurisdictions:
                        type: array
                        items:
                          type: string
                      obligations:
                        type: array
                        items:
                          $ref: '#/components/schemas/Obligation'
                      report:
                        type: object
                        properties:
                          available:
                            type: boolean
                          format:
                            type: string
                            example: pdf
                          filename:
                            type: string
                          download_url:
                            type: string
                            format: uri
                            description: Signed private link to fetch the rendered PDF.
                          expires_in_days:
                            type: integer
                          required_tier:
                            type: string
                            description: On a preview, the tier that unlocks the PDF.
            application/pdf:
              schema:
                type: string
                format: binary
                description: The rendered compliance-report PDF.
        '400':
          description: Missing state/sector or malformed body
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: createReport
      tags:
      - Report
components:
  schemas:
    Error:
      type: object
      properties:
        api_version:
          type: string
        error:
          type: object
          properties:
            code:
              type: string
              example: rate_limited
            message:
              type: string
            docs:
              type: string
            retry_after:
              type: integer
              description: Seconds (429 only).
          required:
          - code
          - message
    Risk:
      type: object
      description: Deterministic 1–10 risk score (same inputs → same score; no model).
      properties:
        score:
          type: integer
          minimum: 1
          maximum: 10
        level:
          type: string
          enum:
          - Low
          - Medium
          - High
          - Critical
        factors:
          type: array
          items:
            type: string
          description: Named contributions to the score (full result only; withheld in a preview).
    Obligation:
      type: object
      description: A derived AI-law obligation — who must do what, by when, or owe what penalty. Retrieved from curated primary sources (no LLM); NOT legal advice.
      properties:
        law:
          type: string
          example: HB 3773 — AI in Employment (amends the IL Human Rights Act)
        jurisdiction:
          type: string
          example: Illinois
        layer:
          type: string
          enum:
          - state
          - federal
          - landscape
          - country
          description: “landscape” = a notable law that may not apply to you (out-of-state); see may_not_apply.
        applies_because:
          type:
          - string
          - 'null'
          description: Why this obligation was surfaced for the given context.
        obligation:
          type:
          - string
          - 'null'
          description: The plain-English duty ("what must I do").
        deadline:
          type:
          - string
          - 'null'
          description: Free-text effective/compliance date verbatim from the source ("by when").
        penalty:
          type:
          - string
          - 'null'
        status:
          type:
          - string
          - 'null'
        citation:
          type:
          - string
          - 'null'
          example: 42 U.S.C. § 2000e
        government_body:
          type:
          - string
          - 'null'
          example: EEOC
        may_not_apply:
          type: boolean
          description: true when the law binds another jurisdiction and may not apply to the caller.
        source_url:
          type:
          - string
          - 'null'
          description: Primary/official source for this obligation.
        source_tier:
          type: string
          enum:
          - primary
          - secondary
          - unverified
          description: Grounding tier of source_url.
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
    BearerAuth:
      type: http
      scheme: bearer
x-news:
  description: GET /v1/news copyright + tier gate. We serve ONLY the headline, a short excerpt, the publisher name and the source URL — never full article text. Free = a taste (newest headlines only, low volume, excerpt withheld); Developer+ = the full archive, high volume + the excerpt.
  recency_window_days:
    anonymous: 14
    free_key: 45
    developer: null
    pro: null
    business: null
  excerpt: Developer+ only (withheld on the free/anon taste).
x-webhooks:
  description: Outbound change notifications. Subscribe with POST /v1/webhooks; deliveries are POSTed to target_url with an HMAC-SHA256 signature.
  events:
  - law.created
  - law.updated
  payload:
    $ref: '#/components/schemas/WebhookPayload'
  headers:
    X-ALT-Signature: sha256=<hex HMAC-SHA256 of `${timestamp}.${rawBody}` under your signing_secret>
    X-ALT-Timestamp: Unix seconds; folded into the signed content (reject if skew is large).
    X-ALT-Event: law.created | law.updated
    X-ALT-Delivery: Delivery uuid — use as an idempotency key.
