If you want to know if a nonprofit exists in an official registry, create a Validation Request and we will check it for you. Documentary evidence can be attached to a Validation Request. When a Validation Request is accepted or rejected, the appropriate field (acceptedAt, rejectedAt) will be populated.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/goodstack:goodstack-validation-requests-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Goodstack Services Validation Requests API
version: v1
x-logo:
url: https://docs.goodstack.io/img/logo.png
altText: Goodstack logo
x-dark-logo:
url: https://docs.goodstack.io/img/icons/Logo-white.svg
altText: Goodstack logo
contact:
email: engineering-support@goodstack.io
name: Api support
description: '# Introduction
Goodstack API allows you to build good into your product by facilitating charitable donations. We achieve this through the API''s listed and specified in this documentation. For all donations using the Goodstack API, Goodstack handles the vetting and validation of the good causes and onward the disbursement of the donation. The Goodstack API is organised around REST. All API responses, including errors, return JSON and use standard HTTP response codes. In all API requests you must specify the content-type HTTP header as application/json. All API requests must be made over HTTPS. # Authentication
Authenticate your API requests by setting your live secret API key in the Authorization header. Two keys are provided to you, a publishable key prefixed with `pk_` and a secret key prefixed with `sk_`. Publishable API keys are meant solely to identify your goodstack account. These can safely be published in places like your JavaScript code, or in an Android or iPhone app and are meant for usage with our SDKs. Secret API keys should be kept confidential and only used in secure server environments. Anywhere that accepts a Publishable key will also accept a Secret key, but routes marked to accept a Secret key will not accept a Publishable key. # Formats
## IDs
All ID fields are case-sensitive. For example, `abc123` and `ABC123` are treated as different IDs. ## Dates
Dates are encoded as strings following the ISO 8601 standard `2025-08-01T12:00:00.000Z`. ## Pagination
A maximum of 100 objects can be returned per request and the limit can be specified by using the pageSize query parameter. By default, the pageSize is set to 25. A `_links` object is included in paginated responses, which contains `next` and `prev` URLs to retrieve the next or previous pages of results. ## Monetary Values
Throughout the API, monetary values are encoded as integers representing the amount in the smallest currency unit, for example 100 cents for a donation of $1.00. Currency is encoded as a string following the ISO 4217 standard (e.g. `USD`). ## Metadata
Some objects have a metadata parameter that you can use to store key-value data. You can specify up to 20 keys, with key names up to 40 characters long and values up to 250 characters long. ## Errors
The API returns standard HTTP response codes to indicate success or failure of API requests. Errors may include a custom error message. Error objects have these attributes, an `id`, a `message` corresponding to the HTTP response phrase of the error,
an optional `invalid-params` attribute detailing issues with the request. An example error object returned from the API:
```json
{
error: {
code: ''bad_request'',
title: ''Bad request'',
message: ''Something is wrong with your request, please check any parameters and try again'',
reasons: [''amount is a required field'']
}
}
```
A summary of the HTTP status codes returned from the api is listed in the table below. | Code | Title | Description |
| ------------- |-------------| -----|
| 200 | Success | Request successful |
| 204 | No Content | Request successful with no content returned |
| 400 | Bad Request | Request was invalid |
| 401 | Unauthorised | Authorization header is invalid |
| 403 | Forbidden | Insufficient permissions |
| 404 | Not Found | Resource does not exist |
| 429 | Too Many Requests | Rate Limited |
| 500s | Internal Server Error | Something went wrong with the Goodstack API |
# Enum Values
Generally enum fields in our API are open-ended. New values may be added to an enum and this is not considered a breaking change. ## Integrating safely
If your code handles enum values exhaustively — for example, a switch without a default case, or deserialisation into a strict typed enum — an unrecognised value may cause errors. We recommend adding a fallback handler for unknown enum values, so that any new value that does reach your integration degrades gracefully rather than failing.'
servers:
- url: https://api.goodstack.io
description: Production server
- url: https://sandbox-api.goodstack.io
description: Sandbox server
tags:
- name: Validation Requests
description: If you want to know if a nonprofit exists in an official registry, create a Validation Request and we will check it for you. Documentary evidence can be attached to a Validation Request. When a Validation Request is accepted or rejected, the appropriate field (acceptedAt, rejectedAt) will be populated.
