Get an API key, make your first call, and see the citation contract — in under 5 minutes.
73| 74|_mock=true for sample data with no upstream hit.
96| Four authentication methods, one JWT token format. All methods issue the same JWT — pick the one that fits your use case.
105| 106|Create a key from the workspace, then send it as the X-API-Key header:
Sign in with GitHub, Google, or any OIDC provider. Redirect to the provider, get a JWT on callback:
114|Configure providers via MAPLESPIKE_OAUTH_{NAME}_CLIENT_ID env vars.
Sign a SIWE (EIP-4361) message with your wallet, verify the signature, get a JWT:
124|Register a passkey (Touch ID, Windows Hello, Android biometric, YubiKey), then authenticate with it:
133|Works with Bitwarden, iCloud Keychain, Google Password Manager, Windows Hello, and any FIDO2 authenticator.
142| 143|All methods issue JWTs with the same format. Use the token as a Bearer header or session cookie. Keys are hashed with SHA-256 at rest.
144| 145| 146|Every response carries the same structure — data, quality score, citation metadata, and usage info. Your agent always knows where the answer came from.
152| 153|| Method | Path | Description |
|---|---|---|
| GET | /v1/health | System status and usage |
| GET | /v1/gov/releases | Latest government data releases |
| GET | /v1/gov/search?query= | Search across all sources |
| GET | /v1/citation/:hash | Verify a data point by SHA-256 hash |
| GET | /v1/usage | Usage and quota info |
| GET | /v1/keys | List API keys |
| POST | /v1/keys | Create a new API key |
| GET | /v1/auth/me | Current user profile |
Every token saved is money earned. These params go in the same request body — they're extracted before validation.
201|| Param | Type | Effect |
|---|---|---|
| _fields | string[] | Return only named fields |
| _format | "full" \ "compact" | Compact strips null/empty |
| _limit | number | Cap array results |
| _page | number | Pagination offset |
| _summary | boolean | Return aggregates, not rows |
| _mock | true | Sample data, free, no upstream hit |
Every MapleSpike endpoint returns the same citation block — whether you're using the REST API, MCP tools, or cross-reference engine. One integration gives you auditable data across the stack.
218|
220|{
221| "success": true,
222| "data": { ... },
223| "citation": {
224| "source_name": "open.canada.ca",
225| "source_url": "https://open.canada.ca/...",
226| "retrieved_at": "2026-05-13T12:00Z",
227| "data_hash": "sha256:a1f3...",
228| "license": "OGL-C",
229| "update_frequency": "daily",
230| "original_format": "JSON",
231| "citation_text": "open.canada.ca, retrieved 2026-05-13. OGL-C. https://...",
232| "citation_footnote": "open.canada.ca, May 2026"
233| }
234|}
235|
236|
237| data_hash is the SHA-256 of the response payload at fetch time. Re-fetch the source yourself and compare — if hashes match, you saw what we saw, byte-for-byte.
All tools return the same { data, quality, citation } envelope. Connect any MCP client — or use the REST API directly:
| Category | Tool | Description |
|---|---|---|
| General | query_gov_data | Search StatCan, CKAN, provincial portals |
| General | fact_check | Verify claims against official data |
| General | get_citation | Retrieve SHA-256 citation hash |
| General | latest_releases | Recent government releases |
| Parliament | search_committees | HoC + Senate committees, evidence, in-camera |
| Corporate | search_corporate | Lobbying, procurement, exec statements |
| Influence | search_influence | 32 tracked actors, funding, connections |
| Regulatory | search_gazette | Canada Gazette Parts I+II regulations |
| Appointments | search_gic | Governor-in-Council appointments |
| Elections | search_elections | Third-party advertising, spending |
| Provincial | search_provincial_lobbying | ON lobbying registry (BC/QC stubbed) |
| Oversight | search_oversight | OAG, PBO, Ethics, CB, CRTC reports |
| Legal | search_canlii | Court decisions, citations via CanLII |
| Cross-Reference | search_cross_reference | Search all modules at once — entity timeline across lobbying, GIC, committees, contracts, elections |
| Labour | search_lmia | LMIA quarterly data, TFW program |
Rate limits are per-second and per-month. Hitting the per-second limit returns 429 with a Retry-After header.
286|| Plan | Per sec | Per month | Overage |
|---|---|---|---|
| Free | 2/s | 1,000 | Hard cap (402) |
| Pro | 25/s | 50,000 | $1/1K (planned) |
| Business | 100/s | 250,000 | $0.80/1K (planned) |
| Enterprise | Custom | Custom | Negotiated |
All error responses carry success: false, a stable error code, and a human-readable message.
| Code | Status | Retry | Meaning |
|---|---|---|---|
| auth_invalid | 401 | No | Fix API key or JWT |
| rate_limited | 429 | Yes | Respect Retry-After header |
| quota_exhausted | 402 | No | Upgrade plan or wait for reset |
| input_invalid | 400 | No | Check input schema |
| source_unavailable | 502 | Yes | Upstream source down, retry later |
| not_found | 404 | No | Resource doesn't exist |
| server_error | 500 | Yes | Backoff, report if persistent |
Do I need a credit card to start?
321|No. Free plan: 1,000 calls/month, every source, every SDK, citation hashes included. No card, no time limit.
322|What makes the citations verifiable?
326|Every response includes source name, exact upstream URL, retrieval timestamp, and a SHA-256 content hash. You can re-fetch and confirm exactly what the agent saw.
327|Which AI frameworks are supported?
331|MCP (Claude, Cursor, Windsurf, ChatGPT), Anthropic tool_use, OpenAI function calling. TypeScript and Python SDKs.
332|How fresh is the data?
336|Depends on the source. Committee evidence: ~24h. Canada Gazette: within hours of publication. CanLII: daily. Every response ships with a freshness_seconds field so your agent always knows.
337|What is the cross-reference engine?
341|Search for any person or company and get their complete government footprint — lobbying meetings, committee testimony, GIC board appointments, procurement contracts, court cases, and campaign donations — in a unified timeline. One call replaces manually querying 63 separate modules.
342|Is my API key secure?
346|Keys are hashed with SHA-256 at rest — we only see them at verify time. HTTPS-only transit. Rotate from the workspace instantly.
347|