One bearer token. Predictable JSON. Visible rate limits.

Authentication

Every request requires an Authorization: Bearer <api_key> header. Keys are issued on signup and shown once — store them in a secret manager. Lost a key? Rotate it via POST /v1/auth/rotate-key.

curl -s \
  -H "Authorization: Bearer hf_live_..." \
  'https://api.hedgefriend.dev/v1/sec/filings/AAPL?filing_type=10-K'

Rate limits

Per-key limits are enforced per UTC day. Three headers come back on every response — read them, don't guess.

When the budget is exhausted, the API responds with 429 and a Retry-After header.

Errors

Errors are JSON. Codes are stable strings — they will not change wording across versions.

{
  "error": "invalid_api_key",
  "message": "API key is missing, malformed, or revoked."
}

{
  "error": "rate_limited",
  "message": "Daily request budget exhausted.",
  "retry_after_seconds": 3214
}

Endpoint reference

Path parameters in {braces}. Query filters are documented inline in the OpenAPI schema served from the API.