> ## Documentation Index
> Fetch the complete documentation index at: https://docs.compliapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Overview

> Base URL, authentication, and conventions shared by every endpoint

All endpoints live under a single base URL:

```
https://api.compliapi.com/api/v1
```

Everything is a `GET`. Metered endpoints (screening, VPN, geolocation) require a bearer [API token](/authentication) — or, with no token at all, [x402 pay-per-request](/payments). The public data feeds (`/stats`, `/delisted`, `/screen/lists`) are unauthenticated and free.

## Requests and quota

Each metered request costs one credit against your organization's monthly quota, regardless of how many lists match. Over quota you get `402` with the option to pay per request or upgrade; burst limits return `429` with a `Retry-After` header. Every request is written to your audit trail.

## Rate-limit headers

Every metered response (and the free `/search`) reports its burst window in the standard [IETF draft RateLimit headers](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/), so clients and agents can self-throttle instead of waiting for a `429`:

| Header | Meaning |
| - | - |
| `RateLimit-Limit` | Requests allowed in the current window |
| `RateLimit-Remaining` | Requests left in the window (the current request already counted) |
| `RateLimit-Reset` | Seconds until the window frees up |
| `RateLimit-Policy` | The policy in `<limit>;w=<window-seconds>` form, e.g. `120;w=60` |

Both `429` variants carry `Retry-After`: on a burst `429` it is seconds until the window frees; on a monthly-quota `429` it points at the period roll (paying per request via [x402](/payments) or upgrading works sooner).

## Versioning

The API is versioned in the URL path (`/api/v1`); see the [versioning and deprecation policy](/api/versioning) for what can change without notice and how deprecations are signaled.

## Response conventions

Screening responses share [one envelope](/api/screen): `sanctioned` is true only for government **sanctions**-list hits, `flagged` is true for any hit (sanctions, crime-intelligence, or risk-exposure), and every match names the list that produced it. All timestamps are UTC ISO-8601.

The same endpoints are also exposed as [MCP tools](/mcp) for AI agents.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.