API reference

Base URL https://opencontrols.ai. Every response is a registered, machine-readable usage-license object that validates against the OpenControls schema. The verdict reflects detected restrictions; it is not legal advice.

Authentication

URL-based API key — works from Claude / Cowork and any HTTP client. Pass it as the ?key= query parameter or the x-api-key header. Create and revoke keys at /dashboard. Each call meters against your plan.

POST /v1/analyze

Analyze a URL or domain. Body: { url, jurisdiction?, purpose? }.

curl -X POST "https://opencontrols.ai/v1/analyze?key=ocsk_xxx" \
  -H "content-type: application/json" \
  -d '{"url":"example.com","jurisdiction":"US","purpose":"commercial"}'

// JavaScript
await fetch("https://opencontrols.ai/v1/analyze?key=ocsk_xxx", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ url: "example.com" }),
}).then(r => r.json());

# Python
import requests
requests.post("https://opencontrols.ai/v1/analyze",
  params={"key": "ocsk_xxx"}, json={"url": "example.com"}).json()

GET /v1/licenses/{id}

Resolve a registered license and re-validate it against the schema. Public (no key).

GET /v1/domains

Your checked domains (latest per domain). Query params: q, category, verdict, sort (url | category | lastCheckedAt), dir, page, perPage. Returns { domains, total, page, perPage }.

The verdict object

verdict.summary	OPEN \| RESTRICTED \| MIXED \| UNKNOWN
verdict.confidence / needsReview	0–1; needsReview when below the 0.9 gate
rights	8 per-right tri-states: scrape, tdm, aiTrain, aiUse, derive, redistribute, transform, tag — each allowed \| restricted \| unknown, with confidence, basis, and conditions
signals	7 evidence signals: robots_txt, terms_of_service, copyright_license, technical_barriers, api_access, self_published_license, privacy_policy (also not_applicable)
detectedLicenses	machine-readable / inferred licenses found (e.g. CC BY 4.0)
assumptions	jurisdiction + purpose the verdict was made under
registration	recordUrl + verifyUrl + status — the registered, verifiable record
disclaimer	required — not legal advice

Prefer MCP? See the MCP docs.