Endpoints under /api/v1 are live and callable. Endpoints under /v1 are proposed and not yet implemented.
Live Implemented and callable
POST /api/v1/compliance
Compliance exposure
Send
Entity, incorporation date, financial-year end, optional AGM date, director count and flags.
Returns
Every obligation with its due date, days late, fee regime, the arithmetic used, the legal citation and what it holds up. Additional fee and adjudicated penalty are returned as separate figures and are never summed.
Notes
Pure and deterministic. asOf is an input, not a clock read, so a result can be reproduced exactly for a dispute. Carries a rule-set version.
POST /api/v1/assistant
Guidance assistant
Send
A business question, plus the page it was asked from.
Returns
A routed answer with steps, a caution, official citations, the facts read out of the question, and follow-up prompts.
Notes
Deterministic intent routing over reviewed guides, plus the rules engine. No model call, so no per-message cost and no invented legal conclusion.
GET /api/v1/search?q=
Service and source search
Send
A query string.
Returns
Matching MCA services, forms and curated official sources with the authority and destination link.
Notes
Lexical retrieval over the catalogue. No eligibility or fee decision is made here.
GET · POST · PATCH /api/v1/filings
Filing lifecycle
Send
A company and an obligation to raise an SRN; an action — upload, pay, resubmit, withdraw — to advance one.
Returns
The SRN with every clock running on it, each carrying its deadline, its basis and what is lost when it runs out. Paid filings also return a derived challan; unpaid ones return the SHA-256 digest a signature would cover.
Notes
Status is never stored. It is derived from the timestamps and the asOf you ask about, so a lapsed window becomes true the moment anyone asks and needs nothing running on a schedule.
GET · POST · DELETE /api/v1/agent
The durable intake agent
Send
POST one utterance — English, Hindi, or a mix. GET reads the held slots; DELETE wipes them.
Returns
What was understood, what is still missing, the one question to ask next in both languages, and — once complete — a prefill link that opens the incorporation flow with every field carried across. Slots persist in D1 against your session, so a half-finished conversation survives a reload.
Notes
Deterministic extraction first; an optional model pass (only if OPENAI_API_KEY is configured as a Worker secret) reads what the rules could not, and its output re-enters through the same validators — a state must be in the fee schedule, a capital must be lawful. Every response reports modelCalls truthfully; with no key it is always 0. The prefill contract is deliberately boring: plain JSON in a ?prefill= query parameter, URL-encoded, so the browser extension, a script, or any other tool can construct it without fighting the form.
GET · POST /api/v1/fees
Incorporation and filing fees
Send
State or Union Territory, authorised capital, entity type and whether it is a small company. GET enumerates the jurisdictions covered.
Returns
Four separate levies with the working and the citation for each, a government subtotal, a market range kept separate from it, and the next rupee of authorised capital that changes the total.
Notes
Never returns one number. `components` is an array and stays an array: a caller that wants a single total has to make that choice and own it. All 35 States and UTs in MCA’s own e-stamp schedule are covered; anything outside returns not-covered rather than an estimate.
GET /api/v1/forms
The form catalogue
Send
Optional slug, query, service family or depth filter.
Returns
Every entry in MCA’s service navigation with its plain name, form code, official source, and the depth to which this product actually knows it — computed, reviewed or name-only. Companies Act 1956 forms carry what replaced them.
Notes
The coverage counts are returned with every list response, so a page cannot render a larger claim than the data supports.
GET /api/v1/master-data
Public register lookup
Send
A query: part of a name, a director, a DIN or a CIN.
Returns
Master data for the matching synthetic companies, their signatories, and what was filed against what was due.
Notes
Open, like the real register. It publishes what was FILED and never what is OWED — the money is computed on the signed-in surface, for your own companies only.
POST · GET · PATCH /api/v1/names
Name reservation
Send
A proposed name and what it is for. Add apply:true to hold it against your account.
Returns
The rule 8A identity test with the normalised form it was compared as, the rule 8B restrictions it tripped, and — when applied — the reservation with its 15-day resubmission window and its validity clock.
