{"aod":"0.1","provider":{"name":"Plinth","url":"https://www.useplinth.com","portalUrl":"https://data.useplinth.com/developers","apisJsonUrl":"https://data.useplinth.com/.well-known/apis.json"},"maturity":"self-serve","account":{"required":true,"signupUrl":"https://data.useplinth.com/account","agentPolicy":"allowed","prerequisites":["A Plinth account — Google sign-in or an email link at /account. No card for the free tier.","Nothing at all for GET /api/v1/search, which resolves a name to an EIN un-keyed and unmetered.","Nothing at all for `?example=1` on any endpoint: a real response envelope, including the error and warning shapes, with no key and no metering.","No account for a trial key: sign a request to /api/v1/agent-key (RFC 9421, Web Bot Auth) and get 250 calls for 24 hours, every fiscal year in the corpus."],"plans":[{"name":"Free ($0)","requiredFor":"50 REST calls a day across /grants/* (the grant graph) and /uk/* (England and Wales). The organization endpoints (/screening, /essentials, /premier), POST /api/v1/sql and the connector are paid.","url":"https://data.useplinth.com/pricing"},{"name":"For nonprofits ($75/month)","requiredFor":"250 REST calls a day, plus plain-English analysis with no daily question cap, within a monthly usage budget.","url":"https://data.useplinth.com/pricing"},{"name":"For consultants ($250/month)","requiredFor":"10,000 REST calls a month, plus POST /api/v1/sql, the people/board and asset tables, the MCP connector, and raw filing retrieval through the connector's get_filing tool.","url":"https://data.useplinth.com/pricing"}],"termsOfService":{"url":"https://data.useplinth.com/terms","acceptance":"implicit"}},"verification":[],"registration":{"applicationNoun":"API key","owner":"developer","mechanisms":[{"type":"open","description":"Entity resolution is open: GET /api/v1/search takes a name and returns EIN, kind, state and the canonical page URL with no key and no metering. It is the intended first call.","baseUrl":"https://data.useplinth.com/api/v1/search","docsUrls":["https://data.useplinth.com/developers#resolve"]},{"type":"portal-api","description":"Trial keys are self-serve for SOFTWARE: POST /api/v1/agent-key signed per RFC 9421 under the Web Bot Auth profile (cover @authority and signature-agent, tag \"web-bot-auth\", publish your Ed25519 key at /.well-known/http-message-signatures-directory on your own host). No account, no browser. 250 calls over 24h, every fiscal year in the corpus, limit ≤ 25; a directory that signs its own response, or an allowlisted operator, gets more. GET the same path for the full requirements.","baseUrl":"https://data.useplinth.com/api/v1/agent-key","registrationEndpoint":"https://data.useplinth.com/api/v1/agent-key","docsUrls":["https://data.useplinth.com/developers#agent-trial"]},{"type":"console-only","description":"The ongoing REST key is minted by a signed-in human at /account (one key per account, rotatable, shown once). There is no programmatic issue endpoint for THAT key — the trial above is the programmatic path, and it expires.","baseUrl":"https://data.useplinth.com/account","docsUrls":["https://data.useplinth.com/developers#auth"]},{"type":"dcr","description":"The MCP connector accepts RFC 7591 dynamic client registration — an agent registers itself, then runs authorization_code + PKCE S256 against the endpoints in our RFC 8414 metadata. The account it authorizes must be on a plan that includes the connector.","baseUrl":"https://data.useplinth.com/api/connector/mcp","registrationEndpoint":"https://data.useplinth.com/oauth/register","authorizationEndpoint":"https://data.useplinth.com/oauth/authorize","tokenEndpoint":"https://data.useplinth.com/oauth/token","docsUrls":["https://data.useplinth.com/connect"]}]},"authentication":{"methods":[{"id":"api-key","type":"header-env","header":"X-API-Key","env":["PLINTH_API_KEY"],"tokenPrefix":"plinth_sk_","bootstrap":"A human signs in at /account once and mints the key; after that nothing is manual."},{"id":"connector-oauth","type":"oauth-pkce-browser","tokenEndpoint":"https://data.useplinth.com/oauth/token","bootstrap":""},{"id":"web-bot-auth","type":"request-signing","header":"Signature","bootstrap":"Generate an Ed25519 keypair, publish the public half as a JWKS at https://<your-host>/.well-known/http-message-signatures-directory, then sign a POST to /api/v1/agent-key. Nothing is manual and nothing is issued to you first."}]},"credentials":[{"type":"api-key","fields":{"api_key":"Trial key from /api/v1/agent-key, sent as X-API-Key. Prefix plinth_ak_."},"ttl":"24h (signed) to 720h (allowlisted operator)","rotation":"Sign the same endpoint again: a live trial ROTATES (same budget, same expiry, new secret) rather than opening a second allowance. After it expires, signing again issues a new one.","oneTimeDisplay":true},{"type":"api-key","fields":{"api_key":"Plinth API key, sent as X-API-Key or Authorization: Bearer"},"ttl":"none","rotation":"Rotate at /account; rotating retires the previous key immediately.","oneTimeDisplay":true},{"type":"access-token","fields":{"access_token":"OAuth access token for the MCP endpoint","refresh_token":"refresh_token"},"ttl":"short-lived; refresh_token grant supported","rotation":"Refresh via the token endpoint; revoke by removing the connector.","oneTimeDisplay":false}],"scopes":{"model":"product-tiers","vocabularyUrl":"https://data.useplinth.com/pricing","notes":"Plan-gated rather than scoped. The free tier reads /grants/* (the grant graph) and /uk/* (England and Wales), plus keyless /api/v1/search; the organization endpoints (/compliance, /essentials, /premier), POST /api/v1/sql, the people/board and asset tables and the MCP connector require a paid plan. A request outside the plan answers 402 with a message naming the reason."},"economics":{"pricingUrl":"https://data.useplinth.com/pricing","freeTier":"50 REST calls a day on a free key across /grants/* and /uk/*, 3 plain-English questions a day, and unmetered GET /api/v1/search. The organization endpoints and SQL are paid. Paid plans raise the REST allowance to 10,000 a month.","rateLimitsUrl":"https://data.useplinth.com/developers#access"},"securityProfile":{"tier":"normal","oauthMetadataUrl":"https://data.useplinth.com/.well-known/oauth-authorization-server","senderConstraining":"none"},"gaps":["No programmatic ACCOUNT signup: an agent can mint a trial key by signing a request, but creating a Plinth account — and with it the ongoing free tier — still needs a browser sign-in.","The self-serve credential is deliberately small: 250 calls over 24h, rows capped at 25 per request, and 1 compliance screen with the evidence fields blanked. It is sized for evaluating the API, not for running on it.","No management API for the ongoing key — issue and rotation happen in the account dashboard only.","The REST API authenticates with a static key rather than OAuth; only the MCP endpoint is OAuth 2.1.","No sandbox environment. `?example=1` returns canned responses with no key, and the free tier runs against live data — but there is no separate test corpus with writable state."]}