Concepts

Your plan gives you a monthly credit allowance that every API draws on. You do not need a separate subscription per API, and you do not have to decide in advance which ones you will use most.

Most lookups cost 1 credit. Heavier queries, such as a sanctions screen or a company search, cost 2. Batch endpoints cost 1 credit per 10 ids. Responses are cached for 24 hours, and any repeat of the same request in that window costs 1 credit, whatever the endpoint. The Free plan stops at 100 credits; paid plans keep working and bill the extra credits at the end of the month.

Every response wraps the record in data and describes the call in meta. Records are flat: keys contain dots but values are not nested objects, so they map directly to columns.

{
  "data": { ... },
  "meta": {
    "credits_charged": 1,
    "credits_remaining": 1999,
    "cached": false,
    "suppressed": false,
    "attribution": "...",
    "sources": [
      {
        "id": "cisa-kev",
        "name": "CISA Known Exploited Vulnerabilities Catalog",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
        "licence": "CC0 1.0",
        "attribution": "Includes data from the CISA Known Exploited Vulnerabilities Catalog (CC0). Not endorsed by CISA.",
        "data_as_of": "2026-09-24",
        "coverage": "live"
      }
    ]
  }
}

Each source is imported every night and has to pass checks on structure, volume and known records before it replaces the previous day's data. data_as_of is the date of the data a source contributed to your response. coverage tells you the state of that source:

A stale source is never hidden: you get the last good data with its real date, so you can decide whether it is fresh enough for your use.

Where a record could identify a person, we keep only what a lookup needs. Anyone can ask for a record to be suppressed by emailing team@stackbyte.app. We acknowledge requests within 48 hours. A suppressed record returns data: null with meta.suppressed set to true.

Use is currently governed by fair use. Per-key rate limits are coming; when they arrive they will be documented here and announced in the changelog.

All endpoints live under /v1. Within a version we only add things: new endpoints, new fields and new sources. Renaming or removing a field, or changing its meaning, would come as a new version path, announced in the changelog.