API reference

Free, no key. Open tenders across Australia; New Zealand rows only when you ask for them (jurisdiction=NZ). Federal, state, council, university and health. Grants ride the same search with kind=grant. Returns {total, results[], coverage}. The link to the original portal (link, url, listing_url, source_url) comes only with an API key or a signed-in session.

Read coverage. It names which sources were searched and which returned nothing, so an empty result means “no match in what we searched” — never “no such tender exists”. There is deliberately no location filter: it is populated on a small minority of rows against jurisdiction's every row, so filtering by it would silently hide most of the corpus.

curl "https://www.stipple.sh/v1/tenders?jurisdiction=AU-QLD&q=road&limit=2"

One result, as captured from the live API on 15 September 2026:

{
  "total": 15,
  "results": [
    {
      "title": "RFT260091 - Capella Rubyvale Road Upgrade CH 47.3 - 48.6",
      "buyer": "CENTRAL HIGHLANDS REGIONAL COUNCIL",
      "jurisdiction": "AU-QLD",
      "tier": "council",
      "closing_date": "2026-09-21",
      "source_tag": "VendorPanel",
      "link": "https://www.vendorpanel.com.au/PublicTenderAccess.aspx?id=...",
      "tender_key": "17d2cc3cca27d22ef5874d9be40ab210"
    }
  ],
  "coverage": {
    "sources_total": 23,
    "sources_empty": [ { "source": "sa", "status": "blocked", "why": "login wall: ..." }, ... ],
    "last_run": "2026-09-14T12:32:04+00:00"
  }
}

Free, no key. One tender by the page_key every search result carries (32 hex, or f + 32 hex for a tender that publishes no reference or buyer), in the same shape as a search result plus open — the search's own rule: no closing date, or a closing date of today or later in the buyer's time zone, taken from its state (Sydney for a tender labelled with the country alone). A closed tender still answers. An unknown key is a 404. An Australian tender's public page is /tenders/au/<slug>-<page_key>.

An API key or a signed-in session. The link to the tender's or grant's original portal: {url, portal_name, link_is_listing}. link_is_listing is true when the portal has no page per tender and the link opens the list it appeared on. 401 without a key or a session; 404 for an unknown key or a tender we hold no link for.

Free, no key. One read for everything around a tender: buyer (the buyer's nightly summary, its five most recent contract awards and five contracts ending soonest), similar (keywords chosen from the tender's title, the contract awards whose titles carry them with their count and published value range, and up to five open tenders like it, each with its page_key) and sources (attributions, computed_at and the award window). Either block is null when nothing is held.

The keywords are a heuristic, and the payload says so (match: {method: "heuristic", rule: "title_keyword"}): the rarest title word, matched as a whole word, that at least three contract awards carry, plus a second word only when the pair narrows the match. Supplier names are shown to a signed-in caller only, as on the contract award routes; each award says whether one is held (supplier_held). An unknown key is a 404; while the intelligence store loads the answer is 503.

Free, no key. Three counts of open tenders: closing_48h (closing today or tomorrow), dates_changed_7d (a closing or published date changed in the last 7 days) and new_7d (first seen in the last 7 days). Each equals the total of the matching search (closing_within_days=1, changed_within_days=7, first_seen_after).

Free. Every nightly and observed snapshot source, including its compact tag, full name, refresh mode, tender count, and most recent run or snapshot date; its URL with an API key or a signed-in session. This is the honesty surface — it names the sources behind login walls and the ones that returned nothing, which is usually the answer to “why did my search come back empty?”

Reads a company's website, builds a capability profile, and ranks open tenders against it. Free. Each match carries why[] — the company's own stated capabilities the tender needs — and gaps[], what the tender asks for that their site does not mention.

score is relative fit within these results, not a probability of winning. degraded: true means scoring was unavailable and the order is keyword relevance only, with no why/gaps — present it as unjudged rather than as ranked. An unauthenticated call returns the strongest few and counts the rest in withheld; shown + withheld == matched always holds.

Signed in, POST /v1/tenders/watch saves any of these as a daily email: a search, a company profile, a buyer, a signal filter or a grants search — five of each kind, one email a day at most, nothing when nothing is new.