Notes
Checking is open and stores nothing. Every result states what it did NOT check: the trade marks register is a statutory part of the test and is not reachable from here.
GET /api/v1/inbox
Account notices
Send
Optional asOf.
Returns
What still needs doing, and the record of what happened — including the deadlines that ran out and any relief about to close.
Notes
Derived on read from the filing and reservation timestamps plus the circulars in force. No events table exists, so a notice cannot go missing because something failed to write it.
GET /api/v1/circulars
The circular override layer
Send
Nothing.
Returns
Every circular held in KV, and the subset in force on a given date, with what each one moves or waives.
Notes
Rules as data. The exposure engine takes these as an input rather than hard-coding a date, which is why a due date that moved by circular can be reconstructed later.
GET /api/v1/storage
Live binding shape
Send
Nothing.
Returns
Table names, row counts and KV key counts from the live D1 and KV bindings.
Notes
Shape and counts only, never row contents — the rows are what people typed about their own businesses.
POST · GET /mcp
MCP server
Send
JSON-RPC: initialize, tools/list, tools/call.
Returns
Four read-only tools over the same engines, discoverable at /.well-known/mcp.json.
Notes
No tool accepts a CIN, DIN or PAN — there is nowhere to put one. The self-test walks every schema for identifier-shaped fields and fails the build if one appears.
POST /api/v1/workspaces
Guest workspace
Send
A synthetic venture profile.
Returns
A workspace id, a rule-based entity comparison with the rule version, and an ordered journey.
Notes
Owned by an HTTP-only guest session cookie. Another session cannot read it.
GET /api/v1/workspaces/:id
Workspace state
Send
The workspace id, with the owning session cookie.
Returns
The stored profile, recommendation, rule version and every journey node with its status and sources.
Notes
Node status is updated through /nodes/:nodeId on the same resource.
Codex and OpenAI, exactly where they are
This prototype runs on OpenAI's Codex sites scaffold — the app is served by @openai/sites-vite-plugin and carries the scaffold's hosting configuration. Codex worked as the build tool across the project: scaffolding the fifty routes, drafting the pure rules engines, writing the separate ingest Worker that snapshots the company register, and producing the training deck and walkthrough under /learning.
The discipline that made that usable is the part worth stating. Every AI-drafted rule was pinned by a hand-written assertion before it shipped — twenty-one suites run on every build, and two of the bugs they caught were ones reading the code would not have found: the payment window that closed before the upload happened, and a lapsed SRN that permanently blocked filing a fresh one. Both were generated logic that looked correct and was not. A figure a founder acts on has to be reproducible, not plausible.
Where a model actually runs at runtime, measured rather than asserted. Two places, and neither writes a legal figure. The intake agent (/api/v1/agent) uses gpt-4.1-mini through an OpenAI-compatible gateway to read a free-text sentence into form slots; POST it a sentence today and the response reports "modelCalls": 1. The course tutor on /learning/course is the other. Everything the model proposes re-enters through the same validators the typed path uses, and every response reports its own modelCalls count truthfully — including when that count is not zero, which it no longer is.
The rule in one line: the model proposes, the engine validates, the human confirms. Legal content — due dates, fees, refusals, citations — never touches a model. That is a claim you can audit rather than take: agent health reads the trace table live and counts ungrounded_figures, which is the number of figures the tutor stated that no tool produced. It is public and read-only for the same reason /storage is — a claim about not inventing numbers should be checkable by the person reading it, not vouched for by the people who wrote it.
What this layer will never do
It does not bypass login, CAPTCHA, payment, digital signature or statutory submission controls, and it does not submit anything to MCA. API Setu and DigiLocker access is subject to the provider’s onboarding, use case, agreements and approval; synthetic identities are used until authorised access is granted in writing.
Try the exposure endpointcurl -X POST /api/v1/compliance -H "Content-Type: application/json" -d '{"entity":"private","incorporationDate":"2020-04-01","financialYearEnd":"2025-03-31","directors":2,"asOf":"2026-08-23","commencedBusiness":true,"hasDeposits":false,"hasMsmeDues":false}'