paths:
/v1/validation-requests:
get:
security:
- SecretApiKey: []
summary: List Validation Requests
tags:
- Validation Requests
parameters:
- in: query
name: status
schema:
type: string
enum:
- pending
- accepted
- rejected
description: Filter for status of Validation Request
example: pending
- in: query
name: query
schema:
type: string
description: filter for name of ValidationRequest or assigned Organisation
- in: query
name: sort
schema:
type: string
enum:
- id
- name
description: Field to sort by
example: name
- $ref: '#/components/parameters/cursor'
- $ref: '#/components/parameters/pageSize'
responses:
'200':
description: Successfully listed Validation Requests
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
allOf:
- $ref: '#/components/schemas/ValidationRequest'
- type: object
properties:
organisationName:
type:
- string
- 'null'
description: assigned organisation's name
object:
type: string
example: validation_request
totalResults:
type: integer
example: 33
pageSize:
type: integer
example: 25
_links:
$ref: '#/components/schemas/CursorLinks'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
IncorrectParams:
$ref: '#/components/examples/IncorrectParams'
CursorError:
$ref: '#/components/examples/Pagination.CursorError'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/ForbiddenScope'
operationId: getV1ValidationRequests
x-operation-id-source: derived
post:
summary: Create a Validation Request
security:
- SecretApiKey: []
tags:
- Validation Requests
parameters:
- in: header
name: Idempotency-Key
schema:
type: string
required: false
description: Idempotency key
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
type: string
description: Name of the charity to validate
maxLength: 500
registryName:
type: string
description: Name of charity's registry
maxLength: 255
registryId:
type: string
description: Charity's id in registry
maxLength: 255
email:
type: string
example: test@goodstack.internal
maxLength: 255
addressLine1:
type: string
example: Testowa street 15
maxLength: 255
addressLine2:
type: string
example: Testowa street 22/15
maxLength: 255
city:
type: string
example: Katowice
maxLength: 255
postal:
type: string
example: 44-100
maxLength: 255
state:
type: string
example: Silesia
maxLength: 255
website:
type: string
format: website
example: https://goodstack.internal
maxLength: 255
countryCode:
type: string
example: POL
usaGroupExempt:
type: boolean
required:
- name
- registryName
- registryId
- website
- countryCode
responses:
'200':
description: Successfully created a Validation Request
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/ValidationRequest'
object:
type: string
example: validation_request
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
OriginalCallInProgress:
$ref: '#/components/examples/Idempotency.OriginalCallInProgress'
SameKeyDifferentData:
$ref: '#/components/examples/Idempotency.SameKeyDifferentData'
KeyInUse:
$ref: '#/components/examples/Idempotency.KeyInUse'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/ForbiddenScope'
operationId: postV1ValidationRequests
x-operation-id-source: derived
/v1/validation-requests/{id}:
parameters:
- in: path
name: id
schema:
type: string
required: true
description: Id of the Validation Request.
get:
security:
- SecretApiKey: []
summary: Retrieve a Validation Request
tags:
- Validation Requests
responses:
'200':
description: Successfully retrieved a Validation Request
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/ValidationRequest'
object:
type: string
example: validation_request
'400':
$ref: '#/components/responses/IncorrectParams'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/ForbiddenScope'
'404':
$ref: '#/components/responses/NotFound'
operationId: getV1ValidationRequestsById
x-operation-id-source: derived
components:
schemas:
Error:
type: object
properties:
error:
type: object
properties:
code:
type: string
title:
type: string
message:
type: string
reasons:
type:
- array
- 'null'
items:
type: string
ValidationRequestDocument:
type: object
properties:
id:
type: string
example: validationrequestdocument_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
validationRequestId:
type: string
example: validationrequest_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
url:
type: string
example: https://s3-eu-west-1.amazonaws.com/assets.poweredbypercent.com/document.docx
createdAt:
type: string
format: date-time
deletedAt:
type:
- string
- 'null'
format: date-time
ValidationRequest:
type: object
properties:
id:
type: string
example: validationrequest_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
name:
type: string
example: Some charity
registryName:
type: string
example: National Charities Registry
registryId:
type: string
example: I34324
description: Charity's ID in registry
email:
type:
- string
- 'null'
format: email
example: test@percent.internal
addressLine1:
type:
- string
- 'null'
example: Testowa street 15
addressLine2:
type:
- string
- 'null'
example: Testowa street 22/15
city:
type:
- string
- 'null'
example: Katowice
postal:
type:
- string
- 'null'
example: 44-100
state:
type:
- string
- 'null'
example: Silesia
website:
type: string
format: website
example: https://percent.internal
organisationId:
type:
- string
- 'null'
example: organisation_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
countryCode:
type: string
example: POL
rejectionReason:
type:
- string
- 'null'
description: Reason for rejecting
deprecated: true
enum:
- Organisation is not a nonprofit.
- Organisation didn’t provide sufficient proof of nonprofit status.
- Organisation is a nonprofit but doesn’t have an official registry ID.
