Public property data for applications and agents

The public API is available without a key for read-only queries, with a rate limit of 100 requests per hour per IP. This is the sandbox-style starting point: it uses only published records, does not create or change data, and returns JSON with stable pagination and source attribution.

For a larger limit, sign in to ObraAberta and open the API key panel at /api. The panel generates a key once, shows only its prefix afterward and lets the owner revoke it. Send the key only from a server-side integration in the X-API-Key header; never put it in browser code, URLs or prompts.

Read the human API documentation at /api/docs or download the OpenAPI contract at /openapi.json. GET responses include legacy X-RateLimit headers and the standard RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers. When a request is throttled, the response is 429 with Retry-After and a machine-readable problem object.

The API returns public records only. It does not expose CPF, private residential addresses, apartment numbers, private contact details, credentials or unmoderated identity data. Missing fields remain missing rather than being inferred.

Use the REST API when your application needs structured JSON and pagination. Use the public MCP at /mcp when an MCP-compatible agent should discover read-only tools for projects, builders, ratings, timelines, nearby services and public sources. Use the CLI at /cli when a developer or script needs terminal commands and --json output.

All interfaces point to the same governed public catalog. Preserve the canonical property URL, source names, dates, quality signals and OpenStreetMap attribution when you redistribute a result.

The versioned base is /api/v1. Breaking changes will use a new versioned path; non-breaking additions may appear within the current version. Respect cache headers, pagination and rate limits, identify your application with a descriptive User-Agent, and stop or back off after 429. Do not use the API, MCP or CLI to enumerate private data or bypass authentication.