Documentation · Screening API

Authentication

The API needs no key today. This page explains what governs access now, how request limits behave when switched on, and what will change when keys arrive.

How access works today

The data service is open: every endpoint answers anonymous GET and POST requests, with no key, token or account. What you may do with the answers is set by our terms, not by a key:

  • Individual look-ups, due diligence on a specific matter, journalism and academic research are free under the terms of use.
  • Automated or systematic screening, use in a business process and redistribution need a commercial licence.

Our terms reserve the right to apply rate limits, volume caps or similar controls to the free services, and to decline access that appears automated, systematic or commercial.

Request limits

The data service has a per-address request limit that the operator can switch on. It is off unless configured, and no limit figure is published yet. When it is on:

  • every response carries X-RateLimit-Limit (requests allowed per minute) and X-RateLimit-Remaining;
  • a request over the limit gets HTTP 429 with a Retry-After header (seconds) and this body:
{"error": "Too many requests", "limit_per_minute": 60}

The figure in the example is illustrative. Handle 429 by waiting for Retry-After seconds before retrying, and batch up to 20 parties in one match request rather than sending them one by one.

To be provided: The request limit that will apply to anonymous use and to licensed use, if any (no limit is enforced today).

API keys

We do not issue API keys yet. When keys are introduced, this page will describe how to obtain one, the header that carries it and how to rotate it. Until then, do not send credentials to the API: it ignores them.

To be provided: Key issuance (self-service or on request), the request header and key format, trial keys, keys for public-interest and non-commercial users, rotation and revocation. Do not build against an assumed format.

Keep keys secret once issued. Treat any future key like a password: keep it out of source code and browser pages, and load it from an environment variable or a secret store.

Example: a client ready for keys

Keep the base address in one place so that adding credentials later is a one-line change.

import os, requests

BASE = os.environ.get("CROWN_API_BASE", "https://api.crownintelligence.net")
session = requests.Session()
session.headers["User-Agent"] = "my-screening-tool/1.0 ([email protected])"

r = session.post(f"{BASE}/api/match/default", json={"schema": "Company", "properties": {"name": ["Example Trading LLC"]}}, timeout=60)
if r.status_code == 429:
    print("Rate limited; retry after", r.headers.get("Retry-After"), "seconds")
r.raise_for_status()
print(r.json()["responses"]["q1"]["total"])
const BASE = process.env.CROWN_API_BASE ?? "https://api.crownintelligence.net";
const headers = { "Content-Type": "application/json", "User-Agent": "my-screening-tool/1.0 ([email protected])" };

const res = await fetch(`${BASE}/api/match/default`, { method: "POST", headers,
  body: JSON.stringify({ schema: "Company", properties: { name: ["Example Trading LLC"] } }) });
if (res.status === 429) console.log("Rate limited; retry after", res.headers.get("Retry-After"), "seconds");
console.log((await res.json()).responses.q1.total);

Questions about access: [email protected]. Commercial terms: talk to sales. Limits and quotas are also covered in the API FAQ.

Last updated 2026-10-03