This page is for the developer holding a key and wiring an application up to a Tamaat API.
The address
An API made available outside Tamaat answers at its own address: https://api.tamaat.com/«name»/«operation», where the operation is one of autocomplete, geocode, reverse or query. Its OpenAPI document is at https://api.tamaat.com/«name»/openapi.json, and the bare address opens a reference page with a Try it console. The document and the page need no key.
Answers are JSON unless you ask otherwise: send Accept: application/xml for XML, and a Data API also answers Accept: application/geo+json with a feature collection. A request body can be XML too, with Content-Type: application/xml.
An API published through Tamaat Server has a formal address for each environment on the same host: https://api.tamaat.com/«organization»/«environment»/«name»/«operation». The deployment page shows the exact one; take it from there. Once a Production environment serves the API, its regular address is the non-production endpoint, answering the author's keys and the current index, and is labelled so.
Authenticate with your key
Every request carries a key in the x-api-key header. Which kind depends on how the API reaches you:
- An API key (
tmk_…) is issued by the API's author for its own address. A Website key answers only from the websites it lists, a Server key only from the addresses it lists, so use the kind that matches where your calls come from. - A consumer key (
tms_…) is issued under a Server environment, and works in that environment only. If a working integration is rejected right after go-live, you are almost certainly still holding the test key.
A lost key can't be recovered, only replaced. Keep it in your secret manager; a Website key is the one kind made to live in a page.
Rates and allowances
Each key has a requests-per-minute rate set by the author. An organization's plan carries a monthly allowance of outside requests; past it, answers slow down (or stop, on Free) until the period resets, and the response says when with a Retry-After header.
Data query requests
Filter on the parameters the product exposes — the deployment page lists them — and you get JSON rows back carrying the fields its author chose to include.
Address requests
Depending on what the product offers: send partial text for suggestions, a full address to get coordinates, or coordinates to get the nearest address. All responses are JSON. The deployment page shows which operations are available and their paths.
What changes, and when
The behaviour you're integrating against doesn't shift under you when the API's author edits their workspace — it changes only when they publish an update. Watch the deployment's release notes to know when that happens.
Calling it from an AI agent
Products can also be exposed as agent tools, which do the same thing as the endpoints here and use the same keys. See Expose Tools to AI Agents.