Developer surfaces

Authenticate with X-API-Key: ta_live_…. Issue and revoke keys in your dashboard: https://trustatlas.pages.dev/dashboard/api-keys.

GET https://trustatlas-api.jeffrolson1.workers.dev/api/v1/vendors

GET https://trustatlas-api.jeffrolson1.workers.dev/api/v1/vendors/{slug}

GET https://trustatlas-api.jeffrolson1.workers.dev/api/v1/vendors/{slug}/full — pro tier

GET https://trustatlas-api.jeffrolson1.workers.dev/api/v1/search?q=… — pro tier

OpenAPI 3.1 spec: https://trustatlas-api.jeffrolson1.workers.dev/api/v1/openapi.json

Quick start

curl -H "X-API-Key: ta_live_…" https://trustatlas-api.jeffrolson1.workers.dev/api/v1/vendors?limit=5

Tier limits

Error responses

• 401 invalid_api_key — missing or unknown X-API-Key
• 403 tier_required — endpoint needs a higher tier than the key
• 429 rate_limited — daily budget reached. Includes Retry-After, X-RateLimit-Reset, and a JSON body with { limit, reset_at, retry_after_seconds }.

Get an API key

GET https://trustatlas-api.jeffrolson1.workers.dev/api/vendors/by-domain?domain={hostname}

Returns the vendor record matching a given hostname. Strips www. and protocol. 1-hour edge cache. Used by the Chrome extension and bookmarklets.

curl https://trustatlas-api.jeffrolson1.workers.dev/api/vendors/by-domain?domain=openai.com

GET https://trustatlas-api.jeffrolson1.workers.dev/api/badge/{slug}.svg

Compact SVG risk badge for any vendor. Tier-colored. Best for README files, footers, and email signatures. Add ?variant=large for a bigger version.

<img src="https://trustatlas-api.jeffrolson1.workers.dev/api/badge/openai.svg" alt="TrustAtlas risk score for OpenAI" />

GET https://trustatlas-api.jeffrolson1.workers.dev/api/og/vendor/{slug}.svg

1200×630 SVG social-share image for a vendor profile. Renders well on Facebook, LinkedIn, Slack, Discord; Twitter falls back to summary card. Already wired into VendorDetail's Meta component.

GET https://trustatlas.pages.dev/embed/vendor/{slug}

Compact 380×120 interactive card. X-Frame-Options: ALLOWALL so embedding works on any origin. Updates as scores change.

GET https://trustatlas.pages.dev/embed/compare/{slug-a-vs-slug-b}

Side-by-side variant for curated vendor pairs only.

<iframe src="https://trustatlas.pages.dev/embed/vendor/openai" width="380" height="120" frameborder="0" loading="lazy"></iframe>

• https://trustatlas.pages.dev/feed/news.xml — vendor-tagged news items from the monitor
• https://trustatlas.pages.dev/feed/score-changes.xml — composite-score moves >5pt
• https://trustatlas.pages.dev/feed/new-vendors.xml — newly cataloged vendors
• https://trustatlas.pages.dev/feed/incidents.xml — recently logged incidents

All four are valid RSS 2.0 with atom:self links and 30-minute edge cache. Drop them in any reader.

• https://trustatlas.pages.dev/sitemap.xml — full sitemap with all vendor profiles, comparisons, glossary, and reports
• https://trustatlas.pages.dev/robots.txt — robots policy with feed advertisements

GET https://trustatlas-api.jeffrolson1.workers.dev/api/vendors

Paginated vendor list. Supports filters: taxonomy_type, hq_country, risk_tier, verified, page, limit (max 100), sort, order.

GET https://trustatlas-api.jeffrolson1.workers.dev/api/vendors/{slug}

Single vendor detail. Returns the core profile; sub-tables (data handling, security, jurisdiction, governance) are at /{slug}/data-handling, /security, etc.

GET https://trustatlas-api.jeffrolson1.workers.dev/api/stats

Aggregate catalog stats — total, by taxonomy, by tier, by country.