API docs

Everything below is the same pipeline the web form uses — same consent gate, same non-targeting blocklist, same pricing. There is no partner bypass for the compliance rules. Keys are issued by us on request — leave your email and mention you want API access.

Authentication

Every request carries your key as a bearer token. Keys are shown once, at issuance or rotation, and stored by us only as a hash — if you lose one, rotate it, you cannot recover the original.

Authorization: Bearer rci_xxxxxxxxxxxxxxxxxxxxxxxx

Rate limits

Each key has its own per-minute limit, set when the key is issued. Exceeding it returns 429. There is no burst allowance — it is a rolling one-minute window.

Endpoints

POST/api/v1/cases

Opens a case. Scope required: cases:write. Body shape is identical to the web intake form's — the same server-side validation, consent gate, and blocklist check run either way.

{
  "tier": "footprint_scan",
  "subject": {
    "name": "...",
    "phone": "91...",
    "email": "...",
    "socialHandle": "..."
  },
  "requesterEmail": "you@yourplatform.com",
  "requesterPhone": "91...",
  "declaration": {
    "hasLegitimateInterest": true,
    "willNotMisuseReport": true,
    "subjectIsPublicOfficialOrLawEnforcement": false,
    "subjectIsMinor": false
  }
}

Returns 201 with { "caseId": "...", "quoteAmountPaise": 49900 }. A rejected declaration or blocklist match returns 400 with a reasonCode — the case is never created.

Payment is not part of this endpoint. A case created here still starts in pending_payment, same as the web flow — this MVP has no separate invoicing or prepaid-credit billing for API partners yet. Talk to us before integrating if you need cases to proceed without a per-case checkout step.

GET/api/v1/cases/{'{id}'}

Poll status. Scope required: cases:read. Only returns cases your own key created.

{
  "caseId": "...",
  "tier": "footprint_scan",
  "status": "processing",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "riskRating": null,
  "reportReady": false
}

GET/api/v1/cases/{'{id}'}/report

Once reportReadyis true, returns a signed download URL valid for 15 minutes, and the report's SHA-256 hash for integrity verification. Scope required: cases:read.

{
  "signedUrl": "https://...",
  "expiresInSeconds": 900,
  "sha256": "...",
  "riskRating": "low"
}

POST/api/v1/webhooks

Registers a callback so we push case.completed and case.rejected events instead of you polling. One active callback per key — registering a new URL disables the previous one.

// Request
{ "url": "https://your-service.example.com/rci-webhook" }

// Response (secret shown once)
{ "ok": true, "url": "...", "secret": "..." }

Deliveries carry an X-RCI-Signatureheader: HMAC-SHA256 of the raw request body, hex-encoded, using the secret above — the same scheme used to verify this project's own inbound Razorpay webhooks. There is no delivery retry queue yet; a missed delivery is still reflected correctly by GET /v1/cases/{id}.

{
  "event": "case.completed",
  "caseId": "...",
  "timestamp": "2026-01-01T00:00:00.000Z"
}

Errors

401 missing/invalid key · 403 key lacks the required scope · 429 rate limit exceeded · 404 case not found or not yours · 400 validation or consent-gate failure, with details in the body.