One JSON API over the register
and your own account.

Your first request

No key, no account, no sign-up. This works right now from your terminal.

curl https://subprocessor.org/v1/register/atlassian.com

{
  "company": "atlassian.com",
  "verified_at": "2026-08-17T06:12:04Z",
  "entity_hash": "427b2945ef",
  "shape": "table",
  "count": 29,
  "history_from": "2019-02-10",
  "entities": [ … ]
}

Every response carries entity_hash. If it has not changed, the list has not changed — regardless of how much of the vendor’s page was rewritten.

Authentication

A bearer token on every request that touches your account. Keys are created in Settings → API, scoped to a workspace, and shown once.

curl https://subprocessor.org/v1/me/pending \
  -H "Authorization: Bearer sk_live_9f2c…"

A live key can email your customers. Notices only go out after an explicit approval call, but treat the key accordingly — scope it, rotate it, and use sk_test_ while you are building.

Versioning

Every path sits under /v1. Additive changes — new fields, new endpoints, new enum values — ship without a version bump, so parse defensively and ignore what you do not recognise. Anything breaking gets /v2 and twelve months of overlap.

Pagination

Only /v1/register/companies pages today. Pass limit from 1 to 200 (default 50) and, for the next page, the next_cursor you were given, as the cursor parameter. The cursor is an opaque string: store it and send it back, do not build one. Filter by domain with q.

curl "https://subprocessor.org/v1/register/companies?limit=50&cursor=41"

{
  "object": "list",
  "data": [ … ],
  "has_more": true,
  "next_cursor": "91"          // null on the last page
}

/v1/changes takes limit and returns the most recent movements with has_more, but has no cursor yet, so you cannot page past the first limit. /v1/entities returns the 500 most-named entities and does not page.

Conditional reads

Poll as often as you like. Send the ETag back and an unchanged resource answers 304 with no body — and 304s do not count against your rate limit. Polling a list that has not moved is effectively free.

curl -i https://subprocessor.org/v1/register/atlassian.com \
  -H 'If-None-Match: "427b2945ef"'

HTTP/2 304
etag: "427b2945ef"
x-ratelimit-remaining: 587  // unchanged

Idempotency

Every POST accepts Idempotency-Key, held for 24 hours. A retry after a timeout returns the original result rather than acting twice — which matters most on approvals, since approving twice could mean emailing your customers twice.

curl -X POST …/v1/me/pending/ch_8e12/decision \
  -H "Idempotency-Key: 6f2c1a90-…" \
  -d '{"decision":"approve"}'

Rate limits

Returned on every response rather than discovered by being cut off, and enforced — a 429 carries Retry-After in seconds.

Headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. A 429 includes Retry-After in seconds.

Errors

Consistent shape, with a request_id to quote at us if something looks wrong.

{
  "error": {
    "type": "invalid_domain",
    "message": "northwind..io is not a resolvable domain",
    "doc_url": "https://subprocessor.org/docs#errors",
    "request_id": "req_01J9X2K7Q…"
  }
}

The register

Public. No key required, and no plans to change that.

Your business

Requires a key. Maintained plan.

Watching vendors

Requires a key. Maintained plan.

Evidence and the ledger

Packs need a key. Ledger verification is public, deliberately.

Anyone can verify a record without an account — your auditor, or a customer of yours checking a notice you sent. That is the point of publishing the chain.

Maintained and observed

Every register response carries source, and it changes what the record means.

• maintained — assembled by discovery, confirmed by a named reviewer, and approved by the business before publication. reviewed is true.
• observed — a dated copy of what the company publishes on its own site. Nobody reviewed it and the business did not approve it. reviewed is false.

Do not treat them alike. An observed record is evidence of what was published on a date, and nothing more — it is not a claim that the list is complete or correct.

Not built yet

Listed because a documented endpoint that does not answer is worse than an absent one, and this page is the contract.

• POST /v1/watchlist and DELETE — add and remove vendors in the UI for now.
• POST /v1/evidence/packs — generate packs in the UI; the files are downloadable there.
• POST /v1/discovery, /v1/me/subscribers, /v1/me/entities.
• Agency workspace endpoints — the tier itself is not built.
• Outbound webhooks. For now, poll /v1/me/pending with the ETag, which costs you nothing when it has not changed, or follow a business through its Atom feed.
• SDKs, the sandbox, the OpenAPI spec and the CI action.

If one of these is what you need, say so and it moves up the list. They are absent because nothing was built on top of them yet, not because they are hard.