Apparently API & Webhooks

Subscribe your systems to platform events — every payload is HMAC-signed so you can verify authenticity end to end.

Compliance API Reference

AI-powered classification, legality checks, and citation verification. View full interactive API docs →

Pricing

Endpoint	Cost	Description
`POST /api/v1/classify`	$0.10 / call	Classify promotion type + required jurisdictions
`POST /api/v1/legality-check`	$1.00 / state	Product legality assessment per jurisdiction
`POST /api/v1/citation/verify`	$0.25 / citation	Legal citation verification
`GET /api/v1/usage`	Free	API usage statistics for your key
`GET /api/v1/jurisdictions`	Free	Jurisdiction requirements database

Get your API key → Keys are prefixed with ak_ and shown once at creation.

Quick start — Classify a promotion

curl -X POST https://apparently.cc/api/v1/classify \
  -H "Authorization: Bearer ak_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Summer Sweepstakes 2026",
    "description": "Online sweepstakes where users earn virtual coins through purchases and can redeem prizes.",
    "prize_value_cents": 500000,
    "entry_method": "purchase"
  }'

Quick start — Legality check

curl -X POST https://apparently.cc/api/v1/legality-check \
  -H "Authorization: Bearer ak_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "product_name": "CoinFlip Casino",
    "product_description": "Social casino app with virtual currency slots and poker.",
    "jurisdictions": ["NJ", "PA", "MI"]
  }'

1. Subscribe

Create a webhook subscription in Settings → Webhooks. Pick the events you want and an HTTPS URL.

2. Event reference

Event	When it fires	Key fields
`application.submitted`	A licensing application is filed	`id, jurisdiction, license_type`
`application.approved`	Regulator approves the application	`id, approved_at`
`application.denied`	Regulator denies the application	`id, reason`
`opinion.delivered`	A legal opinion is delivered to the client	`opinion_id, summary`
`opinion.staleness_alert`	A delivered opinion is potentially stale	`opinion_id, severity, trigger`
`stakeholder.intake_completed`	A key person finishes the intake form	`stakeholder_id, full_name`
`filing.submitted`	A filing is submitted to a regulator	`filing_id, jurisdiction`
`deadline.upcoming`	A compliance deadline is within 7 days	`deadline_id, due_date`

3. Payload envelope

{
  "event": "application.submitted",
  "delivered_at": "2026-05-08T12:34:56.000Z",
  "attempt": 1,
  "subscription_id": "9a3f...",
  "data": {
    "id": "app_abc123",
    "jurisdiction": "NV",
    "license_type": "supplier",
    "submitted_by": "user_xyz"
  }
}

Required headers:

X-Apparently-Event — the event name
X-Apparently-Signature — sha256=<hex digest>
X-Apparently-Delivery-Id — unique per attempt

4. Verify the signature

Node.js

import crypto from 'node:crypto'

function verifyApparentlySignature(rawBody, header, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(header)
  )
}

Python

import hmac, hashlib

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header)

Ruby

require 'openssl'

def verify(raw_body, header, secret)
  expected = 'sha256=' + OpenSSL::HMAC.hexdigest('SHA256', secret, raw_body)
  Rack::Utils.secure_compare(expected, header)
end

5. Retries

If your endpoint returns non-2xx (or times out after 10s), we retry up to 4 times with backoff: 1m → 5m → 30m → 2h. After the last attempt the delivery is marked unrecoverable but stays visible in your deliveries log.

6. REST API

For direct read access to your data, generate an API key in Settings → API Keys. Each key is shown once at creation — store it in your secrets manager.

Authentication

Send your key as a bearer token in the Authorization header:

curl https://apparently.cc/api/v1/applications \
  -H "Authorization: Bearer aply_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

Available endpoints (read-only)

Method & Path	Returns	Required scope
`GET /api/v1/organization`	Your organization profile	`read:organization`
`GET /api/v1/applications`	List of licensing applications	`read:applications`
`GET /api/v1/applications/{id}`	A single application	`read:applications`
`GET /api/v1/filings`	List of filings (state & federal)	`read:filings`
`GET /api/v1/opinions`	List of delivered legal opinions	`read:opinions`
`GET /api/v1/opinions/{id}`	A single opinion	`read:opinions`
`GET /api/v1/stakeholders`	List of key persons in your org	`read:stakeholders`

Rate limits

Default: 300 requests per minute per key. Enterprise tiers have higher limits — see pricing.

Errors

Standard HTTP status codes. Auth failures return 401 with a JSON body. Scope failures return 403. Validation failures return 400.