Dataset API

The corpus, as a feed

AIVIB is our vendor data-handling dataset: what each AI vendor does with the data you put in, per plan and per surface, with the verbatim sentence we relied on and the date we last checked it. This is that dataset over HTTP — for GRC platforms, TPRM tools, MSSPs, and insurers who would rather sync it than staff it.

Why there is a key on public data

The vendor profiles are already published on our public explorer. Gating them would hide nothing, and we are not going to pretend otherwise. The key exists so you get a stable contract, advance notice before we break a schema, and so we know who is building on the data and can tell you when something you depend on moves. The change-event feed is the licensed part — that is the stream you cannot reconstruct by scraping a page today, because it only exists if someone was watching yesterday.

Get a trial key

no key

POST /dataset/trial

Self-serve, no call, no card. The key is returned once and stored only as a hash — we cannot recover it for you. Valid 30 days, 500 requests a day.

curl -X POST https://api.veraxai.xyz/dataset/trial \
  -H "content-type: application/json" \
  -d '{"email": "you@company.com", "organisation": "Your Co"}'

# {"key": "vxd_…", "tier": "trial", "daily_quota": 500,
#  "expires_at": "…", "schema_version": 2}

Vendor profiles

trial +

GET /dataset/vendors

The full profile for each vendor: training posture, retention, data region, certifications, sub-processors, the per-plan matrix, every source URL — and our own completeness score for that record. Page with limit/offset; pass since to re-pull only what we have re-verified.

curl "https://api.veraxai.xyz/dataset/vendors?limit=50&since=2026-06-01" \
  -H "X-API-Key: $VERAX_DATASET_KEY"

# {"schema_version": 2, "total": 100, "count": 50, "offset": 0,
#  "vendors": [{"name": "…", "trains_on_input": "consumer_tier",
#               "effective_trains_on_input": "consumer_tier",
#               "plans": [...], "sources": [...], "source_count": 3,
#               "completeness": 0.85}]}

Change-event feed

licensed

GET /dataset/changes

Every published change: which vendor, which fields moved, whether risk went up or down, a human summary, and the verbatim quote plus URL it came from. Incremental by event id — resume from next_since_id and you cannot skip an event the way a timestamp cursor can when two land in the same second.

curl "https://api.veraxai.xyz/dataset/changes?since_id=1482" \
  -H "X-API-Key: $VERAX_DATASET_KEY"

# {"schema_version": 2, "count": 3, "since_id": 1482,
#  "next_since_id": 1485,
#  "changes": [{"id": 1483, "vendor_name": "…",
#               "change_class": "material", "direction": "risk_up",
#               "affected_fields": ["retention"],
#               "human_summary": "…",
#               "citation_url": "…", "citation_quote": "…"}]}

Key status

trial +

GET /dataset/me

Tier, remaining quota today, total calls, expiry. Useful in a health check so a sync job fails loudly on an expired key instead of silently going stale.

curl https://api.veraxai.xyz/dataset/me -H "X-API-Key: $VERAX_DATASET_KEY"

# {"tier": "trial", "daily_quota": 500, "remaining_today": 497,
#  "total_calls": 3, "expires_at": "…", "schema_version": 2}

Versioning

Every response carries schema_version. Additive fields ship without a bump — pin to the version, not to the field list, and ignore keys you do not recognise. A breaking change bumps the number and we email every active key at least 30 days first.

Limits

Trial keys allow 500 requests a day, resetting at 00:00 UTC, and expire after 30 days. Licensed keys are unmetered. Pages cap at 200 records. Over quota returns 429; the licensed feed on a trial key returns 402.

Licensing

The change feed, redistribution rights, and an SLA are part of the data licence — from €30,000/year, priced on volume and whether you resurface the data to your own customers. Tell us what you are building and we will send terms. See pricing for the product tiers, and methodology for how a claim gets into the dataset in the first place.

Talk about a licence

Feeding your own logs in instead? That is the integrations API — a different key, scoped to your private workspace.