Bitculator
Developer console

Policies

API policies

How the Data API is versioned, how deprecations are announced and how long they run, and how to report a security issue.

Versioning

The API is versioned in the path: every endpoint lives under /api/v1. The contract's info.version (currently 1.1.0) follows the changelog: the minor number rises when something is added, the patch number when something is fixed, and a new path version (/api/v2) is the only way a breaking change ships.

The eight official SDKs track the API: a new endpoint is a minor SDK release, a removed or renamed one a major release.

What counts as breaking

These never happen inside a path version:

  • Removing or renaming an endpoint, a query parameter or a response field.
  • Changing a field's type, or the rule that prices, rates and supplies are decimal strings.
  • Changing the { data, meta } envelope, the error envelope or the meaning of an existing error code.
  • Lowering a rate limit or quota a plan already has.

These can happen at any time and are announced in the changelog:

  • New endpoints, query parameters and response fields.
  • New error codes for new situations - always match on error.code, never on the message.
  • New values in lists the reference says may grow, such as event names and indicator names.
  • Higher limits and quotas.

Deprecation

When an endpoint, parameter or field is scheduled for removal it is announced in the changelog and by email to every key owner, and from that day the endpoint answers with Deprecation and Sunset headers (RFC 9745, RFC 8594) naming the removal date. The OpenAPI contract flags it with deprecated: true.

Removal happens no sooner than six months after the announcement. A new path version runs alongside the previous one for at least six months before the old one is sunset the same way.

Nothing is currently deprecated or scheduled for removal.

Limits and fair use

Per-minute burst limits and monthly quotas are part of your plan, reported on every response in the X-RateLimit-* and X-Quota-* headers and documented in the reference. Raising a limit is never breaking; lowering one inside a plan is, and follows the deprecation timeline.

Responsible disclosure

If you believe you have found a security vulnerability in bitculator.com, the Data API, the MCP server or the SDKs, email contact@bitculator.com with the affected URL or endpoint, steps to reproduce and the impact you see. You will hear back within three business days.

Please keep the report private until it is fixed, do not access or alter data that is not yours, and do not run denial-of-service or automated scanning against production. Reports made in good faith under these terms will not be met with legal action. There is no paid bounty programme; credit is given on request.

The same contact is published machine-readably at /.well-known/security.txt (RFC 9116).

Status and incidents

Live component status, open incidents and the last 30 days of outages are on the status page and at /status.json.