Skip to main content

​
API keys

Send your key on every authenticated request, as either header: 
curl "https://api.financialdatapi.com/v1/public/coverage" \
  -H "x-api-key: $CONDUIT_API_KEY"
Keys are stored hashed and compared in constant time. Keep them server-side; never ship a key in client-side code.

​
Public, no-key endpoints

These are open so agents and tooling can discover the API before authenticating:
EndpointPurpose
GET /healthLiveness check.
GET /readyReadiness check.
GET /openapi.jsonOpenAPI 3.1 document.
GET /llms.txtCompact, sectioned index of every endpoint — start here as an agent.
GET /llms-full.txtFull endpoint reference with parameters.

​
Errors

Errors use a stable envelope and codes — distinguish “don’t retry” (bad_request, not_found, unauthorized, forbidden) from “retry with backoff” (rate_limited, internal_error): 
{
  "error": { "code": "unauthorized", "message": "Missing or invalid API key", "request_id": "req_..." },
  "requestId": "req_..."
}
StatusCodeMeaning
400bad_requestMalformed request or unknown query param.
401unauthorizedMissing or invalid key.
403forbiddenValid key, insufficient scope.
404not_foundNo such resource.
429rate_limitedSlow down; retry after a pause.
500internal_errorTransient server error; retry with backoff.

​
Scopes

Keys are least-privilege scoped (data:read for the data API; ops:read for health/coverage). Most usage only needs data:read. Request the scopes you need when you get a key.