Trust & Data API

Getting the scope

trust:read is not self-serve. It is granted at key-validation time only to developer keys whose partner holds an active consumer or trust data link, so the scope tracks a real commercial relationship rather than a checkbox. A key without it gets 403 missing_scope like any other scope on the platform. Nothing about this endpoint is hidden, it is simply gated.

Endpoints

curl -X POST "https://api.bolrach.com/v1/trust/check-url" \
  -H "Authorization: Bearer bk_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

{
  "url": "https://example.com"
}

Latency and timeouts

The engine performs a live fetch, so allow several seconds and set a client timeout of at least 30 seconds. If the engine does not answer within its own window the platform returns 502 trust_unavailable: that is the engine being slow or unreachable, not a verdict about the URL. Retry shortly; do not treat it as a pass or a fail.

Limits and errors

Plan rate limits are shared across the platform (plans table) and every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Errors use the platform envelope: bad_url (400), missing_key / invalid_key (401), missing_scope (403), rate_limited (429), trust_unavailable (502).

Changelog