Shipping daily
Nov 1DATAAll 646 projects re-verified: 6,419 developer claims tested against registers, courts and pressNov 1DATAMalaysia TEDUH and Philippines DHSUD licence checks: expired licences and approved delays foundNov 1DATAThailand ONEP register: 2 condos found selling before environmental approvalNov 1DATAMexico PROFECO contract register checks: one sales registration belonged to a laundryNov 1DATAAbu Dhabi ADREC inspections and RAK RERA permit list added: % built straight from the regulatorNov 1SHIPPEDNew stage filter: completed but still sellingNov 1SHIPPEDPublic database page: verification levels, disclosure distribution, every marketNov 1DATA+212 projects in one day, round 3: USA, Caribbean, Gulf, Africa, Japan, AustraliaNov 1SHIPPEDStage on every case: off-plan or under constructionOct 31SHIPPEDVerification level per check on every case card: registry, independent, developer, contradicted
Changelog →

Kolaboro / Docs / API keys

API keys and usage

The open data API needs no key and stays that way. A key gives you a usage panel, a daily quota you can plan around, and a way for us to raise your limits. We show the key once and store only its SHA-256.

Checking whether self-serve keys are open…

Create a key

No account and no email needed. Three keys an hour per visitor.

Usage panel

The key is sent only in the x-api-key header to kolaboro.com and kept in this tab's memory, never in storage.

Plans and limits

PlanDaily quotaHowPrice
No keyFair use of /api/open/*Just call itFree
Free key1,000 metered calls a day (UTC)Self-serve on this pageFree
PartnerAgreed with youWrite to [email protected]Contact us

Billing is not decided. Today we only meter calls and enforce the quota: nothing is charged and there is no card to enter. If paid plans come, they will be announced on the changelog before anything changes for existing keys.

The pilot API (document reading, desk reviews, Bitcoin timestamps, shared cases) keeps its own kb_pilot_ keys and its 200 calls a day.

Using a key

Send it in the x-api-key header to the metered base URL https://kolaboro.com/api/x/k/m/. Every path of the open API works there and returns the identical, signed body; each answer also carries x-ratelimit-limit and x-ratelimit-remaining. Over quota you get 429 until midnight UTC.

curl -H "x-api-key: kb_live_…" https://kolaboro.com/api/x/k/m/projects?market=Bali // TypeScript (see /docs/sdk/) const k = new Kolaboro({ apiKey: process.env.KOLABORO_KEY }); # Python k = Kolaboro(api_key=os.environ['KOLABORO_KEY'])

How keys are kept

  • The key is 160 random bits from the server's cryptographic generator, written as kb_live_ plus 40 hex characters.
  • It is shown once. The database stores its SHA-256, the first 4 hex characters (so you can tell keys apart), your label, the country of the request and the creation time. No IP address.
  • Usage is counted per key, per UTC day and per endpoint path with ids removed (for example /api/open/projects/{id}). Nothing else about the calls is stored.
  • You can revoke a key yourself from the usage panel. Revoked keys stop working at once; the usage record stays.
  • Database writes go through functions that only our server can call, so nobody can create keys or spend your quota by calling the database directly.
Protect my purchase