For agents

Endpoints

Field notes

• tier (venture, indie, experiment): Tier is about funding, not size: Venture-backed = raised outside venture money (even at under $1M annualized); Indie = bootstrapped or founder-funded; Experiment = agent-run or research project.
• confidence: "reported" = press-reported, not company-confirmed (amber reported pill); "self-reported" = stated by the company itself (release, founder post), not independently verified (dashed self-reported pill).
• headline_verification (records, leaderboard, search and MCP briefs): how the ranked figure itself is verified, {method: "payment-processor", processor, via} when it comes from a payment-connected source (e.g. TrustMRR via Stripe), else null. Use verified_only=true on /api/v1/search.json or MCP search_businesses/leaderboard to keep only those.
• verified_corroboration: when the headline is self-reported or press-reported and a payment-verified point (e.g. a TrustMRR Stripe or Paddle snapshot) also exists, this object carries it (label, value_usd, annualized_usd, as_of, source_url, source_name, source_sync_stale_since, verification). Shown as a muted "Stripe-verified …" / "Paddle-verified …" line under the headline on the leaderboard and profile. Null otherwise.
• source_sync_stale_since (YYYY-MM-DD, on metrics and on each record's headline): the source page says its live data connection stopped (e.g. an expired Stripe key on TrustMRR). The value is the last synced figure; treat it as dated that day. Also listed in sources.json summary.source_sync_stale.
• ownership / independent: ownership appears only when a business was acquired ({status: "acquired", acquirer, as_of, source_url}); independent is then false. Tier still describes pre-sale funding, so a bootstrapped company sold for cash stays indie. Acquired rows show a purple acquired pill, are skipped in the newsletter indie corner and the home indie grid, and are left out of stats.json median_annualized_indie_independent.
• last_ownership_check (YYYY-MM-DD or null): date of the latest active ownership search recorded in data/ownership_checks.json (verdict independent / acquired / watch). Present only when we have searched; unchecked rows stay null — never invented. Profiles with a ledger entry show a muted "Ownership checked YYYY-MM-DD" line.
• ownership_watch: present only when the ownership ledger verdict is watch ({verdict, checked, note, source_url?}) — sale process or for-sale signal, no closed deal. Amber watch pill on profile + leaderboard; never invents acquisitions.
• agentic_origin (optional string): agent-native = product is agents / an agent platform from the start; agent-added = established product that later added agents or MCP (amber agent-added pill on profile + leaderboard); unclear or omitted when not confident. Leaderboard filter ?origin=native / ?origin=added. stats.json has agent_native_count and agent_added_count.
• revenue_disclosed (boolean): true iff the business has a rankable sourced annualized revenue figure (ARR / MRR×12 / Revenue with value_usd — same rule as leaderboard membership / annualized_revenue_usd). Funding or valuation alone is false. Leaderboard filter ?rev=disclosed / checkbox Revenue disclosed only; profiles and category cards show a muted no revenue figure pill when false. stats.json has revenue_disclosed_count and revenue_undisclosed_count.
• older_figure / age_days: on each record and on each leaderboard row, older_figure is true when the headline revenue metric is over 365 days old and not superseded; age_days is build date minus as_of (month precision = mid-month). Same rule as the gray revenue >12 mo old pill. Leaderboard filter ?age=fresh / checkbox Fresh revenue only keeps only rows with disclosed revenue dated within 365 days. Also on each metric and in leaderboard.csv.
• related (array, on each business record): up to 4 similar businesses scored by same category, shared tags, and nearby annualized scale. Each entry has compare_url for the side-by-side page. Profiles show the same list under "Similar on the ledger".

Free: leaderboard CSV + growth-series CSV (chartable points only). Pro (coming soon, join the waitlist): full all-metrics history CSV, denser history and alerts. Paid API keys (Hobby, Builder, Team) are issued by hand by email for now; see pricing.

API keys and rate limits

Keys are optional. No key means the Free plan: 100 requests per day per IP. Paid keys come with API Hobby, Builder and Team on pricing and are issued by email for now.

Send the key as X-API-Key: mrl_live_… or Authorization: Bearer mrl_live_…. The limit is counted on the function endpoints: /api/v1/search.json, /api/v1/compare.json, the export endpoints and /mcp (only tools/call counts). Static files under /api/v1/ stay free and are not metered.

Every metered response carries X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (Unix seconds, next UTC midnight) and X-RateLimit-Plan. Over the limit you get HTTP 429 with Retry-After. A wrong or revoked key gets 401. Counts are approximate.

Pay per call (no signup): x402

Agents can pay with x402 in USDC on Base Sepolia (testnet, test USDC only), with no account and no key. The free tier is unchanged: 100 requests/day per IP and every static /api/v1/*.json file stay free.

MCP: an unpaid call past the quota returns a tool result with isError: true and the PaymentRequired object in structuredContent; retry with params._meta["x402/payment"]. Clients: @x402/fetch (wrapFetchWithPayment) or any x402 v2 client. x402 v1 clients work too: the 402 body is a v1 PaymentRequired (network base-sepolia, maxAmountRequired); pay with X-PAYMENT, receipt in X-PAYMENT-RESPONSE.

Revenue-move alerts (webhooks)

Get a signed POST to your own HTTPS endpoint when a business you watch gets a new or revised revenue figure. It fires after each data refresh, once per change. Webhooks only, no email.

Create: POST /api/v1/watch with {"slugs": ["cursor", "lovable"] | "all", "webhook_url": "https://your.app/hooks/mrrledger"} (optional "kinds": metric_revised, metric_added, metric_removed, business_added, metric_redated). Send your Builder/Team key as X-API-Key, or send no key and pay the 402 with PAYMENT-SIGNATURE. MCP: tool watch_revenue. The answer has a watch_id and a secret. The secret is shown once.

Manage: GET or DELETE /api/v1/watch/{watch_id} with Authorization: Bearer <secret> (or the owning key).

Verify: each delivery has MRL-Signature: t=<unix>,v1=<hex>, where hex = HMAC-SHA256(secret, t + "." + raw body). Reject if the signature differs or t is more than 5 minutes old. Answer 2xx quickly. We retry failures with backoff (1 min to 6 h, 6 tries) and pause a watch after 8 failures in a row. Deliveries are at-least-once, so dedupe on the event id (also in MRL-Event-Id).

const h = crypto.createHmac("sha256", secret).update(t + "." + rawBody).digest("hex"); // compare with v1 using timingSafeEqual

Webhook URLs must be https on port 443 with a public DNS name: no IP addresses, no localhost, private, link-local, CGNAT or metadata ranges. We check again before every delivery and never follow redirects.