API and Agent Usage Terms
1. What these terms cover
These terms govern programmatic access to Trooth: the public API, authenticated API access from a workspace, and any automated agent, script or crawler that interacts with the Service. They supplement the Terms of Service, which continue to apply. Deprecation and versioning commitments live in the API Versioning and Deprecation Policy.
2. The public API
The public interfaces Trooth supports are listed in the interface catalog at /interfaces.json and on /developers: the website's read endpoints, whose contract is /openapi.json; the reads and the public subscription and view endpoints on api.trooth.co, whose contract is /openapi.yaml; the public MCP server; the command line; and the embeddable badge. These terms apply to each of them, and each entry names its own contract, version policy, limits and support status. Not every public interface is a read: the catalog marks each endpoint that stores state or makes Trooth send requests later, and those have no credential but are not passive. Endpoints not in the catalog are internal: they exist to serve the application, they change without notice, and building on them is not supported. Authenticated endpoints that serve a signed-in workspace are not public interfaces.
3. Credentials
The public API, the public tools of the MCP server, the three skills of the A2A agent and the command line need no key, no account and no credential of any kind. One MCP tool, which reads your own workspace's company record, and A2A tasks kept for a caller take an OAuth access token issued by Trooth's sign-in provider to a person who has signed in to Trooth; no scope is required, and such a token reads only the workspace linked to the person it was issued for. Access to other authenticated endpoints, which serve a signed-in workspace and are not part of the public contract, requires credentials issued through a Trooth workspace. Credentials are yours to protect: do not embed them in client-side code, public repositories or shared documents. Trooth may rotate or revoke a credential that appears in a public place or shows anomalous use, and will notify the workspace when it does. You are responsible for activity under your credentials until you revoke them or report them compromised to security@trooth.co.
4. Rate limits and fair use
Endpoints enforce rate limits, and a limited response carries HTTP 429. Respect the limit: back off and retry later rather than rotating identifiers, distributing requests to evade a cap, or otherwise circumventing limits. Circumvention is a violation of these terms and of the Acceptable Use Policy.
5. Idempotency
Endpoints that accept an Idempotency-Key header deduplicate retries of the same request. When you retry a request that mutates state, send the same key; the documented behavior at /developers describes the replay semantics.
6. Automated agents and crawlers
Automated access to public Network data is offered through the API rather than by scraping pages. If you operate an agent or crawler anyway, it must identify itself with an accurate user agent, honor robots directives, and respect rate limits. robots.txt and ai.txt are signals about crawling, not access controls: anything that is not public is protected by authentication, whatever a robots file says. What each kind of use may do with each kind of data is set out in section 7, which controls where a robots or noai directive and these terms appear to differ.
7. What you may do with API data
Free access is not an open-data license. The table below is the whole grant. "Network data" means what the public API, the MCP server, the command line and public pages return about companies; "Trooth's own pages" means pages about Trooth itself, such as this document and the marketing site.
| Use | Network data | Trooth's own pages |
|---|---|---|
| Internal use: evaluating companies, your own workflows and tools | Permitted | Permitted |
| Showing it to your own customers inside your product, with its source label, date and a link to the record | Permitted | Permitted, with a link |
| An AI agent answering a user's question from it, with its source label | Permitted | Permitted |
| Caching it | Permitted for up to 24 hours, or until a read shows it changed or was withdrawn, whichever comes first | Permitted |
| Indexing it for search | Permitted, with a link to the record | Permitted |
| Benchmarking or evaluating Trooth itself, and publishing accurate results | Permitted | Permitted |
| Training or fine-tuning an AI model on it | Not permitted without a written agreement | Permitted, as ai.txt says, by crawlers that honor robots directives |
| Bulk export or republishing it as a dataset or a directory | Not permitted without a written agreement | Not permitted |
| Building a competing directory or record service from it | Not permitted | Not applicable |
| Keeping it after these terms stop applying to you | Delete cached copies within 30 days | Not applicable |
Wherever you show Network data, keep the provenance label and date that come with it, and do not present a Trooth observation as something Trooth established rather than observed, or a company's declaration as something Trooth observed. What a company supplies stays the company's content: these terms do not grant rights in a company's own documents, logos or text beyond displaying them as they appear on its record, and third-party evidence may carry its source's own terms. A company that withdraws its record is withdrawing it from Trooth; Trooth cannot recall copies others made while it was public, and section 7's caching and retention limits are how Trooth asks you to honor a withdrawal.
8. Availability and changes
The API is provided as described in the Terms of Service. Trooth publishes changes through the versioning policy above; it does not promise a particular availability level in these terms. Any service-level commitment, where one exists, comes from a written agreement between your organization and Trooth.
9. Suspension
Trooth may suspend programmatic access that degrades the Service for others, violates these terms, or presents a security risk, and will restore it when the issue is resolved.
10. Contact
developers@trooth.co for API questions; security@trooth.co for credential compromise.
Revised September 4, 2026: descriptions of retired features (composite figure, plan tiers, TruePass badge, Verified Inquiries) removed; the document now describes the witness record as published. Section 8 referred to a plan agreement; Trooth sells no plan, so it now refers to a written agreement. No term was narrowed.
Revision note. Revised September 20, 2026. Section 7 prohibited misattributing Trooth as having verified something it only witnessed. Verified is no longer one of the words this product uses about a company, so the clause named a distinction a reader can no longer look up. It now prohibits the same thing in the vocabulary the product actually publishes: presenting a Trooth observation as something Trooth established rather than observed. The prohibition covers what it covered before and nothing more, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 23, 2026. Dates are written month first. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 26, 2026. Section 3 now says that the public API, MCP server and command line need no credential. Section 6 says robots and ai.txt are signals, not access controls, and defers to section 7. Section 7 replaces a short list with a table of what each use may do with Network data and with Trooth's own pages, including caching, indexing, benchmarking and retention after these terms stop applying, which the earlier text did not address. Benchmarking and evaluating Trooth and publishing accurate results, which the Acceptable Use Policy appeared to prohibit, is expressly permitted. Section 6 said Trooth does not authorize training on Service content while ai.txt permitted training crawlers on Trooth's own pages; the table now states the ai.txt position, which is the one Trooth has applied. No right was narrowed, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 28, 2026. Section 2 limited the public API to the operations in /openapi.json, although Trooth also documents a public MCP server, reads and subscription endpoints on api.trooth.co, a command line and a badge. Section 2 now incorporates the public interface catalog, which lists each of them with its own contract, and says which public endpoints store state rather than read. The permitted-use table in section 7 is now a real table rather than a paragraph of text. No permitted use was narrowed and no prohibited use was relaxed, and the correction is recorded under our publication and correction policy.
Revision note. Revised October 5, 2026. Section 3 said the public MCP server needs no credential of any kind. One MCP tool, which reads the caller's own workspace record, and tasks kept by the A2A agent now accept an OAuth access token from Trooth's sign-in provider, with no scope required. Section 3 now says so, and says that such a token reads only the workspace linked to the person it was issued for. The public tools and the A2A agent's skills still need no credential. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.