Developers

Build on governed AI with tools you already know.

Data.co exposes standard interfaces: an OpenAI-compatible API for models, a retrieval API that enforces permissions, YAML policies in Git, an MCP gateway for tools, and REST and MCP access to Marketplace datasets. Start with the surface you need.

API & MCP docs Marketplace quickstart

Surfaces

Where to start.

AI gateway

OpenAI-compatible chat and embeddings endpoints in your deployment. Point existing SDKs at a new base URL.

Dataset declarations

Name the datasets an AI call draws on with the X-Dataco-Datasets header, so their classification labels feed the policy decision before any model sees the request.

Policy as code

Write YAML policies, test them in CI, and simulate decisions before deploying.

MCP gateway

Marketplace API

REST endpoints, MCP servers, and downloads for licensed datasets, with API keys from your account.

Audit export

Stream or batch export audit records to your SIEM or data warehouse.

Examples

A few lines each.

Hostnames and model names below are placeholders for your own deployment.

chat.ts

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://ai.internal.example.com/v1",   // your Control runtime
  apiKey: process.env.DATACO_AGENT_TOKEN,          // dc_agent_…
  defaultHeaders: {
    "X-Dataco-On-Behalf-Of": "[email protected]",
    "X-Dataco-Datasets": "support.tickets",
  },
});

const res = await client.chat.completions.create({
  model: "local:llama-70b",   // a registered inference endpoint key
  messages: [{ role: "user", content: "Draft a summary of ticket 4821." }],
});

Illustrative example · final API surface documented in /docs

Where things live

Deployment APIs versus Marketplace APIs.

Interface	Runs in	Authentication
AI gateway and MCP gateway	Your deployment	Agent identity tokens (dc_agent_…) or scoped API keys
Policy and classification config	Your Git repository	Your source control
Marketplace REST API and MCP server	api.data.co	API keys (dc_live_…) with scopes, from your Data.co account
Account, licensing, billing	app.data.co	Data.co account sign-in

Marketplace API

REST and MCP over the same operations.

The public API lives at api.data.co/v1 and is described by an OpenAPI 3.1 document at /v1/openapi.json. The MCP server at api.data.co/mcp exposes the same operations as tools, so scopes, quotas, and metering are identical on both.

shell

curl -s "https://api.data.co/v1/legal/cases?q=adverse%20possession&limit=5" \
  -H "Authorization: Bearer $DATACO_API_KEY"

# Every response uses one envelope:
# { "data": …, "meta": { "request_id": "req_…", "next_cursor": … }, "error": null }

Illustrative example · final API surface documented in /docs

Handling outcomes

What your code should expect back.

Gateway responses carry an x-dataco-request-id header. Policy outcomes add x-dataco-decision and x-dataco-policy-ids.

Surface	Outcome	What to do
AI gateway	403 policy_denied	Show the explanation; do not retry the same request
AI gateway	409 approval_required	Surface the approval ID and approver groups; retry once it is approved
MCP gateway	JSON-RPC -32001 / -32002	Denied, or approval required, with the same details
REST and MCP	401 invalid_api_key	Key missing, revoked, or expired
REST and MCP	403 missing_scope or rights_restricted	Request the scope, or the dataset license does not permit it
REST and MCP	429 rate_limited or quota_exceeded	Honor Retry-After, or wait for the monthly quota to reset

Getting set up

From zero to a governed call.

1
Get access
Use a Data.co deployment in your environment, or create an account for Marketplace API keys.
2
Authenticate
Issue an agent identity token for your deployment, or create a scoped API key in app.data.co for the Marketplace. Secrets are shown once.
3
Call
Use an OpenAI-compatible SDK, plain HTTP against the REST API, or any MCP client.
4
Inspect
Read the x-dataco-decision and x-dataco-policy-ids response headers, then find the matching audit record by request ID.

FAQ

Questions buyers ask

Is there an official SDK?

The AI gateway works with existing OpenAI-compatible SDKs. Marketplace SDK information is on the SDK documentation page.

Can I try Data.co Control without a deployment?

Data.co Control runs in your infrastructure, so evaluation typically involves a pilot deployment. Marketplace APIs can be tried with an account.

How do I handle policy denials in my application?

Denied requests return a structured error with the policy ID and a human-readable reason. Show the reason to users and treat it as a final answer for that request.

Where are rate limits documented?

Marketplace limits are on the rate limits page. Limits in your own deployment are configured by your administrators.

Which API key scopes do I need?

datasets:read for catalog metadata, datasets:query for record search, legal:read for the legal corpus, and mcp:invoke in addition to a tool's resource scope when calling over MCP. Request only what your application uses.

How do agents act on behalf of a user?

Send the user's email in the X-Dataco-On-Behalf-Of header with the agent's token. The request is evaluated as the agent and as the user, and the stricter result applies. Identities can be configured to refuse calls without a user.

Policy Engine

Deterministic allow / deny / approve

Developer Documentation

MCP Documentation

AI Gateway

One endpoint, policy-enforced routing