The Capbase API

Getting a key

API access is granted by Capbase admins: ask at support@capbase.fyi and say what you plan to add. Once your account is a contributor, create keys on your API keys page. A key belongs to you — everything it submits is attributed to your account — and you can hold up to 5 at once. Its secret is shown once, when you create it; Capbase stores only a hash. Keys start with cbk_, so a leaked one is easy to search for. Revoke it on the same page.

Authentication

Send the key as a bearer token on every request:

curl https://capbase.fyi/v1/me \
  -H "Authorization: Bearer cbk_…"

GET /v1/me answers with the key's owner, its scope and how many of your submissions are waiting for review. A key works only on /v1; the website's own routes don't accept it.

Scopes

A key's scope is a ceiling on your account's role. If an admin changes your role, keys the new role doesn't allow stop working at once.

No key can delete, merge, ban or change roles. Those stay on the website.

Rate limits

Limits are per key, per minute. Every address also has its own limit at the edge, so one busy script doesn't slow anyone else's.

Over a limit you get 429 with a Retry-After header (seconds). Wait that long, then carry on; there is no penalty beyond the wait.

IP allowlist

When you create a key you can list up to 10 addresses or CIDR ranges (203.0.113.7, 198.51.100.0/24, IPv6 too). A request from anywhere else gets 403, even with the right secret. Leave the list empty to allow any address. For a key that runs on a server, an allowlist turns a leak into a non-event.

Writing data

Writes take the same JSON as the website's forms; the reference shows every field. Three rules apply to all of them:

• "attested": true is required — your confirmation that you have the right to share the data (Terms §4). Without it the request is a 400.
• Send sourceUrl whenever you can: the filing, press release or page the fact comes from. It becomes the citation readers see, and moderators check it first.
• Check before creating. GET /v1/companies?domain=example.commatches a company's website host exactly (a scheme, www. or path is ignored), so you can skip companies that already exist and add to them instead.

curl -X POST https://capbase.fyi/v1/companies/helia/rounds \
  -H "Authorization: Bearer cbk_…" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Series B",
    "date": "2025-06-01",
    "amountUsd": 40000000,
    "investors": [{ "name": "Example Ventures", "lead": true }],
    "sourceUrl": "https://example.com/press/series-b",
    "attested": true
  }'

With a contributor key the response says "moderationStatus": "PENDING": the row is in the moderation queue and appears publicly once approved, and you get the usual email when it is decided. You can have up to 500 submissions waiting at once; past that, writes answer 429 until some are reviewed. With an admin key the response says APPROVED and the row is live.

Edits to an investor firm (POST /v1/investors/:slug/proposals) send only the fields to change. A firm that comes from SEC Form ADV or Wikidata may have some fields re-set by the next import from that source.

Errors

Errors are JSON with a statusCode and a message (a list, for validation errors, with one entry per problem).