Quick Start

Production API access

To get started with Atlas API, you need an Atlas workspace account and a scoped API key. Workspace owners and admins can create keys from API Documentation.

Atlas Professional and Team include the product workspace, configured integrations, developer documentation and an authenticated synthetic no-write sandbox. Production API keys, production MCP and outbound webhooks require Core, Scale or an Enterprise agreement.

Both tiers include scoped REST keys, regulatory MCP query tools, the bounded metered exact-source refresh action, and customer-configured signed webhooks. Production credentials require the package capability and an active allowance. Enterprise can contract a larger allowance, rollout support or service terms. None of these packages authorizes native Slack delivery.

If you are not an owner or admin, ask a workspace owner to issue the key or contact Pimlico Solutions to enable API Access.

Start with a sandbox key. Move to production only after endpoint, authorization, payload shape, and destination proof are clear.

What a read unit means

A read unit is a predictable weight reserved for one authorized API or MCP operation. It is not one returned record and it is not a separate charge for every item in a page. Each additional page is a new request with the same displayed weight. Reuse the same request id only when retrying that exact logical operation.

If the whole Core monthly allowance were used for only one operation type, it would cover approximately:

Most customers use a mix. Metadata, sandbox validation and connector configuration consume zero read units. X-Atlas-* response headers include the request, operation weight, used allowance and remaining allowance so usage can be reconciled without guessing.

What the API supports

Atlas API currently supports the following operations:

• Published regulation list and detail retrieval
• Exact-source freshness evidence and verified-age gates
• Tenant-bound asynchronous exact-source refresh jobs and receipts
• Coverage and taxonomy discovery
• Durable regulation versions and field-level changes
• Monitor digest retrieval
• Durable, cursor-paginated monitor event retrieval
• Read-only watchlist and project context
• Client coverage management
• Signed outbound webhook registration
• MCP query tools and bounded exact-source refresh
• Official TypeScript and Python SDK source packages

How to build it into your stack

Native Slack is not another API response format. Use the separately authorised Slack connector when Atlas should own channel delivery; use a signed webhook when the customer's service should own the downstream action.

Query the regulatory question

Atlas exposes regulatory facts as composable dimensions rather than forcing customers to know our internal tables. Filters combine with AND semantics. Every returned record carries stable identity, source provenance and normalized Atlas Data dimensions; it never infers customer applicability or authorizes a delivery action.

Query contract version: 2026-09-05.regulations-query.v2. Pin this value in production clients and review the machine-readable contract before adopting a later version.

Source freshness evidence

Current regulation, monitor-digest and monitor-event reads return a versioned freshness envelope. It identifies the exact source registry row and newest append-only ordinary source-scan receipt when one exists. Atlas keepssource_checked_at separate fromupdated_at andcustomer_published_at; changing or publishing an Atlas row is not represented as checking the official source. A fresh receipt proves a successful exact-source check inside the selected age window; it does not claim that a model re-adjudicated every published field on that API request.

Atlas serves published records from its database and separately refreshes their sources, retaining a history of each check. Reads never launch a source fetch or AI verification call. When the caller chooses to refresh stale evidence, create an explicit job withPOST /freshness/refresh-jobs and anIdempotency-Key, then poll/freshness/refresh-jobs/{job_id}. The job is tenant-bound, scans only the exact active sources that need it, and returns source, bounded retry, queue-trace and immutable receipt evidence. Creation costs 25 units, polling costs 1, and the controlled contract caps an organization at 25 jobs per UTC day. Source cadences vary; the 26-hour default is a verification boundary, not a universal scan SLA. Freshness or relevance never authorizes Slack, webhook or another send.

Interactive query explorer

Build the regulatory question in the browser, copy an official SDK example, and use live taxonomy values when you have a scoped key. Keys entered here remain in component memory only and are not stored by the documentation page.

curl "https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/partner-api/regulations?jurisdiction=EU&vertical=AI&freshness_mode=standard&freshness_max_age_seconds=93600&limit=25" \
  -H "Authorization: Bearer $ATLAS_API_KEY"

Endpoint

All API routes are served from the Atlas functions host.

