Authentication

Every request is authenticated with an API key sent as a request header.

curl https://api.company-watch.co.uk/v1/subscription \
  -H "Authorization: Bearer YOUR_API_KEY"

Your key is shown once, right after you verify your email at sign-up. Store it somewhere safe as we can't show it to you again.

Rate limits & test data

Sign-up is rate-limited per IP address to keep the free tier usable for everyone. Once you have a key, the /v1/test-events endpoint fires a real, correctly-signed event through the real delivery pipeline against a company on your watchlist. This is a quick and easy way to prove your integration works before anything real happens on the register.

FAQ

Why not build this ourselves against the public register?

You absolutely can, but a few things make a DIY integration more work than it first looks:

• The connection has to stay open, indefinitely. A real-time change feed is a long-running connection and production infrastructure (containers, load balancers, proxies) isn't always kind to a connection meant to sit open 24/7. Periodic drops are normal rather than exceptional and need to be coded around.
• Reconnecting correctly is its own problem. A dropped connection needs backoff so you're not hammering the source the moment it recovers, and a resume position so you pick up exactly where you left off - too far back and you replay events you've already handled, too far forward and you silently miss some.
• You're filtering a firehose, not a feed for your companies. The underlying feed carries every change across every company on the register when most integrations only care about a tiny subset of them. Something has to sit in front of it discarding almost everything in real time, just to catch the few you care about.
• Connection and rate limits are real, and mostly undocumented until you hit them. There are practical caps on concurrent connections and request volume that tend to surface through trial and error against the live service, not through the docs. This is not something you want to discover for the first time in production.
• Testing is awkward. It's a live feed of real company changes, so there's no sandbox where you can trigger a specific event on demand which makes it hard to build and test an integration with any confidence before going live.

None of this is hard in isolation — it's just a lot of infrastructure to build and keep running for something that usually isn't your core product. That's the part we've already built, so you don't have to: sign up, get a key, and you're integrated and tested in minutes rather than weeks.