The c:node Contract API delivers answers, legal provisions and public administration services with source, licence and verification status. You call it via REST or plug it into Claude, Copilot and your own agents directly via MCP.
The Contract API is the public interface to the c:node Graph. Every answer is built so that you can verify it: it names the source (ref), the verification status (grounding), the licence and, where required, the attribution of the data source.
| Field | Meaning |
|---|---|
ref | Standard reference of the source, e.g. ELI:BSIGesetz§10, CELEX:32024R1689 or XZUFI:S1000030000000045. |
grounding | Verification status against the cited passage, e.g. verified. |
license | Licence class of the source: open, attribution or internal. |
attributions | Mandatory attributions (source, licence, URL) for the data delivered. |
citations · factscore | For /v1/ask: verified sources only, plus a verdict per statement (belegt = evidenced or offen = open) and the share of evidenced statements. |
content_hash | For provenance records: SHA-256 over the content, for logging under EU AI Act Art. 12. |
The complete machine-readable specification is available at /openapi.json.
The first two calls work against the sandbox without a key. For knowledge endpoints you need a Contract key.
Send your Contract key in the X-API-Key header. The query parameter ?key= is also accepted, but ends up in logs and browser histories more easily – only use it where a header is not possible.
public-observatory): graph overview, provenance, audit and attributions./v1/ask, /v1/legal, /v1/leistung and /v1/betroffenheit.Every key is bound to a profile. The profile defines which licence classes and knowledge domains an answer may use – the models only see what your profile allows. GET /v1/profiles lists them live.
| Profile | Purpose | Key |
|---|---|---|
public-observatory | Public sandbox: graph overview and provenance. | no |
trial | Trial access for evaluation. | yes |
free-market | Market knowledge (markets, trade, investment, public finances). | yes |
research-open | Research partners: research and innovation. | yes |
de-federal | German federal data space, full access. | yes |
commercial-full | Commercial full access (excluding non-commercial sources). | yes |
The c:node MCP server exposes the Contract API as tools. The model writes, c:node delivers the evidenced basis: ask Claude for a legal basis and it calls cnode_ask and answers with a source.
Add to .vscode/mcp.json. Copilot asks for the key on first start and does not store it in the project:
Any MCP client with Streamable HTTP works: URL https://mcp.c-node.ai/mcp, key in the X-API-Key header or as Authorization: Bearer <key>. Usage and profile then run through your own key. In on-prem deployments the MCP server runs in your environment and talks to your own Contract API.
| Tool | What it does | Endpoint |
|---|---|---|
cnode_ask | Evidenced answer to a question, every statement with a source. | GET /v1/ask |
cnode_legal | Section by reference, all sections of a law or full-text search. | GET /v1/legal |
cnode_leistung | Public administration service with its legal basis. | GET /v1/leistung |
cnode_dossier | Hash-chained application dossier. Prepares, triggers nothing. | POST /v1/dossier |
cnode_brain_preview | Company Brain from a domain, without storing. | GET /v1/demo/brain/stream |
cnode_brain_bootstrap | Build and store the Company Brain for your tenant. | POST /v1/brain/bootstrap |
cnode_findings | Current findings for your tenant, each with evidence. | GET /v1/findings |
cnode_health · cnode_profiles | Connection check and the profiles of your key. | GET /v1/health · /v1/profiles |
The c:node shell is open core: interface, chat and graph runtime run via Docker on your machine or server. For local answers an open model via Ollama is enough – or you bring your own API key.
The shell then runs at http://localhost:3010 and the API at http://localhost:8080. The scope of the open core, tenant configuration and the commercial licence are described in the README on GitHub.
Evidenced answers and legal sources. All endpoints here require a Contract key.
Answers a question exclusively from the concepts your profile allows. Citations come only from verified references. If c:node finds no evidence, the answer says so instead of guessing.
| Parameter | Description |
|---|---|
q | The question in natural language (min. 3 characters). Required. |
k | Number of concepts the answer draws on (1–20, default 6). |
Without evidence: "grounded": false and the answer “That is not (yet) in the knowledge graph.” Statements without support receive the verdict offen (open).
Same parameters and verification as /v1/ask. The response arrives as server-sent events: token events with text chunks, then a done event with citations, verdict and factscore, and finally [DONE].
One section by reference, all sections of a law or a full-text search. One of the three parameters is required.
| Parameter | Description |
|---|---|
ref | Exact reference, e.g. ELI:BSIGesetz§1. |
law | Name of the law, e.g. BSIGesetz – returns its sections. |
q | Full-text search (all terms must appear). |
limit · offset | Pagination (1–500, default 50). If there are more hits, next_offset is included in the response. |
Public administration services from XZuFi/LeiKa (German service catalogues). rechtsgrundlagen (legal bases) only contains links to laws that are in the c:node Graph – nothing is guessed. Parameters: ref or q, plus limit/offset.
Records for traceability: where a statement comes from, whom a legal act affects, and which sources must be attributed. With Try it you call the sandbox live.
Returns the verification status, licence, an uncertainty statement and a content hash for a reference – built for logging under EU AI Act Art. 12. Parameter: ref.
Links an EU legal act to the affected sectors and companies from the commercial register. Parameter: act, e.g. ArtificialIntelligenceAct.
Extends /v1/audit with the region: law → sector → affected companies → federal state → regional indicators (GDP, unemployment rate, income). Every derived figure carries its evidence chain. Parameters: act (optional), limit (1–100).
Assembles a verifiable dossier from application fields: every field with its source, the eIDAS trust verdict on the seal and a tamper-proof hash chain. If the application names a service without legal bases, c:node adds them from the graph. Responses contain personal data and are not cached.
All data sources of your profile with licence and URL – for your imprint, source list or export.
A domain becomes an evidenced company profile: c:node reads the public pages, checks the imprint and commercial register, anchors the company in its sector and delivers findings on regulation and open public tenders – each with a source.
The public preview: streams the run for a domain, stores nothing. Limited per IP and day; the result for a domain is cached for 24 hours and replayed. Parameter: domain, e.g. firma.de.
Event types in this order: step, page, feed, impressum, register, profile, anchor, finding, done (on errors error), terminated by [DONE].
Runs the full process and stores profile, pages and findings in your tenant graph. Afterwards /v1/ask and /v1/findings know your company. Body: {"domain": "firma.de"}. Time limit 90 seconds (504 if exceeded).
As a stream: GET /v1/brain/stream?domain=… delivers the same events as the preview and stores at the end.
The proactive findings from the last run: regulation, public tenders, registers and sector context, each with evidence. If there has been no run yet, findings is empty and hint names the next step.
Writes a document or note into your private tenant graph. The entry can be answered immediately via /v1/ask. The c:node Graph itself remains unchanged.
Fields: title or label, text or content, optionally source and ref.
Shows your current per-minute quota and usage: answers delivered, of which billable, ingests and the average factscore.
Concepts, relations, domains and verification rate of the graph your profile sees.
Errors are returned as JSON with a detail field.
| Status | Meaning |
|---|---|
400 | Parameter missing, e.g. /v1/legal without ref, law or q. |
401 | Missing or invalid key for an endpoint that requires a Contract key. |
403 | Key valid, but without a tenant (Company Brain, findings, ingest). |
404 | Reference or legal act not in the graph. |
429 | Rate limit reached. Wait the number of seconds given in the Retry-After header. |
503 | Answer generation is currently at capacity. Retry after Retry-After. |
504 | Brain run exceeded the time limit. |
Every /v1 call except /v1/health is rate-limited per client; /v1/usage shows your current quota. Only a pseudonymous client ID, the path and the status are logged – no content.