Developers / API v1

A domain in.
A company draft out.

Register companies for your clients using the same website analysis as our submission form. Review the result, fill the gaps, and send it to our editors.

Partner workspace →

Invite-only pilot. API access requires an approved partner account. Listings enter editorial review and start Free when approved. Broker access does not grant company ownership, verification or premium features.

Download OpenAPI 3.1 specification · Company types, categories and countries

1. Create your key

Sign in, ask the directory team to enable your partner account, then create a key in Listing partners → API keys. Choose read and submit access for an import integration, or read-only for reporting. Keys expire after 90 days and can be revoked at any time. Store the key on your server, not in a browser app.

2. Start with the domain

curl https://cybersecuritycompanies.io/api/v1/partner/drafts \
  -H "Authorization: Bearer $CSC_PARTNER_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: company-import-0001" \
  -d '{"domain":"your-client.com"}'

The API saves a private draft before looking up the website. The response includes id, version, suggested fields, required gaps and enrichment status. Allow up to 30 seconds for the request. If it times out, repeat it with the same domain and Idempotency-Key; it returns the saved draft instead of creating another one.

Unknown information stays empty. Website and AI suggestions are unverified: check the result before submitting. If analysis is unavailable, complete the draft yourself or retry its lookup. Existing listings return 409 duplicate; the public listing URL is supplied when available.

3. Correct the draft

PATCH /api/v1/partner/drafts/{id}
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "version": 3,
  "fields": {
    "country": "GB",
    "oneLiner": "Managed detection and response for growing businesses.",
    "focuses": ["security-operations"],
    "specializations": ["mdr"],
    "products": [
      {"name": "Managed SOC", "oneLiner": "Round-the-clock monitoring and response."}
    ]
  }
}

Use the actual version from your latest response and category slugs from the taxonomy. Omitted fields stay unchanged; supplied arrays replace the entire array. A stale version returns 409 conflict. After an uncertain edit, GET the draft and reconcile it before retrying.

A complete submission needs a company name, a one-line description, company type, headquarters country and at least one security category. Products and source links are optional. Certifications must be supported by company evidence. The domain, listing plan, owner and publication status cannot be changed through profile fields.

4. Submit for review

POST /api/v1/partner/drafts/{id}/submit
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{"version": 4}

A 202 response confirms the submission is recorded for review. Poll the draft or check the partner dashboard. Editors approve it or return it with a reviewNote. Approved companies join the next successful directory refresh, usually within an hour when storage is healthy. A returned draft can be corrected and resubmitted.

Endpoints

Method	Path	Purpose
GET	`/account`	Your account, access scope and daily limits.
GET	`/drafts`	Your drafts, 25 per page. Pass the returned nextCursor as cursor.
POST	`/drafts`	Create a draft from a domain and run website analysis.
GET	`/drafts/{id}`	Saved fields, gaps, version and review outcome.
PATCH	`/drafts/{id}`	Save corrections to an editable draft.
POST	`/drafts/{id}/analyze`	Retry a website lookup with an empty JSON object.
POST	`/drafts/{id}/submit`	Submit a complete draft for review.

All paths above are relative to https://cybersecuritycompanies.io/api/v1/partner. Successful JSON responses contain data and a diagnostic requestId. Errors contain error.code, error.message, optional error.details, and requestId.

Limits and reliable imports

Default pilot allowance: 500 API requests, 20 new drafts and 20 website lookups per account per UTC day. GET and failed authenticated attempts count toward requests.
One company per create request. Process a small batch sequentially, with a stable idempotency key for each company. There is no bulk-array endpoint.
Requests are capped at 64 KiB. A draft supports up to 12 products and 20 supporting sources.
Successful responses report request limits through X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (Unix seconds).
429 means the account or shared platform allowance is unavailable or exhausted. Obey Retry-After. Limits reset at midnight UTC.
503 means storage could not confirm the operation. Retry after the stated delay using the same create key; check the current draft before repeating an edit. Never count a failed request as an accepted submission.
Interrupted analysis can be retried after 60 seconds. Retries fill only empty fields and preserve saved corrections.

The pilot runs with shared capacity limits and has no uninterrupted-availability guarantee. Draft edits do not rebuild the public directory. Company claims, payments and billing remain separate workflows.