Evidence with an explicit contract.

Contract gf-customer-v1. API responses are versioned; access comes from the server, not a page flag.

Public versus paid

GET /data/summary.json returns public counts by state and label, with no record rows. All paid tiers retain account-scoped GET /api/cliffs and GET /api/export.csv. National additionally has bearer-only /api/v1 reads, retained snapshot history and exports. No cookie fallback grants bearer API access.

National reads

Supply Authorization: Bearer YOUR_KEY from your own secure integration. Never put a key in a URL, screenshot or public file. Create, rotate and revoke keys in your account; raw keys are shown once.

Pagination and errors

List responses contain schema_version, snapshot_id, source_status, items and next_cursor. Use the returned cursor unchanged. It pins an immutable snapshot and query/scope identity. An empty items array differs from unavailable data.

Limits are 1 to 100 rows, default 50. The current contract limits reads to 60 per minute per key plus an account aggregate. A 429 includes Retry-After. Errors have error.code and a safe error.message: invalid_request400, unauthenticated401, forbidden403, not_found404, conflict409, expired410, rate_limited429, provider_error502 and unavailable503.

CSV safety and lineage

CSV preserves numeric zero, leaves null empty, quotes fields and neutralizes formula-like strings. Keep the requested snapshot and source citation with any downstream analysis. A source award value is not a measure of lost funding.

Signed webhooks

All paid tiers retain webhook capability. Verify X-Grantfall-Id, X-Grantfall-Timestamp, X-Grantfall-Secret-Version and X-Grantfall-Signature. Compute HMAC-SHA256 over timestamp + '.' + the exact raw JSON bytes, enforce a 300-second window and deduplicate delivery_id. Retries retain the same payload identity with a fresh signature. A blocked_egress endpoint is not delivering.

Manage API and exportsManage webhooks