Getting started

Quickstart — no account needed

All read endpoints are currently open. Call the API right now without any setup:

# Vendor trust leaderboard — no key required
curl "https://disclosedlabs.com/api/v1/vendors?sort=trustScore&graded=true"

# Cheapest retatrutide across vendors
curl "https://disclosedlabs.com/api/v1/prices?peptide=retatrutide&sort=price_asc"

# All COAs for a peptide
curl "https://disclosedlabs.com/api/v1/coas?peptide=bpc-157"

Rate limit: 120 requests / minute (per IP). No sign-up required.

API keys — for write access

If you're a listed vendor and want to manage your own prices and deals via the API, create an API key. Write-scoped keys use Bearer token auth:

curl -X PUT \
  "https://disclosedlabs.com/api/v1/vendors/your-vendor/products/clx456" \
  -H "Authorization: Bearer dlk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "priceCents": 4999, "inStock": true }'

Keys start with dlk_. We store only a SHA-256 hash — the plaintext is shown once at creation, so save it. Lost a key? Revoke it and mint a new one.

Read endpoints also accept a key (useful for tracking your own usage in the dashboard) — but they'll work without one.

Attribution (required) {#attribution}

The API is free in exchange for a visible dofollow link to disclosedlabs.com on any page or app that surfaces our data. A dofollow link is a normal <a href="https://disclosedlabs.com"> — not marked rel="nofollow", sponsored, or ugc.

Add your site URL to a key in the dashboard. A weekly crawl spot-checks the link and marks the key Verified or Missing. The check is best-effort and never blocks your requests — but persistent non-attribution is grounds for revoking a key under the Terms. Every API response also carries an X-Attribution-Required header and an attribution note in meta as a reminder.

Rate limits

Each response includes standard rate-limit headers:

Exceed the limit and you'll get 429 with a Retry-After header. Back off until the window resets.

Response envelope

List endpoints:

{
  "data": [ /* ...resources... */ ],
  "pagination": { "nextCursor": "clx...", "hasMore": true, "limit": 20 },
  "meta": { "apiVersion": "v1", "attribution": "Data from https://disclosedlabs.com ..." }
}

Detail endpoints return a single object in data. Errors:

{ "error": { "code": "rate_limited", "message": "..." }, "meta": { "apiVersion": "v1" } }

Error codes: unauthorized (401), forbidden (403), not_found (404), bad_request (400), conflict (409), rate_limited (429).

Pagination

All list endpoints use cursor pagination. Pass limit (default 20, max 100). When pagination.hasMore is true, pass pagination.nextCursor back as the cursor query param for the next page:

curl "https://disclosedlabs.com/api/v1/coas?limit=50&cursor=clx123"

Cursors are stable under inserts, so you won't see duplicates or gaps while paging.

Vendor price writes

If you're a listed vendor, create an API key scoped to your domain from the API keys page. That key gains write:prices scope for POST/PUT/DELETE /api/v1/vendors/{slug}/products and PATCH /api/v1/vendors/{slug}/deals. Read the reference for the request bodies.

Each product must reference a catalogued peptide. Pass peptideSlug — list every valid slug at GET /api/v1/peptides — or pass a name/code and we'll resolve it (e.g. GET /api/v1/resolve?name=GLP-3 → retatrutide). Un-catalogued names are rejected so the shared price corpus stays clean.