Returns {total, results[], computed_at, sources, withheld, withheld_reason}. Each award carries contract_id, buyer, buyer_key, title, value_amount, value_currency, awarded_date, start_date, end_date, categories (UNSPSC), and — signed in or with a key — url, supplier, supplier_id and supplier_key.

Every buyer with a public page for a country: at least 20 contract awards in the window or at least 5 open tenders, recomputed nightly. Returns {country, total, buyers[{buyer_key, name, slug, jurisdiction, award_count, open_tenders, expiring_12m, planned_12m, median_value, value_total, value_currency}], computed_at, sources}. A buyer page lives at /buyers/au/<slug>-<buyer_key>.

How many buyers were first seen in a contract award on or after since. Returns {since, count, computed_at}.

Returns the same payload as the buyer route below, or 404 when nothing is held for that name. When the exact name misses, two labelled heuristics are tried: the name without a trailing division code, and, for a tender labelled with the country alone, the one state the name names. Their result adds match, which names the rule used.

curl "https://www.stipple.sh/v1/awards/buyers/lookup?name=Transport%20for%20NSW&jurisdiction=AU-NSW"

{buyer, expiring[], planned[], recent_awards[], top_suppliers[], open_tenders[], computed_at, sources}. The buyer object is the nightly summary: award_count and window_from (the start of the awards window the counts cover), median_value, p25_value, p75_value, value_currency, median_response_days (publication to close across its tenders), expiring_12m and planned_12m. top_suppliers is a name and a share, never a page. Buyers are one row per published spelling — no alias merging.

An ABN (digits only or spaced) or a scheme:id key. Returns {entity, contracts[], buyers[], categories[], standing, computed_at, sources}: the names seen, the registry number and standing, the contracts held, the buyers won from and the categories. The website's supplier page is for signed-in people only; this route is the same entity. Anonymous callers get the counts with the names and identifiers withheld.

Each signal carries confidence — published or derived, a vocabulary, not a score — window_start and window_end (never invented: an expiry's window is the contract's end date, and a planned row with no parseable quarter has none), value_text, evidence_ref, status (the source's own word for a plan, for example As Published or To Market; empty where the source gives none), released (true when the plan is marked To Market), and — signed in or with a key — evidence_url and incumbent. A plan its agency withdrew is never returned.

curl "https://www.stipple.sh/v1/signals?kind=contract_expiry&jurisdiction=AU-QLD&limit=5"

The signals route filtered to planned_procurement, plus by_jurisdiction counts for building chips. Same filters and paging, and buyer_key, quarter (an id like 2026Q4 from by_quarter, later or ended; a well-formed id outside the current five answers an empty list), window_after (YYYY-MM-DD; a window with no end date is kept), sort (soon or buyer) and exact=1 (the jurisdiction code alone, not its states); a bad value returns 400. A withdrawn plan is never returned, and each row carries status, the agency's own word, and released. The facets ignore the row filters: figures, by_quarter, top_buyers and top_categories.

The plan's buyer summary and that buyer's own contract awards for similar work, inside the summary's window: a count and how many end within 12 months, matched by words in the title (a heuristic, labelled by match). Counts only, no names.

What the state pages render: {jurisdiction, name, expiring{total, federal_by_region, horizon_days, rows[]}, planned{total, quarter, rows[]}, buyers[], open_tenders, region_basis, computed_at, sources}. Commonwealth contracts are attributed to a state by the buyer's published office region, and region_basis says so.

{open_now, new_this_week, expiring_12m, planned_quarter, buyers_month, grants_open, sources_total, countries, by_jurisdiction, previews, computed_at}. Always the anonymous rung — counts and previews, no names.

{pairs[{trade, jurisdiction, open_now, ending_12m, planned_quarter, year_awards, volume, eligible}], minimum, year, match, computed_at}, largest first. A trade is a labelled heuristic: whole words of a row's title and published category, and category code families. Counts only.

