Developer Documentation

1. Base URL & Authentication

Production requests are served globally from Cloudflare's edge network at https://api.tinplate.dev.

• Direct Bearer Key (Zero-Proxy / All-Access Bundle): Pass Authorization: Bearer <API_KEY> directly to https://api.tinplate.dev. Recommended for security-sensitive production workloads because requests terminate directly at Tinplate's zero-logging Cloudflare Workers with no third-party marketplace proxy in between.
• RapidAPI: Pass X-RapidAPI-Key via RapidAPI's gateway (RapidAPI's proxy automatically injects the per-API X-RapidAPI-Proxy-Secret verified in constant time by our Gateway).
• Zyla API Hub: Pass your Zyla bearer key via Zyla's gateway (Zyla's proxy injects X-Zyla-Proxy-Secret).

2. Standard Response & Error Envelope

Every endpoint returns HTTP 200 with ok: true on success, or a structured error envelope (400, 401, 413, 429, 500) with X-Request-Id:

{
  "ok": true,
  "data": { ... },
  "meta": {
    "request_id": "2c8a9f10-91b4-4d3e-8a11-09ab12cd34ef",
    "ms": 1
  }
}

{
  "ok": false,
  "error": {
    "code": "validation_error",
    "message": "Invalid request payload"
  },
  "meta": {
    "request_id": "2c8a9f10-91b4-4d3e-8a11-09ab12cd34ef",
    "ms": 0
  }
}

3. All 42 API Endpoints & OpenAPI 3.0.3 Specifications

4. Official Streamable HTTP MCP Server (POST /mcp)

Connect Claude Desktop, Cursor, Windsurf, or the OpenAI Agents SDK directly to Tinplate's stateless edge server to expose all 42 deterministic validators and guardrails as MCP tools (tinplate_prompt_guard, tinplate_json_heal, tinplate_eu_vat_iban, tinplate_mcp_manifest_linter, etc.):

{
  "mcpServers": {
    "tinplate": {
      "type": "streamable-http",
      "url": "https://api.tinplate.dev/mcp"
    }
  }
}

5. Multi-Step Composite Pipeline (POST /v1/pipeline) & Turnkey Presets (/v1/presets)

Execute up to 5 Tinplate endpoints sequentially in a single sub-millisecond Worker invocation with automatic short-circuiting (stop_on_block: true) and dynamic step-to-step data piping via $steps.<stepId>.data.<field>:

curl -X POST "https://api.tinplate.dev/v1/pipeline?receipt=true" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "stop_on_block": true,
    "steps": [
      { "id": "guard", "endpoint": "/v1/prompt-guard", "body": { "text": "Contact alice@tinplate.dev", "context": "user_input" } },
      { "id": "redact", "endpoint": "/v1/pii-redactor", "body": { "text": "Contact alice@tinplate.dev", "locales": ["GLOBAL"], "mode": "token" } },
      { "id": "secrets", "endpoint": "/v1/secret-scanner", "body": { "text": "$steps.redact.data.redacted_text", "mode": "token" } }
    ]
  }'

Or call one of the 4 pre-wired Enterprise Presets (GET /v1/presets): POST /v1/presets/llm-ingest-safe, POST /v1/presets/llm-output-safe, POST /v1/presets/agent-pre-exec, or POST /v1/presets/eu-vendor-kyb. Append ?receipt=true (or header X-Tinplate-Receipt-Request: true) to any /v1/* call to receive an HMAC-SHA256 signed compliance receipt in the X-Tinplate-Receipt response header.