Authentication & access

Base URL, schema, and authentication

https://api.filingsift.com/api/v1

Schema version 1.0.0 uses JSON envelopes with data and meta. Public endpoints need no key, although sending a credential can add account restrictions and usage metering. API-key-enabled routes use Authorization: Bearer fs_live_…; browser-session-only operations are marked separately in OpenAPI. Keep that key in a server-side secret manager, never browser code or source control. Production browser sessions use the Secure HttpOnly __Host-filingsift_session cookie, not a Bearer session token or a JavaScript-readable credential. The website sends credentials with its requests; cookie-authenticated mutations require the FilingSift Origin and X-FilingSift-CSRF: 1. Login responses contain session: true and tokenType: "Cookie", not a raw session token. Browser login sessions default to 12 hours; rememberMe: true opts into a seven-day session.

Signup verification receipts include a 30-minute handoffTicket. The originating browser can check POST /auth/signup/status and complete sign-in through POST /auth/signup/complete after email verification, using the ticket and original password. The ticket is not a session or email-verification token; MFA still applies. These are first-party browser flows, not API-key provisioning shortcuts. Internal /admin/* operations require platform-administrator authority and the documented scope; ordinary organization administrators cannot use them.

Use this documentation for people, or download the OpenAPI 3.1 specification for developer tools.

Access and availability

Compare browser, SDK, MCP, spreadsheet and delivery workflows. Each interface exposes its documented operations; connecting MCP or installing an SDK does not enable every REST endpoint or a gated source.

Public examples, status and BIS credit context can be explored without a key. Authenticated research checks your plan, scopes and selected issuers where applicable. Every plan includes all available indexed filing history for permitted companies; provider retrieval and new historical processing have separate bounds. Available records and sources are shown in the coverage information for each tool.

Create a scoped key in API keys. Examples below use FILINGSIFT_API_KEY from your server environment. Read the OpenAPI operation for its exact security and request contract. SDKs preserve the REST envelope; they do not bypass permissions or source admission.

Available: REST v1, published SDKs, source-backed email alerts including opt-in saved-screen and advanced disclosure notifications, read-only MCP at https://api.filingsift.com/mcp, and an authenticated GET /filings/stream SSE stream with stream:read and entitlement checks. MCP uses scoped API keys and existing plan quotas; the stream reports retained FilingSift records, not a direct SEC push feed.

Review security controls and enterprise requirements when evaluating your team’s deployment needs.