Documentation

Base URL https://attestry.cashflowedx.com. The machine-readable description is at /v1/openapi.json (OpenAPI 3.1).

Quick start

Create an account, confirm your e-mail address, and create an API key in the console. The key is shown once. Send it as a Bearer token.

curl -s https://attestry.cashflowedx.com/v1/companies/search \
  -H "Authorization: Bearer $ATTESTRY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Siemens", "country": "DE", "limit": 5}'

How responses are shaped

Success is always {"data": …, "meta": {…}}. Failure is always {"error": {"code", "message", "details", "request_id"}} with a matching HTTP status. Every response carries an X-Request-Id header; quote it when you contact support.

Each field of a record is an object:

"legal_name": {
  "value": "…",
  "status": "verified",          // verified | unverified | inferred | unavailable
  "source": "gleif",
  "source_record_id": "…",
  "collected_at": "2026-11-12T09:30:00+00:00",
  "verified_at": "2026-10-02T07:11:42Z",
  "confidence": 0.95,
  "permitted_purposes": ["any_lawful_purpose"],
  "retention_days": 365,
  "restrictions": ["do_not_imply_gleif_endorsement"]
}

Send "view": "flat" to get only value and status per field. A field no source could supply is returned as {"value": null, "status": "unavailable"}; it is never filled with a guess.

Credits, limits and errors

• Credits are charged per record returned. Nothing found, a failed request, or a record withheld for privacy reasons costs nothing. meta.credits_charged and meta.credits_remaining are in every response.
• Rate limits are per API key per minute. See X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Over the limit you get 429 rate_limited with Retry-After.
• 402 quota_exceeded: the month's credits are used up. 422 filter_not_supported: no source supports that filter. 503 source_not_enabled: a source that could answer exists but is not switched on. 502 source_unavailable: the sources did not respond.
• Send an Idempotency-Key header on enrich and batch requests. Repeating the same request with the same key within 24 hours returns the first response and is not charged again.

Connect an AI agent (MCP)

The MCP endpoint is https://attestry.cashflowedx.com/mcp (Streamable HTTP). Authenticate with the same API key as a Bearer token.

# Claude Code
claude mcp add --transport http attestry https://attestry.cashflowedx.com/mcp \
  --header "Authorization: Bearer $ATTESTRY_API_KEY"

# Cursor, and other clients that read an mcp.json file
{
  "mcpServers": {
    "attestry": {
      "url": "https://attestry.cashflowedx.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Tools: search_companies, enrich_company, get_company_information, search_people, enrich_contact, verify_business_email, batch_enrich_companies, get_account_usage, list_data_sources.

Apps that sign in through the browser, such as custom connectors in the Claude and ChatGPT web apps, need only the address https://attestry.cashflowedx.com/mcp. They register themselves, send you to an Attestry page to approve access (OAuth 2.1 with PKCE), and can be disconnected in the console under Connect an agent.

Webhooks

Add an https endpoint in the console or with POST /v1/webhooks. Attestry sends batch.completed events. Each delivery has an Attestry-Signature: t=<unix time>,v1=<hex> header: the HMAC-SHA256 of <t>.<raw body> with your endpoint secret. Reject deliveries whose signature does not match or whose timestamp is more than five minutes old.

Endpoint reference

Companies

People

E-mail

Batches

Account

Transparency

Webhooks