---
title: Proquiro Public API reference
description: Markdown reference for the Proquiro public API — demo-request and health endpoints, error codes, rate limits, and idempotent retries.
canonical: https://proquiro.com/api/docs
last-updated: 2026-08-26
---

# Proquiro Public API

> Form-handler endpoints for the Proquiro marketing site. Not a general-purpose data API.
> For an HTML overview of every Proquiro developer resource (MCP server, OpenAPI spec, agent-skills index, llms.txt), see [/developers](https://proquiro.com/developers).

## Endpoints

### POST /api/v1/demo-request

Submit a demo request. Triggers internal sales notification + 3-email buyer nurture sequence over ~14 days.

**Rate limit:** 5 requests per IP per hour
**Honeypot:** `website` field must be empty
**Rejected:** disposable email domains (mailinator, guerrillamail, etc.)
**Required fields:** `name`, `email`, `phone`

**Body:**
```json
{
  "name": "Jane Doe",
  "email": "jane@company.com",
  "phone": "+91 99000 00000",
  "message": "Interested in seeing the platform.",
  "hear_about": "Google search",
  "utm_source": "google",
  "utm_medium": "cpc",
  "utm_campaign": "land-acquisition"
}
```

### GET /api/v1/health

Service health check. Returns `{ "status": "ok", "version": "1.0.0", "timestamp": "..." }`.

## Versioning & deprecation

The API is versioned in the URL path; the current version is `v1`. The unversioned aliases `/api/demo-request` and `/api/health` remain permanently supported and behave identically to v1. Breaking changes only ship in a new path version (`/api/v2/*`). Deprecations are announced at least 6 months ahead via `Deprecation` and `Sunset` (RFC 8594) response headers, `deprecated: true` in the OpenAPI spec, and the changelog at https://proquiro.com/product-updates. Full policy: https://proquiro.com/developers/deprecation-policy

## Rate limits

Every `/api/*` endpoint response carries standard rate-limit headers agents can self-throttle on: `RateLimit`, `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` (seconds until reset), and `RateLimit-Policy` (`<limit>;w=<window-seconds>`). The publicly cached discovery documents (`/api/docs`, `/api/openapi.json`) are rate-limited but carry no per-IP counters.

- Global ceiling: 300 requests per minute per IP across `/api/*` (`RateLimit-Policy: 300;w=60`)
- Demo requests: 5 per IP per hour on `/api/v1/demo-request` (`RateLimit-Policy: 5;w=3600`)

`429` responses include `Retry-After` (seconds) and the structured JSON error below with `code: "RATE_LIMITED"`. Details: https://proquiro.com/developers#proquiro-rate-limits

## Discovery

- **OpenAPI 3.0 spec:** `/api/openapi.json`
- **API catalog:** `/.well-known/api-catalog` (RFC 9727 linkset+json)
- **Agent skills:** `/.well-known/agent-skills/index.json`
- **MCP server:** `/.well-known/mcp/server-card.json`

## Authentication

These endpoints are public form handlers — no authentication required. They are protected by:

- Per-IP rate limiting (Cloudflare D1)
- Honeypot field
- Disposable-email-domain rejection
- Server-side input validation

For the full agent authentication guide (rate limits, agent identification, partner Bearer tokens, MCP session handshake), see [`/developers/auth`](https://proquiro.com/developers/auth).

## Error schema

Every endpoint returns a structured JSON error on failure with `Content-Type: application/json`:

```json
{
  "error": {
    "code": "RATE_LIMITED",
    "message": "Too many requests from this network. Please try again later.",
    "hint": "Limit: 5 requests per IP per hour.",
    "docs": "https://proquiro.com/developers#proquiro-public-api"
  }
}
```

Stable codes: `INVALID_PAYLOAD`, `MISSING_FIELDS`, `INVALID_PHONE`, `INVALID_EMAIL`, `DISPOSABLE_EMAIL`, `HONEYPOT_TRIGGERED`, `RATE_LIMITED`, `DUPLICATE_REQUEST`, `NOT_FOUND`, `METHOD_NOT_ALLOWED`, `DB_NOT_CONFIGURED`, `DB_NOT_INITIALIZED`, `DB_UNAVAILABLE`, `INTERNAL_ERROR`. `429` responses include a `Retry-After` header.

Unknown `/api/*` paths — including method/path combinations with no handler, which surface as HTTP 404 — return this JSON envelope with `NOT_FOUND`; endpoints that explicitly reject a method return `METHOD_NOT_ALLOWED` (HTTP 405). Never an HTML error page.

## MCP server

The Proquiro MCP server is mounted at `POST /mcp` (Streamable HTTP, JSON-RPC 2.0). Send `Accept: application/json, text/event-stream` to negotiate SSE responses. Sessions are tracked via the `Mcp-Session-Id` response header.