Quick Start

Endpoint

All API routes are served from the Atlas functions host.

Authorization

Send your scoped key as a bearer token. External callers must never use service-role credentials.

Authorization: Bearer pk_...

Making your first request

Start with a key carrying the sandbox scope. This request returns synthetic data, consumes zero read units and does not send anything. For live cited updates, use a production key carrying the REST API scope with GET /monitor-digest; production also requires API Access and an active allowance.

curl "https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/partner-api/sandbox" \
  -H "Authorization: Bearer pk_..."

Production API access

A workspace owner or admin can create a scoped API key on this page.

Atlas Professional and Team include the product workspace, configured integrations, developer documentation and an authenticated synthetic no-write sandbox. Production API keys, production MCP and outbound webhooks require Core, Scale or an Enterprise agreement.

Both tiers include REST keys, MCP research tools, source refreshes and webhooks. Production requests require an enabled package and available read units. API keys do not grant permission to send email or Slack messages.

Contact Pimlico Solutions for Enterprise volumes or rollout support.

Start with a sandbox key to test your requests.

What a read unit means

A read unit is a predictable weight reserved for one authorized API or MCP operation. It is not one returned record and it is not a separate charge for every item in a page. Each additional page is a new request with the same displayed weight. Reuse the same request id only when retrying that exact logical operation.

If the whole Core monthly allowance were used for only one operation type, it would cover approximately:

Most customers use a mix. Metadata, sandbox validation and connector configuration consume zero read units. X-Atlas-* response headers include the request, operation weight, used allowance and remaining allowance so usage can be reconciled without guessing.

What the API supports

Atlas API currently supports the following operations:

• Published regulation list and detail retrieval
• Exact-source freshness evidence and verified-age gates
• Tenant-bound asynchronous exact-source refresh jobs and receipts
• Coverage and taxonomy discovery
• Durable regulation versions and field-level changes
• Monitor digest retrieval
• Durable, cursor-paginated monitor event retrieval
• Read-only watchlist and project context
• Client coverage management
• Signed outbound webhook registration
• MCP query tools and bounded exact-source refresh
• Official TypeScript and Python SDK source packages

How to build it into your stack

Native Slack is not another API response format. Use the separately authorised Slack connector when Atlas should own channel delivery; use a signed webhook when the customer's service should own the downstream action.

Query the regulatory question

Atlas exposes regulatory facts as composable dimensions rather than forcing customers to know our internal tables. Filters combine with AND semantics. Every returned record carries stable identity, source provenance and normalized Atlas Data dimensions; it never infers customer applicability or authorizes a delivery action.

Query contract version: 2026-09-05.regulations-query.v2. Pin this value in production clients and review the machine-readable contract before adopting a later version.

Source checks

Results include when Atlas last checked the original source. This is separate from the record’s publication and update dates. Reading a record does not recheck its source.

To request a new check, usePOST /freshness/refresh-jobs and anIdempotency-Key, then poll/freshness/refresh-jobs/{job_id}. Creation costs 25 read units; polling costs 1. The limit is 25 jobs per workspace per UTC day. The default maximum age is 26 hours; source-check schedules vary.

Interactive query explorer

Build the regulatory question in the browser, copy an official SDK example, and use live taxonomy values when you have a scoped key. Keys entered here remain in component memory only and are not stored by the documentation page.

curl "https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/partner-api/regulations?jurisdiction=EU&vertical=AI&freshness_mode=standard&freshness_max_age_seconds=93600&limit=25" \
  -H "Authorization: Bearer $ATLAS_API_KEY"

API Reference

Use OpenAPI or Postman for the full contract. The table below keeps the first integration path short.

SDK release candidates

The checked-in TypeScript and Python clients wrap the same OpenAPI contract. Both expose regulatory queries, coverage, taxonomy, version history, monitor reads and Atlas request/read-unit receipts. They apply bounded timeouts and retry only idempotent GET requests. Their distributable artifacts are verified, but the registry packages are not yet published.

Install commands will appear only after signed registry readback is recorded in the API changelog. Until then, use the OpenAPI-generated contract or the checked-in SDK source provided during assisted onboarding.

MCP

Connect a remote HTTP MCP client to https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/mcp-regulatory. Choose OAuth and sign in to your Atlas workspace. Server applications can use a production key with the mcp scope for research tools.

• Find research with search_regulations, or usequery_regulations for exact filters. Coverage and taxonomy tools list the available jurisdictions, authorities and verticals.
• Check source dates in the results. To request a new check for up to 10 records, use request_regulatory_refresh, then poll its job. The source-check limits above apply.
• OAuth clients can preview email or Slack messages for configured destinations. Sending requires confirmation of the exact preview, workspace permission and an idempotency key. Research API keys cannot send messages. Other app deliveries are available through Atlas’s integration screens.

Access stays tied to the selected workspace and ends if membership or authorization is revoked. Production access requires the MCP/API package and available read units. Use tools/list for tool schemas andhttps://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/partner-api/query-capabilities for supported filters.

Outbound events

Outbound events use signed JSON envelopes and stable Atlas event ids. Use them when a customer-owned receiver should decide what to do next. Registering a webhook does not authorize Slack: the endpoint, subscribed event type, route policy, signature check, retry state and delivery receipt are separate controls.

Error handling

Protected routes fail closed without a valid scoped key, package entitlement and active allowance. Send a stable Idempotency-Key (or X-Request-Id) when retrying. Atlas returns the canonical request id and read-unit receipt in X-Atlas-* response headers.

Rate limits

Core defaults to 60 requests per minute with 15 immediately available burst tokens; Scale defaults to 120 per minute with 30 burst tokens. Contracted organization overrides can differ. Follow pagination.next_cursor until has_more is false and treat RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and X-Atlas-Rate-Limit-Policy as the authoritative receipt.

Only API_RATE_LIMITED includes Retry-After. Read-unit exhaustion or a capped-overage decision is not transient and must not be retried as a rate limit. The official SDKs keep one X-Request-Id across bounded GET retries and never retry earlier than the server instructs.