Developers
Developer documentation
The REST API and the MCP server for insurers, reinsurers, brokers, agencies, research bodies and anyone who integrates Coastal Intelligence by code: what you can read, how to authenticate, every endpoint and tool, the signed exports, the data model and its licences.
What a partner can read
Everything is read-only and comes from the shared layers: open model, satellite and station data and the values computed from them. The same 9 tools answer over both channels; each needs an approved product (or none):
list_bays: list bays. No product needed.list_sites: list sites of a bay. No product needed.get_signals: get signals. Product signals.get_events: get bay events. Product events.get_skill: get model skill. Product skill.get_timeseries: get a time series. Product: the dataset key given as product.get_backtest: get the bloom back-test. Product backtest.get_risk_index: get the bay risk index. Product risk_index.describe_datasets: describe datasets. No product needed.
Two channels
- REST: plain HTTPS and JSON at
https://coastal-intelligence.triskelionaisystems.com/api, one route per tool under/agency/, plus the signed CSV export, the dataset registry and the observations webhook. See REST API. - MCP (Model Context Protocol): the same tools for AI assistants and agents at
https://coastal-intelligence.triskelionaisystems.com/api/mcp, streamable HTTP, stateless. See MCP server.
How to get a key
- Agencies and research bodies: sign in with a work e-mail and send an access request on Request data access (bays, products, aggregation, date range, purpose). An administrator approves it and issues the key; the key's scope is exactly the approved request.
- Insurers, reinsurers and brokers: ask for a quote on the pricing page (choose API / MCP access), then request access the same way. The products for underwriting are
risk_index,events,skillandbacktest. - Loggers and gateways that push readings use the deployment's webhook key, not an agency key: see Observations webhook.
Details of the flow, the headers and the status codes: Authentication and keys.
What is never shared
- Operator records: data-logger series, harvest, mortality and seaweed logs, webhook series, notes, photos, briefs and post-mortems. They are not a product, the queries exclude them, and a last check refuses any result that would hold one.
- Personal data: operator and crew names, contacts, account e-mails.
- Operability signals (they encode a farm's own working limits) and the thermal and runoff back-test rows (scored against operator records). Only the bloom back-test is shared.
- Anything outside the key's approved bays, products, aggregation and date range.
Limits
- Rate limit: 60 calls per minute per key unless the deployment sets another value, REST and MCP together; over it
429withRetry-After. - One call covers at most 366 UTC days and returns at most 20,000 rows; an omitted range means the last 30 days up to today plus the 10-day forecast horizon, inside the approved range.
- Refusals are explicit:
401key,403scope,404unknown bay or site,422bad parameters.
Versioning
The API is version 0.1.0 (the info.version of https://coastal-intelligence.triskelionaisystems.com/api/openapi.json). Fields are added, never renamed or removed without a dated entry on the Versioning and changes page.
Signals and the risk index are favourable, marginal or unfavourable style indicators for a named activity, not food-safety advice. For shellfish harvesting and food safety always follow the official closures (Marine Institute HAB bulletin, SFPA).
Where to ask
Write to coastalintelligence@triskelionaisystems.com for keys, scope changes and integration questions. The plain-language guides are in the help knowledge base: Agency data access and Insurer data sharing.
Pages
- Integrators, security reviewers
Authentication and keys
The request and approval flow, the Authorization and X-API-Key headers, what a key's scope means, revocation, the exact meaning of 401, 403, 404, 422 and 429, and what the access log records.
Last reviewed 1 Nov 2026 - Integrators, data engineers
REST API
The base URL of this deployment, every partner endpoint with its parameters, the date rules, the response envelope field by field, examples in curl, Python and JavaScript, and the live OpenAPI reference.
Last reviewed 1 Nov 2026 - Analysts with an AI assistant, agent builders
MCP server
The Model Context Protocol server for AI assistants and agents: endpoint and transport, the auth header, every tool with its typed arguments, the tool-error shape, client configurations, the configuration checker and example prompts.
Last reviewed 1 Nov 2026 - Insurers, reinsurers, brokers
Risk index and signed exports
The insurer product: the 0 to 100 index per peril, the bay aggregation and suppression rules, the CSV export, verifying its Ed25519 signature with a complete Python example, and how to cite the licences.
Last reviewed 1 Nov 2026 - Logger and gateway integrators
Observations webhook
POST readings for a site from a logger, gateway or app: the key, the item fields, the accepted properties and units, the all-or-nothing and idempotence rules, and the response shape.
Last reviewed 1 Nov 2026 - Data engineers, legal and compliance
Data model and licences
The five provenance fields on every row, the three scales, what lead_hours means, the public dataset registry, the licence ids and the attribution line each one requires, and the product catalogue.
Last reviewed 1 Nov 2026 - Integrators
Versioning and changes
Where to read the API, MCP server and method versions, what is stable (fields are added, never renamed or removed without notice here), and the dated list of changes.
Last reviewed 1 Nov 2026