DataVendor Documentation

DataVendor has a REST API for each side of the marketplace and one MCP server for coding agents. All of them authenticate with the same team API key. Buying, bidding, publishing, and moving money stay in the web app.

Vendor API

Your listings, inventory, opportunities, estimations, and earnings.

Buyer API

The catalog, your purchases and bids, and the opportunities you posted.

Use the API that matches your organization’s role. An organization with both roles uses both with one key. Both APIs read the catalog and the taxonomy, so those endpoints appear on each page.

API	OpenAPI document	Interactive reference
Vendor	`/vendor/openapi.json`	`/vendor/docs`
Buyer	`/buyer/openapi.json`	`/buyer/docs`

Authentication

DataVendor organizations are HUD teams, so the key is a HUD team API key. Create one in Settings → API Keys and send it as a bearer token on every request. The hud-api-key and X-API-Key headers are accepted too.

curl https://api.datavendor.ai/v2/listings/browse \
  -H "Authorization: Bearer $HUD_API_KEY"

Missing or invalid credentials return 401. A valid key whose team may not touch the resource returns 403. Catalog reads also require a marketplace role on the team, and vendor-only teams are subject to the browse gate: behind it, GET /v2/listings/browse serves only the first page of the unfiltered catalog with locked: true, and refuses search, filters, sorting, and cursors with 403. GET /v2/listings/browse/access reports where your team stands.

Conventions

Convention	Detail
Base URL	`https://api.datavendor.ai`, every route under `/v2`.
Format	JSON in, JSON out.
IDs	Resources are addressed by UUID in the path.
Pagination	Catalog browse is keyset-paginated: pass `cursor` from the previous page’s `next_cursor`. Team-scoped lists take `limit` and `offset`.
Time	Timestamps are UTC, ISO 8601.
Mutations	Creates return `201`, deletes return `204`, everything else returns `200`.
Rate limits	Requests can be capped per client IP and per team. Per-team budgets cover catalog, history, and sales reads, purchases, quality checks, and uploads. A request over a limit receives `429`.

Every example on the API pages is generated from that API’s OpenAPI document, so field names match what the server sends and receives. The values are placeholders.

Errors

Failures share one envelope, with a machine-readable code and a human-readable message. The status tells you whether to fix the request, the credentials, or the state.

Status	Meaning
`400`	The request is malformed.
`401`	Credentials are missing or invalid.
`403`	Authenticated, but not allowed: no marketplace role, a Mutual NDA not yet accepted, or the browse gate.
`404`	The resource does not exist, or is not visible to you.
`409`	The resource already exists, or conflicts with its current state.
`422`	The body or parameters failed validation.
`429`	Too many requests. Back off, then retry.

MCP

The DataVendor MCP is a read-only Model Context Protocol server for coding agents: streamable HTTP JSON-RPC at https://api.datavendor.ai/v2/mcp/, with the same team API key. One server serves both sides; the tools a key can use follow its team’s role. The tools are listed per side under Vendor MCP tools and Buyer MCP tools.

{
  "mcpServers": {
    "hud-datavendor": {
      "url": "https://api.datavendor.ai/v2/mcp/",
      "headers": {
        "Authorization": "Bearer YOUR_HUD_API_KEY"
      }
    }
  }
}

claude mcp add --transport http hud-datavendor \
  https://api.datavendor.ai/v2/mcp/ \
  --header "Authorization: Bearer $HUD_API_KEY"

{
  "hud-datavendor": {
    "url": "https://api.datavendor.ai/v2/mcp/",
    "headers": {
      "Authorization": "Bearer YOUR_HUD_API_KEY"
    }
  }
}

Every tool resolves your team from the key, as the REST routes do, and enforces the same marketplace role, NDA, and browse gate. Missing or invalid credentials fail the call with an Unauthorized error. The tools wrap the same service methods as the REST routes, so a listing id from browse_listings is the id GET /v2/listings/browse/{listing_id} takes.

Get started

Resources

Using the API

Vendor API

Buyer API

Authentication

Conventions

Errors

MCP

Vendor API

Buyer API

​Authentication

​Conventions

​Errors

​MCP

Authentication

Conventions

Errors

MCP