Authorization

Send your scoped key as a bearer token. External callers must never use service-role credentials.

Authorization: Bearer pk_...

Making your first request

Start with a key carrying the sandbox scope. This request returns synthetic data, consumes zero read units and does not send anything. For live cited updates, use a production key carrying the REST API scope with GET /monitor-digest; production also requires API Access and an active allowance.

curl "https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/partner-api/sandbox" \
  -H "Authorization: Bearer pk_..."

API Reference

Use OpenAPI or Postman for the full contract. The table below keeps the first integration path short.

SDK release candidates

The checked-in TypeScript and Python clients wrap the same OpenAPI contract. Both expose regulatory queries, coverage, taxonomy, version history, monitor reads and Atlas request/read-unit receipts. They apply bounded timeouts and retry only idempotent GET requests. Their distributable artifacts are verified, but the registry packages are not yet published.

Install commands will appear only after signed registry readback is recorded in the API changelog. Until then, use the OpenAPI-generated contract or the checked-in SDK source provided during assisted onboarding.

MCP

Atlas MCP query tools are read-only. The separately named request_regulatory_refresh tool may enqueue one bounded, stale-only, idempotent exact-source verification job for 1–10 published regulations; creating the job costs 25 read units and polling its receipt costs 1. A separate safety quota allows no more than 25 refresh jobs per organization per UTC day. MCP does not create Jira issues, Confluence or Notion pages, Asana tasks, Slack or Microsoft Teams messages, Google files, or Archer records.

Configure an authenticated remote HTTP MCP server at https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/mcp-regulatory. OAuth authorization code plus PKCE is the primary interactive-client path. Approved server-to-server or CLI clients can use a production key with the mcp scope as a fallback. Start by calling initialize, tools/list, then a citation-backed read such as get_monitor_events.

Atlas binds OAuth access tokens to the exact MCP resource and a live Atlas user, client, and session. Choose an active workspace during consent; a single workspace is preselected. The connection keeps that workspace when tokens refresh. Removing or suspending the membership ends access without switching to another workspace. Tokens also require the email claim, MCP and API entitlements, and an active API allowance.

Use search_regulations for relevance-ranked natural-language discovery. Use query_regulations when the agent needs the same deterministic jurisdiction, authority, lifecycle, materiality, source and date dimensions exposed by GET /regulations. Both tools are published-only reads and neither can authorize delivery.

Use get_regulatory_coverage and get_regulatory_taxonomy before forming exact queries. Use get_regulation_versions or get_regulation_changes when an agent needs an auditable timeline rather than only the current row.

Before wiring a client, inspect https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/partner-api/query-capabilities for the versioned filter and response-dimension contract, then use https://xldyvilhtvxmfgtyjusb.supabase.co/functions/v1/partner-api/openapi.json for the complete transport schema.

Outbound events

Outbound events use signed JSON envelopes and stable Atlas event ids. Use them when a customer-owned receiver should decide what to do next. Registering a webhook does not authorize Slack: the endpoint, subscribed event type, route policy, signature check, retry state and delivery receipt are separate controls.

Error handling

Protected routes fail closed without a valid scoped key, package entitlement and active allowance. Send a stable Idempotency-Key (or X-Request-Id) when retrying. Atlas returns the canonical request id and read-unit receipt in X-Atlas-* response headers.

Rate limits

Core defaults to 60 requests per minute with 15 immediately available burst tokens; Scale defaults to 120 per minute with 30 burst tokens. Contracted organization overrides can differ. Follow pagination.next_cursor until has_more is false and treat RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and X-Atlas-Rate-Limit-Policy as the authoritative receipt.

Only API_RATE_LIMITED includes Retry-After. Read-unit exhaustion or a capped-overage decision is not transient and must not be retried as a rate limit. The official SDKs keep one X-Request-Id across bounded GET retries and never retry earlier than the server instructs.