Three ways to build on your AI visibility data

Brand management (create, list, retrieve, update, delete), AI visibility reports across the six major LLM platforms, citation & source tracking with the Rank Prompt Score, scheduled reports, outbound webhooks, plus the account endpoints (`/v1/me`, `/v1/me/quota`). You can also connect an MCP client. Brand audits, AI-optimized content generation, technical SEO audits, and outreach are on the public roadmap and ship under the same /v1 contract; subscribe to the changelog to track release dates. The eventual surface mirrors the dashboard 1:1.

Developer API access is included with every Starter and up dashboard plan, with a monthly request cap per tier: 10,000 on Starter, 25,000 on Pro, 50,000 on Agency, and 100,000 on Agency Plus. Credit-consuming /v1 endpoints (the ones that hit a paid LLM or third-party search backend) draw from your plan's own monthly credits, so you never pay twice. Want the API on its own, with no dashboard plan? Two standalone subscriptions cover that: API Starter ($99/mo, 50,000 request units, 500 bundled API credits) and API Pro ($299/mo, 200,000 request units, 2,000 bundled API credits). Every plan applies a 120 requests/minute per-key burst limit, and the per-endpoint cost map lives in the developer docs.

A per-key burst limit of 120 requests per rolling minute is applied to every API key, regardless of plan. On top of that, your plan grants a monthly request-unit quota. Every metered response includes `X-RP-Quota-Limit`, `X-RP-Quota-Used`, `X-RP-Quota-Remaining`, and `X-RP-Quota-Reset` so you can pace work without polling. Throttled calls return a 429 with `Retry-After`.

The `GET /v1/me` and `GET /v1/me/quota` endpoints cost 0 request units and never count against your quota, so you can validate keys, scopes, and request signing without burning budget. For full end-to-end tests, mint a separate key with limited scopes and exercise it against a test brand.

Yes. Optionally bind a key to a single brand at creation time (`allowed_brand_id`). The API will refuse any request whose target brand does not match, even if the calling key carries `write:all`. This lets agencies and platforms issue per-brand keys to clients without spinning up a new Rank Prompt workspace.

Yes. The Rank Prompt MCP server lets Claude Code, Cursor, Claude Desktop, or any MCP client read your reports, brands, and citations, and run reports on your behalf. You connect over OAuth in the browser, so there is no key to paste. See the MCP server page at rankprompt.com/mcp for the 30-second setup.

Every Starter and up dashboard plan includes Developer API access, so you can mint a key straight from the Developers page in your workspace. Want the API on its own, without a dashboard plan? Subscribe to a standalone API Starter or API Pro plan instead. Each key carries scoped permissions (e.g. `read:brands`, `write:brands`) and an optional brand restriction for white-label use. Keys are prefixed with `rp_live_`, are shown once at creation, and stored hashed in the database.

No. Developer API access is included with your Starter, Pro, Agency, or Agency Plus plan, with a monthly request cap that scales by tier (10,000 / 25,000 / 50,000 / 100,000 requests). Credit-consuming /v1 endpoints draw from the same monthly credits you already pay for, so there's nothing extra to buy. You'd only add a standalone API Starter or API Pro plan if you don't run a dashboard plan at all, or you want a larger dedicated request quota with its own bundled API credits.

Not yet. The API ships with an OpenAPI 3.1 spec, so you can generate idiomatic clients in any language using openapi-generator, oazapfts, hey-api, Stainless, Speakeasy, or Fern. The docs include curl, JavaScript (fetch), and Python (httpx) examples for every endpoint. First-party TypeScript and Python SDKs are on the roadmap.

The /v1 contract is additive. We only add fields and endpoints; we never silently remove or rename them. When a breaking change is unavoidable, we ship /v2 alongside /v1 with a long deprecation window, and we announce the sunset of any endpoint via the standard `Sunset` HTTP header well in advance.

Yes, webhooks are live. Register a per-brand endpoint with `POST /v1/brands/{brand_id}/webhooks` and subscribe to `report.completed`, `report.failed`, `schedule.run.completed`, and `schedule.run.failed`. Payloads are HMAC-signed, the signing secret rotates (the old secret stays valid for 24 hours), and an endpoint auto-disables after repeated failures. You no longer need to poll report status from a worker.

Bearer-token authentication over TLS, scoped per-resource. Browser CORS calls are blocked at the edge: the API is server-to-server only. Keys are stored hashed and we submit the `rp_live_` prefix to GitHub secret scanning so leaked keys are caught automatically. The API runs on the same hardened infrastructure as the rest of the Rank Prompt platform, with EU/US data residency options.