    X-ALT-Webhook-Id: The subscription uuid.
  delivery: At-least-once. Up to 6 attempts with exponential backoff; 10 consecutive failures auto-disable the webhook. De-duplicate on X-ALT-Delivery / event_id.
  verify_example_node: "const crypto = require('crypto');\nfunction verify(req, secret) {\n  const ts = req.headers['x-alt-timestamp'];\n  const sig = (req.headers['x-alt-signature'] || '').replace(/^sha256=/, '');\n  const expected = crypto.createHmac('sha256', secret).update(`${ts}.${req.rawBody}`).digest('hex');\n  const a = Buffer.from(sig), b = Buffer.from(expected);\n  return a.length === b.length && crypto.timingSafeEqual(a, b);\n}"
x-rate-limits:
  description: 'A KEY IS REQUIRED on every data endpoint (since 2026-08-20); a keyless request answers 401 key_required. Free keys are self-serve and need no card — POST /v1/keys, or https://ai-law-tracker.com/developers#get-key. Open without a key: /v1/health, /v1/openapi.json, /v1/keys, /v1/checkout, /v1/auth, /v1/us-law/taxonomy and /v1/us-law/jurisdictions. Per-key limits are enforced by the gate; every response carries X-RateLimit-Limit/Remaining/Reset and a 429 includes Retry-After. Per-key overrides (rate_limit/daily_limit/monthly_limit) take precedence over the tier defaults — GET /v1/me always reports YOUR effective numbers.'
  keyless: not served — 401 key_required (see the open-endpoint list above)
  free_key: 60 req/min, 300 req/day, 9000 req/month
  starter: 150 req/min, 5000 req/day, 150000 req/month
  pro: 300 req/min, 10000 req/day, 300000 req/month
  business: 1000 req/min, 15000 req/day, 450000 req/month
  oem: 1500 req/min, 20000 req/day, 600000 req/month
  enterprise: 2000 req/min, 2000000 req/day (custom above this — contact sales)
  us_law_platform:
    us_free: US Law — Free — 60 req/min, 500 req/day, 750 records/day
    us_entry: US Law — Starter — 100 req/min, 5000 req/day, 2500 records/day
    us_solo: US Law — Solo — 150 req/min, 10000 req/day, 2800 records/day
    us_starter: US Law — Pro — 300 req/min, 25000 req/day, 3100 records/day
    us_pro: US Law — Business — 600 req/min, 100000 req/day, 75000 records/day
    us_enterprise: US Law — Enterprise — 2000 req/min, 500000 req/day, 250000 records/day
x-pricing:
  description: Two product lines over two corpora. AI Law Tracker sells the AI-specific corpus (/laws, /search, /news, the interpreted obligations layer); the US Law Platform sells the general US-law corpus (/us-law) and is metered on RECORDS SERVED rather than requests. A key is licensed for one line or the other (or both). See https://ai-law-tracker.com/pricing.
  ai_law:
  - id: free
    name: Free
    price_usd_month: 0
    self_serve: false
    note: Demo & prototyping
  - id: starter
    name: Starter
    price_usd_month: 49
    self_serve: true
    note: Ship your first integration
  - id: pro
    name: Pro
    price_usd_month: 99
    self_serve: true
    note: AI products & vendors
  - id: business
    name: Business
    price_usd_month: 299
    self_serve: true
    note: Vendors, firms & gov-affairs
  - id: oem
    name: OEM / White-label
    price_usd_month: 499
    self_serve: false
    note: Embed & redistribute the data
  - id: enterprise
    name: Enterprise
    price_usd_month: null
    self_serve: false
    note: Big 4, insurers & RegTech platforms
  us_law:
  - id: us_free
    name: US Law — Free
    price_usd_month: 0
    records_per_day: 750
    self_serve: false
    note: Evaluate the corpus before you commit
  - id: us_entry
    name: US Law — Starter
    price_usd_month: 99
    records_per_day: 2500
    self_serve: true
    note: Evaluate in production, on one project
  - id: us_solo
    name: US Law — Solo
    price_usd_month: 199
    records_per_day: 2800
    self_serve: true
    note: One developer, one application
  - id: us_starter
    name: US Law — Pro
    price_usd_month: 499
    records_per_day: 3100
    self_serve: true
    note: A team building on the corpus, over the API
  - id: us_pro
    name: US Law — Business
    price_usd_month: 1500
    records_per_day: 75000
    self_serve: false
    note: Pipelines & bulk export, under licence
  - id: us_enterprise
    name: US Law — Enterprise
    price_usd_month: null
    records_per_day: 250000
    self_serve: false
    note: Platforms, insurers & redistribution
  retired:
  - id: developer
    name: Developer
    price_usd_month: 29
    note: Withdrawn from sale 2026-08-19. Existing keys keep every limit and capability they had; no new checkout is accepted. Replaced by Starter ($49).
x-attribution: Data by AI Law Tracker (CC BY 4.0) — https://ai-law-tracker.com