{open, ending{days_90, covers_90, days_365, by_month[{month, count, rows[]}], chart, rows[], calendar}, planned, recurring, buyers{rows[], by_value[]}, concentration, eligible, computed_at}. Every figure carries covers, the jurisdictions its rows came from. The open tenders are /v1/tenders?trade=&jurisdiction=&kind=tender. Supplier and holder names, and the re-tender calendar, with a key or a signed-in session.

From the tender corpus alone (GrantConnect): {open, closing_month, month_end, value_open, value_currency, with_value, by_jurisdiction, closing_soon[], computed_at, sources}. value_open sums only the rounds that state a value, and with_value says how many did. Each closing round carries its value, eligibility and GrantConnect's own type as published.

Verifies a document's citations (live / archived / dead, scholarly papers matched against their claimed titles), recomputes its internal arithmetic, and — in deep mode — fetches each cited source to judge whether it supports the claim. Results persist under a content-hash id and include a public shareable permalink.

curl -X POST "https://www.stipple.sh/v1/verify-references?deep=1&stream=1" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/report.pdf"}'

Key response fields: summary (totals + headline), references[], claims[], internal_consistency[], limitations, check_id, permalink.

Fetch a stored fact-check result by its content-hash id (fc_ + 16 hex). This is the data behind the public /fc/<slug>-<hex> permalink pages.

curl https://www.stipple.sh/v1/fact-checks/fc_6d22fb4033cbac40

Estimates the probability that a document's prose was AI-written, with the specific linguistic tells. Abstains (applicable: false) on forms, tables, and scans, where style detection is unreliable. Stateless — nothing is stored.

{
  "applicable": true,
  "probability": 0.92,
  "lean": "ai",
  "tells": ["uniform paragraph rhythm", "hedged superlatives", ...],
  "reasoning": "...",
  "limitations": "Probability is a confidence, not a calibrated truth. ..."
}

Finds whether submitted text overlaps text published on the public web — a plagiarism-style check. Exact matches are confirmed against the fetched source page and returned as quotes from both sides with char spans and the URL. A second tier — clearly-labelled model judgements on possible paraphrases, in possible_paraphrases, never mixed with exact matches — is currently disabled pending its evaluation gate: until it passes, results carry an empty list, paraphrase_checked: false, and a note saying so. Reports overlap, never accusations — no match is never proof of originality. Free, like every checker — counted against your weekly limit only when outcome: "assessed"; abstentions (applicable: false) and search outages don't count. Stateless — nothing is stored.

{
  "outcome": "assessed",
  "overlap_band": "notable",
  "overlap_ratio": 0.14,
  "matches": [{
    "tier": "exact",
    "source_url": "https://example.com/reference-handbook",
    "matched_quote": "...",
    "source_quote": "...",
    "passage_span": {"start_char": 118, "end_char": 214},
    "tokens_matched": 17
  }],
  "possible_paraphrases": [],
  "paraphrase_checked": false,
  "note": "Paraphrase comparison is not enabled on this deployment — the exact-match tier still ran.",
  "top_sources": [...],
  "headline": "Matching published text found at 1 source ...",
  "limitations": "Public-web overlap only ... never an originality certificate. ..."
}

Pull structured fields out of any document. A vision model reads up to a few pages and returns the values you ask for. Say what to pull four ways: an ad-hoc fields list (names, or {name, type, description}, where type is text / amount / date / boolean); a template (payslip, tax_invoice, bank_statement, receipt, contract); neither (auto — classify, then apply that type's fields); or auto on an unrecognised type (schema-free — every labelled field). Reads checkboxes (type: boolean). Extraction, not verification — values are what the document shows; the document is never stored.

options turns on extra capabilities, every one off by default — and asking for one this server does not support is an error naming it, never a silent no-op. tables returns whole tables as rows: on a born-digital PDF they are read deterministically from the document's own coordinates (exact cells, merged-cell colspans, no charge for the table pass); on a scan the vision model reads the rows and the table says source: "vlm". grounding adds a bounding box and text_layer_match to every value the PDF's own text layer can locate — a scan has no coordinate source yet, so its values return bbox: null. classify and redact fold the classification verdict and the masked PII inventory into the same call. layout, links and figures return the document's structure; chunks returns retrieval-ready chunks (six strategies, heading path and position on every chunk; tables are kept whole by default); split returns the page ranges of the distinct documents in one file; flag_below lists the fields under a confidence threshold. GET /v1/extract/capabilities (free, no key) is the machine-readable contract for exactly what this server supports.

