FilingSift Intake API

openapi: 3.2.0
info:
  title: FilingSift Intake API
  version: 1.0.0
  description: FilingSift v1 REST contract for source-cited SEC filing facts, facilities, covenants, filing comparisons, research workflows, and reference-source intelligence. Responses preserve source evidence, provenance, uncertainty, and validation status so every result can be traced to its origin. Route availability follows the production service and the authenticated account's permissions; current endpoint responses are authoritative. FilingSift does not automatically assign materiality, investment, financial, or legal conclusions. Request limits, authentication, issuer/history access, and pagination differ by resource. The URL query guard does not count JSON body fields. Query cost equals 5 plus the effective query-string limit (20 when omitted), plus 3 for each query parameter other than limit and cursor, plus 2 when a cursor is present. X-Query-Cost and X-Max-Query-Cost report the applied and allowed amounts when the request reaches the query guard; earlier refusals may omit them. Plan limits stop requests or account actions; they do not create overage charges. The SEC worker restarts one minute after its prior bounded run completes, plus randomized delay, with an operating target of discovery within five minutes of SEC acceptance. Extraction and delivery follow asynchronously. Active reference sources fetch on the first eligible cache miss with source-specific caches from five minutes to six hours. Treasury, Federal Reserve Board, OFR, BIS, the FDIC and GLEIF expansion datasets, and the Treasury Fiscal combined report have no deployed saved monitor. Alert mode instant makes a processed alert due for the next ingestion monitoring stage; quiet hours, capacity, and retries can defer delivery. Operating targets are not current-state claims; GET /coverage/status is authoritative for current SEC backlog and delay.
  contact:
    name: FilingSift Support
    email: support@filingsift.com
servers:
- url: https://api.filingsift.com/api/v1
  description: FilingSift production API
- url: http://127.0.0.1:5000/api/v1
  description: Local development
tags:
- name: Intake
  description: First-party website intake
paths:
  /leads:
    post:
      tags:
      - Intake
      operationId: createLead
      summary: Store a design-partner early-access request
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LeadRequest'
      responses:
        '201':
          description: Request stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LeadResponse'
        '202':
          description: Honeypot request accepted without storage
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '429':
          $ref: '#/components/responses/RateLimited'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /analytics/events:
    post:
      tags:
      - Intake
      operationId: createAnalyticsEvent
      summary: Store an allowlisted cookie-free first-party website event
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnalyticsEventRequest'
      responses:
        '202':
          description: Event stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '429':
          $ref: '#/components/responses/RateLimited'
components:
  schemas:
    AnalyticsEventRequest:
      type: object
      required:
      - event
      - path
      properties:
        event:
          type: string
          enum:
          - page_view
          - explorer_loaded
          - explorer_fallback
          - design_partner_form_started
          - design_partner_form_submitted
          - design_partner_form_failed
        path:
          type: string
          maxLength: 500
          pattern: ^/
        properties:
          type: object
          additionalProperties:
            oneOf:
            - type: string
              maxLength: 200
            - type: number
            - type: boolean
    ErrorResponse:
      type: object
      required:
      - error
      properties:
        error:
          type: object
          required:
          - code
          - message
          - reason
          properties:
            code:
              type: string
            message:
              type: string
            reason:
              $ref: '#/components/schemas/ErrorReason'
        requestId:
          type: string
        meta:
          $ref: '#/components/schemas/ApiMeta'
    LeadRequest:
      type: object
      required:
      - name
      - email
      - company
      - workflow
      - pilot
      - turnstileToken
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 120
        email:
          type: string
          format: email
          maxLength: 254
        company:
          type: string
          minLength: 1
          maxLength: 200
        workflow:
          type: string
          enum:
          - Credit or covenant monitoring
          - Investment research
          - Financial data product
          - AI or agent development
          - Other
        coverage:
          type: string
          maxLength: 2000
        pilot:
          type: string
          enum:
          - Ready for a paid pilot
          - Open to a paid pilot after validation
          - Researching for later
        website:
          type: string
          maxLength: 200
          description: Honeypot; human users leave blank.
        turnstileToken:
          type: string
          minLength: 1
          maxLength: 2048
          writeOnly: true
          description: Single-use Cloudflare Turnstile token for action lead.
    ErrorReason:
      type: object
      required:
      - category
      - retryable
      properties:
        category:
          type: string
          enum:
          - request
          - rate_limit
          - response_limit
          - service
        retryable:
          type: boolean
        retryAfterSeconds:
          type: integer
        details:
          type:
          - object
          - 'null'
          additionalProperties: true
        maximumCost:
          type: integer
        calculatedCost:
          type: integer
        maximumBytes:
          type: integer
        actualBytes:
          type: integer
    ApiMeta:
      type: object
      required:
      - schemaVersion
      - apiVersion
      properties:
        schemaVersion:
          type: string
          const: 1.0.0
        apiVersion:
          type: string
          const: '1'
        mode:
          type: string
        pagination:
          $ref: '#/components/schemas/Pagination'
    Pagination:
      type: object
      required:
      - limit
      - returned
      - hasMore
      - nextCursor
      properties:
        limit:
          type: integer
          minimum: 1
          maximum: 100
        returned:
          type: integer
          minimum: 0
          maximum: 100
        hasMore:
          type: boolean
        nextCursor:
          type:
          - string
          - 'null'
    LeadResponse:
      type: object
      required:
      - data
      - meta
      properties:
        data:
          type: object
          required:
          - id
          - receivedAt
          properties:
            id:
              type: string
            receivedAt:
              type: string
              format: date-time
        meta:
          $ref: '#/components/schemas/ApiMeta'
    AcceptedResponse:
      type: object
      required:
      - data
      - meta
      properties:
        data:
          type: object
          required:
          - received
          properties:
            received:
              type: boolean
              const: true
        meta:
          $ref: '#/components/schemas/ApiMeta'
  responses:
    RateLimited:
      description: API-wide fixed-window request limit exceeded
      headers:
        Retry-After:
          $ref: '#/components/headers/RetryAfter'
        RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServiceUnavailable:
      description: Turnstile, commercial billing, or another required service is temporarily or intentionally unavailable
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid filter, cursor, request, or query cost
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  headers:
    RateLimitLimit:
      description: Request limit for the current fixed window
      schema:
        type: integer
    RateLimitReset:
      description: Seconds until the current fixed window resets
      schema:
        type: integer
    RateLimitRemaining:
      description: Requests remaining in the current window
      schema:
        type: integer
    RetryAfter:
      description: Seconds before retrying
      schema:
        type: integer
  securitySchemes:
    BrowserSession:
      type: apiKey
      in: cookie
      name: __Host-filingsift_session
      description: Secure HttpOnly SameSite=Lax production browser cookie, set by authentication responses. Raw tokens are not returned to browser JavaScript. Cookie-authenticated mutations require a trusted Origin and X-FilingSift-CSRF header equal to 1. API keys do not authenticate browser-only workspace operations.
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: FilingSift API key
      description: High-entropy fs_live API key in Authorization. FilingSift persists only token hashes. Production browser sessions use BrowserSession cookies, not Bearer tokens.