Developers
Query the Decision Insights Registry from your own code: vendors, open source projects, technology terms, and dated signals about them, each attributed and linked to its primary source.
Base URL
https://api.decisioninsights.ai/api/public/v1
Authentication
Most of this API needs no credential. The read endpoints below answer an anonymous caller, counted rather than gated, at the lowest allowance.
Three states, and they are different. No Authorization header: served at the anonymous tier, which is supported rather than a failure. A header we cannot recognise: 401 invalid_token, naming both what arrived and what we accept. A token we could not check because our own identity service was unreachable: served at the anonymous tier, so the request succeeds at a lower allowance rather than failing.
There is no API key to request. A credential here is an OAuth access token, sent in an Authorization header with the value Bearer YOUR_TOKEN. An x-api-key header carrying the token on its own is also accepted, for clients that send that instead. Signing in raises your allowance, and it is the only way to reach the endpoints that act on your own account.
Signing in over OAuth
Tokens are issued by https://my.decisioninsights.ai, which publishes its own metadata so a client can configure itself rather than being configured: https://my.decisioninsights.ai/.well-known/oauth-authorization-server. This site publishes the matching resource metadata at https://decisioninsights.ai/.well-known/oauth-protected-resource, which names this issuer so a client can find the sign-in without being told where it is.
The MCP endpoint is a separate resource with its own metadata at https://mcp.decisioninsights.ai/.well-known/oauth-protected-resource, and it names the same issuer. Follow the authorization_servers in the document for the resource you are actually calling: those documents are authoritative, and one credential works across both surfaces.
https://api.decisioninsights.ai/.well-known/api-catalog redirects to the catalog on decisioninsights.ai, which is the canonical instance (RFC 9727).
Registering a client
You do not have to ask us for one. POST https://my.decisioninsights.ai/oauth2/register is dynamic client registration (RFC 7591). It takes no credential and it is rate limited. Send client_name, redirect_uris, and token_endpoint_auth_method. A command line tool or a desktop app should send none and keep no secret: PKCE is the proof instead, and only S256 is accepted.
Redirect URIs are matched exactly, so register every one you might use, each loopback port included. A port you did not register is not the same URI.
Which grant you get, and what each is for
authorization_code is what a self-registered client is, every time. A person signs in once in a browser, the token comes back to your redirect URI, and it renews itself afterwards with refresh_token. That is the grant behind di login and behind an assistant's sign-in prompt. The scope is profile, which is what the resource metadata asks for and what reading the graph needs.
client_credentials is advertised in the metadata and you cannot self-register into it. It is for a first-party service acting on a whole account rather than for a person, so those clients are created by hand and their scopes are granted deliberately. A registration that asks for it is still created as an authorization code client, so read the grant_types in the registration response rather than assuming you got what you asked for. If you need one, talk to us.
The authorization server serves other products, and its metadata lists their scopes alongside profile. A self-registered client cannot hold them.
Endpoints
These answer an anonymous caller. Each takes a required query parameter, and a request without it returns a 400 naming the one that is missing.
| Resource | Search | One record |
|---|---|---|
| Companies | GET /companies?domain=example.com | GET /companies/{uuid} |
| Open source projects | GET /projects?q= | GET /projects/{uuid} |
| Content | GET /content?q= | GET /content/{uuid} |
| Terms | GET /glossary?q= | GET /glossary/{uuid} |
| Everything at once | GET /search?q= |
/companies is a lookup by the company's own domain rather than a listing. When you have a keyword instead of a domain, use /search.
What a record carries, beyond the obvious. A company record carries the open source projects it owns as projects, with projects_total and projects_truncated saying when the list is a subset. A content record carries the companies the article mentions as mentioned_companies, each with the @id its own record publishes, along with mentioned_companies_total, mentioned_companies_truncated, and mentions_extraction, which states that mentions come from automated name extraction and may include false positives. It also carries subject_company_id, project_refs and canonical_url. A project record carries its owning company as owner_organization_id, which is a dereferenceable identifier rather than a name.
The same endpoints are described as OpenAPI at https://decisioninsights.ai/openapi.json, so a client can generate itself rather than being written against this table.
Endpoints that act on your account
These need an access token and operate on your own account, so they are not part of the anonymous surface above.
| Watch lists | GET and POST /watch-lists |
| Watch list members | GET and POST /watch-lists/{id}/members, DELETE /watch-lists/{id}/members/{member_id} |
| Webhooks | POST /webhooks |
Watch lists let you follow a set of companies. Webhooks let you be notified rather than poll. If your account reaches more than one organization, add ?organizationUuid= to say which one you mean; a request that leaves it ambiguous returns a 403 listing the organizations you can choose from.
Rate limits
Limits apply per caller, per minute and per day, and rise when you sign in.
| Tier | Per minute | Per day | How you get it |
|---|---|---|---|
| Anonymous | 10 | 50 | No sign-in. The default. |
| Free | 30 | 1,000 | Signed in on a free plan. |
| Paid 1 | 60 | 10,000 | Signed in on a paid plan. |
| Paid 2 | 60 | 15,000 | Signed in on a higher paid plan. |
| Paid 3 | 60 | 40,000 | Signed in on the top paid plan. |
Those are the current values, not a guarantee. They are retuned without a deploy, so read what you actually got off the response: every reply carries X-DI-Tier with the tier you resolved to, X-RateLimit-Limit with the per minute ceiling that goes with it, and X-RateLimit-Remaining.
A request over the limit returns a 429 with a Retry-After header in seconds. Wait that long rather than retrying immediately.
MCP
The same data is available over MCP at https://mcp.decisioninsights.ai/api/mcp-public. If you are wiring up an assistant rather than writing code, start at For AI Agents, which carries the access points and the tool by tool description.
Command line
The CLI is published on npm as decision-insights-cli and installs a command named di. It needs Node 18 or newer.
npm i -g decision-insights-cli
Then run di. Every command is one MCP tool call against the endpoint above, so the CLI returns the same records the API and MCP return. It works with no account. Signing in with di login raises your rate limit to what your plan entitles.
Attribution
Every record carries the link to its primary source. If you surface a record, carry that link with it.
Getting an account
There is no key to issue. Signing in is what raises your allowance and what reaches the account endpoints above, and an account takes one step from a person.
Choose a plan on Pricing, including the free one. Use the work address at the domain your company publishes from: the domain is what attaches the account to your company, so free mailboxes are refused on this path. Then open the link we email you, which verifies the address and signs you in. A paid plan takes a card, in a browser, on that same account.