{
  "mode": "fields",
  "document_type": "document",
  "fields": {
    "gross_pay": { "value": 5800, "confidence": 0.95, "page": 1 },
    "consent_checkbox": { "value": "checked", "confidence": 0.98, "page": 1 }
  },
  "not_found": ["middle_name"],
  "pages_read": 1,
  "page_limit": 3,
  "page_count": 1,
  "capabilities_used": ["tables.native_pdf"],
  "tables": [ { "page": 1, "source": "native_pdf", "header": ["Description", "Amount"],
                "json": [ { "Description": "Consulting", "Amount": "1000.00" } ] } ],
  "limitations": "Extraction, not verification - values are what the document shows. ..."
}

Free, like every checker — counted against your weekly limit once per call regardless of page count or which options (grounding, layout, links, figures, chunks, redact, split, classify) are requested.

Run an Australian identity check over a set of documents. A vision model reads each one — its type, which identity fields it shows (name / photo / address / signature), and its issue date — then a deterministic engine tallies them against a scheme: afp_100_point (points, the default) or austrac_safe_harbour (category combinations). It reports whether identity is established and exactly what's missing if not. Identity coverage, not a forgery judgment — run /v1/warrants for authenticity. Stateless; documents are never stored.

{
  "established": true,
  "rule": "points_accumulation",
  "points": 110,
  "target": 100,
  "primaries": 2,
  "reason": "Identity established: 110 points with 2 primary document(s).",
  "documents": [
    { "classified_type": "australian_passport", "shows": ["N", "P"],
      "points": 70, "counts": true, "note": "+70 pts (primary)" },
    { "classified_type": "drivers_licence", "shows": ["N", "A", "P"],
      "points": 40, "counts": true, "note": "+40 pts (primary)" }
  ],
  "limitations": "Verification COVERAGE, not a legal identity decision. ..."
}

Does a set of documents satisfy a checklist? Each document is classified (one cheap page-1 read, hash-cached — never field extraction or multi-page reads), then a deterministic engine maps the types onto the checklist's required slots and reports what's present and what's missing. Supply a named scheme (income_proof, lending_prequal, rental_application) or an ad-hoc requirements checklist. Completeness coverage, not approval — that the right document types are present, not that any is genuine.

{
  "scheme": { "id": "lending_prequal", "name": "Lending pre-qualification" },
  "complete": false,
  "slots": [
    { "key": "proof_of_income", "label": "Proof of income", "satisfied": true, "matched": "payslip.pdf" },
    { "key": "bank_statement", "label": "Recent bank statement", "satisfied": false, "matched": null }
  ],
  "missing": ["bank_statement"],
  "documents": [{ "filename": "payslip.pdf", "classified_type": "payslip" }],
  "unmatched_documents": [],
  "limitations": "Completeness COVERAGE, not approval - that the right document types are present. ..."
}

Screen a person or organisation for adverse media and sanctions exposure (PEP is not screened, and the reply says so). Two layers: a deterministic, corroboration-gated match against four primary sanctions lists (OFAC, EU, UK, AU DFAT), and an entity-disambiguated scan of public news for adverse coverage (fraud, money laundering, bribery, sanctions, enforcement). Same-name articles about other people are surfaced under excluded, and a name-only sanctions hit is flagged possible, never confirmed. Screening coverage, not a determination — a hit means “review”, and “nothing found” is not a clean record.

