Authentication

Every request is authenticated with an API key in the Authorization header:

curl -s "$BASE_URL/v1/sanctions/full" \
  -H "Authorization: Bearer YOUR_API_KEY"

Key environments

Keys are prefixed by environment:

lk_live_…: live environment, real data
lk_test_…: sandbox environment, synthetic data only

Dataset scopes

Each key carries one or more dataset scopes, such as sanctions and pep. A request to a dataset endpoint without that dataset in scope returns 403 Forbidden with error.code = "scope_missing", as does ?regen=true from a key without the admin scope.

The sanctions scope has no per-source restriction. It grants every record in the dataset, including records from sources added after your integration shipped.

Per-country PEP licensing

The PEP dataset is licensed per coverage country. A record is served only when at least one of its source codes is in your key’s grants. Source are granted in groups rather than individual countries: a group such as Nordics or Europe expands to its member countries’ codes automatically. Using the whoami endpoint shows the expanded per-country grants.

The source filtering applies on every path: full snapshots, combined streams, and single-entity lookup. On the lookup path, a record outside your grants returns 404 Not Found, not 403, so existence never leaks.

See Source codes for the codes a record can carry and what a coverage country means.

Authentication errors

A request with no Authorization header returns 401 with error.code = "auth_missing". A request with an invalid, expired, or revoked key returns 401 with auth_invalid. See Errors for the full list of codes.