OpenData / Developers
OpenData for developers & agents
The machine-readable surface of OpenData, documented as it actually is today: a live MCP server any agent can query, an OpenAPI specification for the account and store-checker endpoints, an llms.txt summary, an MCP discovery manifest, and a Markdown variant of the homepage. Read on for exactly what exists and what does not.
Machine-readable resources
| Resource | URL | What it is |
|---|---|---|
| OpenAPI specification | /openapi.json | OpenAPI 3.1 description of every endpoint the site exposes, with typed parameters, response schemas and the structured error shape. |
| llms.txt | /llms.txt | A short Markdown summary of the product with the canonical link set, in the llms.txt format. |
| MCP manifest | /.well-known/mcp/manifest.json | Discovery manifest (JSON) naming OpenData and pointing at the OpenAPI specification and this page. |
| Markdown homepage | GET / with Accept: text/markdown | The homepage negotiates content: Markdown requests receive a Markdown rendering (with Vary: Accept); browsers keep receiving HTML. |
| Database browser API | GET /api/browse · POST /api/browse/export | Session-authenticated filtered browsing over the API dataset snapshot (814,516 stores, 4 Nov 2026): platform, country, tech, app, gateway, has_email, cursor pagination at 25 rows. Free accounts receive masked contacts; paid plans receive full records. Exports are capped (100 free / 1,000 paid rows) and logged. |
| Store checker | /checker/ | The on-site checker itself — look up any domain in the current snapshot (23,984,359 domains scanned, 1,504,744 verified stores, snapshot 15 Nov 2026) and unlock full records with an account. |
MCP server — live
OpenData runs a public Model Context Protocol server (Streamable HTTP, stateless). Any MCP client or agent can connect without a key and query the store index:
https://opendata-mcp.superblackhero8.workers.dev/mcp
| Tool | What it does |
|---|---|
count_stores | Count verified stores matching filters: platform, country, tech, app, gateway, has_email. |
search_stores | List matching stores (up to 25 per call) with platform, country, technologies, apps and payment gateways. |
get_store | Full public record for one domain. |
Public tier: domains and labels are shown in full; email addresses are reported as available or not — the addresses themselves are part of the paid data files and the RapidAPI plan. The MCP server answers from the 4 Nov 2026 dataset snapshot (814,516 stores); the on-site checker runs on the newer snapshot. Rate limit: 120 requests per minute per IP.
Client configuration example:
{
"mcpServers": {
"opendata": {
"url": "https://opendata-mcp.superblackhero8.workers.dev/mcp"
}
}
}Authentication model
Accounts are website accounts. You sign in with Google (OAuth 2.0 with PKCE) from any page on this site; the server then sets a single session cookie, od_session — 32 random bytes, HttpOnly, Secure, SameSite=Lax, 30-day lifetime, with only its SHA-256 hash stored server-side. That cookie is the only credential the API accepts, as declared in the OpenAPI sessionCookie security scheme.
There are no self-serve API keys and no OAuth scopes to request, because the API today serves the signed-in website experience only — it is not a separate developer platform. POST endpoints additionally require a same-origin Origin or Referer header.
Authentication & permissions
The website API authenticates with a signed session cookie: after you sign in with Google or email, the server sets the od_session cookie described above — the same credential declared as the sessionCookie security scheme in the OpenAPI specification. A request carrying a valid cookie acts as that account, under its plan and quota; a request without one receives the structured 401 JSON error. There is no bearer token or API-key header to send instead.
No public API keys are issued, and no OAuth tokens or scopes are granted to third parties yet. A scoped public API — where a third-party client would request named, least-privilege permissions — is demand-led and is not yet available; today the only permissions model is the signed-in account itself (free account, paid account, or site owner). If scoped access would unblock real work for you, tell us what you would build with it.
Rate limits
The one metered budget is the checker unlock quota: free accounts get 30 unlocks per calendar month (UTC); paid accounts are unlimited. Lookups that miss the snapshot are logged to history but never consume quota. Every /api/* response carries RateLimit-Policy and RateLimit headers describing that budget, and 429 responses include Retry-After. Your current usage is always visible via GET /api/me and on your account page. Errors from /api/* are structured JSON — {"error":{"code","message","hint"}} — never HTML error pages.
What is not here (yet)
The store database itself is delivered as CSV exports on the pricing plans — that is the launch interface. Programmatic access exists today in two forms: the public MCP server above (counts and masked records, no key) and the RapidAPI listing (full records under its plans). Scoped self-serve API keys for direct REST access are demand-led and not yet issued. If programmatic access would unblock real work for you, tell us what you would build with it.