- Other
rejectionReasonCode:
type:
- string
- 'null'
description: Reason code for rejecting
enum:
- other
- not_eligible
- incorrect_documentation
- not_attributable_to_registry
usaGroupExempt:
type:
- boolean
- 'null'
deprecated: true
createdAt:
type: string
format: date-time
example: '2020-10-13T17:46:54.000Z'
deletedAt:
type:
- string
- 'null'
format: date-time
example: '2020-10-13T17:46:54.000Z'
acceptedAt:
type:
- string
- 'null'
format: date-time
example: '2020-10-13T17:46:54.000Z'
rejectedAt:
type:
- string
- 'null'
format: date-time
example: '2020-10-13T17:46:54.000Z'
documents:
type: array
items:
$ref: '#/components/schemas/ValidationRequestDocument'
organisationTypes:
type: array
items:
type: string
enum:
- social_impact
- nonprofit
CursorLinks:
type: object
properties:
current:
type: string
example: https://.../v1/...?cursor=eyJ2Ijox...N3AifQ%3D%3D
next:
type: string
example: https://.../v1/...?cursor=eyJ2Ijox...N3AifQ%3D%3D
prev:
type: string
example: https://.../v1/...?cursor=eyJ2Ijox...N3AifQ%3D%3D
examples:
IncorrectParams:
summary: 400 Incorrect Parameters
description: Bad Request - Incorrect parameters
value:
error:
code: bad_request
title: Bad request
message: One or more of the inputs were invalid
reasons:
- pageSize must be greater than or equal to 0
Idempotency.SameKeyDifferentData:
summary: Idempotency - Data has changed from previous request
description: Data has changed from previous request with this key
value:
error:
code: idempotency/same_key_different_data
title: Bad request
message: Data has changed from previous request
Pagination.CursorError:
summary: Error in cursor parameter
description: We were unable to decode the cursor
value:
error:
code: pagination/cursor_error
title: Bad request
message: Unable to find the next page
Idempotency.KeyInUse:
summary: Idempotency - Key in use
description: Idempotency Key is already in use
value:
error:
code: idempotency/key_already_in_use
title: Bad request
message: Idempotency Key is already in use
Idempotency.OriginalCallInProgress:
summary: Idempotency - Original call in progress
description: Original call with this idempotency key is still in progress, please wait and try again
value:
error:
code: idempotency/original_call_in_progress
title: Bad request
message: Original call with this idempotency key is still in progress
parameters:
pageSize:
in: query
name: pageSize
required: false
schema:
type: integer
minimum: 0
default: 25
description: How many items per page, for pagination.
cursor:
in: query
name: cursor
required: false
schema:
type: string
example: eyJ2IjoxLCJkIjoibmV4dCIsImlkIjoiZG9uYXRpb25fMDAwMDAwQnc3U1BhMHBxOHBRMFFsckVaWGFaN3AifQ%3D%3D
description: A cursor that points to where to start the page
responses:
IncorrectParams:
description: Error validating inputs
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
code:
type: string
example: bad_request
title:
type: string
example: Bad request
message:
type: string
example: One or more of the inputs were invalid
reasons:
type: array
items:
type: string
example: pageSize must be greater than or equal to 0
NotFound:
description: The specified resource was not found
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
code:
type: string
example: not_found
title:
type: string
example: Resource not found
message:
type: string
example: This endpoint is unavailable or can not be found
Unauthorized:
description: Unauthorized
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
code:
type: string
example: unauthorized
title:
type: string
example: Unauthorized
message:
type: string
example: Access is denied due to invalid credentials
ForbiddenScope:
description: Forbidden (scope)
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
code:
type: string
example: forbidden
title:
type: string
example: Forbidden
message:
type: string
example: Access is denied due to missing scope permissions
securitySchemes:
PublishableApiKey:
type: apiKey
in: header
name: Authorization
description: API key starting with 'pk_' that can be made public
SecretApiKey:
type: apiKey
in: header
description: API key starting with 'sk_' that must be kept secure
name: Authorization
DonationSessionToken:
type: apiKey
in: header
name: donation-session-token
description: Donation session token
SCIMBearer:
type: http
scheme: bearer
description: 'SCIM API key issued for the partner, presented as a bearer token in the
`Authorization` header. The key is bound to a single partner and the
partner must have the `scim_api` scope enabled. A missing or invalid key
returns `401`; a valid key for a partner without the scope also returns
`401` (`detail: "scim feature not enabled for this partner"`).
'
x-tagGroups:
- name: NONPROFIT DATA
tags:
- Organisations
- Countries
- Registries
- Categories
- Organisation Branding
- name: NONPROFIT VALIDATIONS
tags:
- Validation Requests
- Validation Request Documents
- Validation Invites
- Validation Submissions
- Validation Submission Documents
- Validation Submission Configuration
- Monitoring Subscriptions
- Eligibility Subscriptions
- Activities
- Agent Verifications
- name: MONETARY DONATIONS
tags:
- Donations
- Donation Sessions
- Users
- Gift Aid
- Monetary Donation Verifications
- name: WORKPLACE GIVING
tags:
- Employees
- Giving Donations
- Donation Match Request
- Fundraising
- Volunteering
- Gamification
- Campaigns
- Budgets
- Donation Wallets
- name: WEBHOOK SUBSCRIPTIONS
tags:
- Webhook Subscriptions
- name: WEBHOOK EVENTS
tags:
- Agent Verification Events
- Country Compliance Check Events
- Donation Events
- Eligibility Subscription Events
- Monitoring Subscription Events
- Validation Request Events
- Validation Submission Events
- Monetary Donation Verification Events
x-provenance:
method: harvested
publisher: Goodstack
source: https://reference.poweredbypercent.com/openapi.json
note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
stamped by stamp-openapi-provenance.py (roadmap#793)