{
  "subject": { "name": "Jane Doe", "source": "provided", "country": "AU" },
  "sanctions": {
    "candidates": [
      { "name": "Jane Doe", "score": 0.93, "strength": "possible",
        "corroboration": "name-only", "topics": ["role.pep"], "datasets": 3 }
    ],
    "strong_matches": 0, "possible_matches": 1, "common_name_ambiguity": false
  },
  "adverse_media": {
    "matched_hits": 1, "possible_hits": 0, "excluded_same_name": 2,
    "categories": { "financial_crime": 1 },
    "hits": [
      { "url": "https://…", "title": "…", "source": "law360.com",
        "match": "match", "category": "financial_crime", "severity": "convicted",
        "evidence": "found guilty of fraud" }
    ],
    "excluded": [ { "url": "https://…", "title": "…", "reason": "different person (same name)" } ]
  },
  "risk_flag": "adverse_findings",
  "headline": "Jane Doe: 1 possible sanctions match (verify); 1 matched + 0 possible adverse-media hits (fraud); 2 same-name false matches excluded.",
  "limitations": "Screening COVERAGE, not a determination. ..."
}

Work out which Australian company a name or number refers to, and whether it is in good standing. Give a name (Acrux Ltd) or an identifier (ABN, ACN or NZBN). An identifier resolves directly — no name search, no ranking — so an exact number can never land on a near-miss. A name only ever produces candidates.

Read status before candidates. ambiguous means several real companies match, and selected is null on purpose — choosing between them is yours to do, with the evidence in front of you. not_found means every register answered and none has it; inconclusive means one could not be read, so absence proves nothing. coverage lists every source and how well it was read, including the ones that were blocked.

selected.asic carries registration standing from ASIC's own register. An active ABN is not the same as a registered company — they are different registers answering different questions, and a company in external administration can still hold an active ABN. Standing is republished weekly, so every answer carries as_of and age_days. It does not include directors or officeholders.

{
  "query": "AQC Dartbrook Pty Ltd",
  "parsed_as": "name",
  "status": "resolved",
  "resolved_because": "exact registered-name match, and the only one among 3 results",
  "selected": {
    "identifiers": { "abn": "46000012813", "acn": "000012813" },
    "names": { "legal": "AQC DARTBROOK PTY LTD" },
    "abn_status": "Active",
    "asic": {
      "status": "EXAD",
      "status_meaning": "External administration",
      "in_good_standing": false,
      "registered": "1923-03-01",
      "former_names": ["ANGLO COAL (DARTBROOK) PTY LTD", "THE BELLAMBI COAL CO LTD"],
      "as_of": "2026-08-24T14:53:11", "age_days": 3,
      "caveat": "ASIC standing as of 2026-08-24T14:53:11. This copy of ASIC's file is no longer refreshed, so the status may have changed since; ASIC Connect is the real-time source."
    }
  },
  "candidates": [ /* every match, ranked; match_quality orders them and never selects */ ],
  "coverage": [
    { "source": "abr", "status": "ok", "detail": "2 rows of 3 matches" },
    { "source": "asic", "status": "ok", "detail": "4,002,081 companies, 3d old" }
  ]
}

Runs the full forensic inspection — tampering signals, structure and metadata analysis, arithmetic reconciliation — and returns a warrant: the document's verification record. The warrant is a signal for review, not a fraud verdict.

Key response fields: warrant_id, risk_band (low / medium / high / insufficient / error), inspection_quality, recommended_action, summary, signals[].

Has this exact document already been inspected? Hash the file yourself (SHA-256, lowercase hex) and check before submitting — identical bytes return the existing warrant for free.

Fetch a stored warrant by id (warrant_ + 16 hex). Add ?format=md for a human-readable Markdown report.

An audit-ready, branded PDF scorecard of the warrant — suitable for case files.

Record a reviewer's verdict on a warrant: {"verdict": "up" | "down", "note": "..."}. Feedback improves the engine's precision over time.

Thumbs up/down on a fact-check or AI-text result: {"tool": "detect_ai_text" | "verify_references", "verdict": "up" | "down"}, with optional ref and note.

Liveness and version: {"status": "ok", "engine_version": "...", ...}

Free and instant, from a signed-in account (the key shares the account's weekly limit): the key is returned once, stored only as a hash, with its key_id. Up to 5 keys per account. See Authentication.

Requires Authorization: Bearer stp_…. Returns your usage this week and when your weekly limit resets — read from the same store that enforces the limit.