SiteFinderAI API

Vending machine locations simplified for developers and AI agents: request ranked, callable Australian sites over a metered REST API with per-account lookup quotas, rate limits and idempotency.

How billing works
The API draws on the same meter as the app — no separate balance.

One site returned = one lookup. A request that returns 20 sites consumes 20 lookups from your monthly plan allowance, then from any purchased top-up bundles.

Free endpoints. /usage, /coverage and /sites/{siteId} never consume lookups.

Paid seats only. API keys require an active subscription; trial accounts are app-only.

Failed calls are free. Errors and upstream failures are never charged.

Try it in the console

Set the parameters you want, copy the ready-made request, and see the quota impact and response shape before you spend a single lookup. Our Ai Bot "Fredie Finder" restricts every search to Australia, so results never drift offshore.

Interactive console
Build a request, see what it would cost in lookups, and preview the response shape. This console is illustrative — it does not call the live API and consumes no lookups. No key is needed here, and you should never paste a real key into a browser page.
Quota impact
Up to 20 lookups — one per site returned. Plan allowance is used first, then top-up bundles. Errors and 0-result runs are free.

Generated request

curl -X POST https://sitefinderai.com/api/public/v1/site-search \
  -H "Authorization: Bearer $SITEFINDER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: ipswich-qld-combo-001" \
  -d '{ "location": "Ipswich QLD", "machineType": "combo", "collarType": "blue_collar", "radiusM": 500, "limit": 20 }'

$SITEFINDER_API_KEY stays a placeholder on purpose — run this from your server or terminal with the key in an environment variable, never from browser code.

Example response

{
  "requestId": "sample-request-id",
  "machineType": "combo",
  "location": {
    "query": "Ipswich QLD"
  },
  "lookupsCharged": 4,
  "lookupsRemaining": "<your remaining balance>",
  "sites": [
    {
      "id": "sample-1",
      "name": "Sample — Riverside Cold Storage",
      "address": "Industrial estate, Ipswich QLD",
      "category": "Distribution centre",
      "collarType": "blue_collar",
      "hours": "Mon–Sat, 5am–10pm",
      "staffEstimate": "80–120 across two shifts",
      "competitors": {
        "count": 0,
        "nearestM": null,
        "mix": "No coffee, takeaway or convenience outlet inside 500 m"
      },
      "opportunityScore": 94,
      "opportunityTier": "hot",
      "pitchSummary": "Nothing to eat or drink within 500 m. Every break turns into a drive off site and paid time the business does not get back — the strongest wage-loss pitch you can open with."
    },
    {
      "id": "sample-2",
      "name": "Sample — Northgate Precision Engineering",
      "address": "Light industrial, Ipswich QLD",
      "category": "Factory / workshop",
      "collarType": "blue_collar",
      "hours": "Mon–Fri, 6am–4pm",
      "staffEstimate": "35–60",
      "competitors": {
        "count": 1,
        "nearestM": 420,
        "mix": "1 convenience store at 420 m; no cafés"
      },
      "opportunityScore": 81,
      "opportunityTier": "hot",
      "pitchSummary": "One convenience store a 420 m walk away. An on-site combo machine still saves the round trip and captures the afternoon top-up."
    },
    {
      "id": "sample-3",
      "name": "Sample — Meridian Business Park, Tower 2",
      "address": "Suburban office park, Ipswich QLD",
      "category": "Corporate office",
      "collarType": "blue_collar",
      "hours": "Mon–Fri, 7am–7pm",
      "staffEstimate": "150+ across tenancies",
      "competitors": {
        "count": 3,
        "nearestM": 260,
        "mix": "2 cafés, 1 takeaway inside 500 m"
      },
      "opportunityScore": 64,
      "opportunityTier": "warm",
      "pitchSummary": "Cafés close by, so lead with convenience and after-hours cover: the machine serves early starters, late finishers and the floors that never leave the building."
    },
    {
      "id": "sample-4",
      "name": "Sample — Harbour View Bowls Club",
      "address": "Coastal town, Ipswich QLD",
      "category": "Club / RSL",
      "collarType": "blue_collar",
      "hours": "7 days, 10am–late",
      "staffEstimate": "12 staff, 300+ members weekly",
      "competitors": {
        "count": 2,
        "nearestM": 340,
        "mix": "1 takeaway, 1 convenience inside 500 m"
      },
      "opportunityScore": 58,
      "opportunityTier": "warm",
      "pitchSummary": "Seven-day trading and member traffic beats headcount here. Pitch a drink and snack combo plus an ATM for the bar."
    }
  ]
}

1. Generate a key

Go to Settings → API access, name the key (for example "Agent tool — production") and optionally set a daily lookup cap for that key. The full secret is shown once only; only a hash is stored. Revoke a key any time and it stops working immediately.

Authorization: Bearer $SITEFINDER_API_KEY
Content-Type: application/json

Sandbox keys, scopes and the test endpoint

Create a sandbox key (sfa_test_…) in Settings → API access to build and test your integration. Sandbox keys return fixed sample sites, never call Google, never consume a lookup and are exempt from fair-use ceilings and sharing detection — so CI runs and demos cost you nothing. Live keys (sfa_live_…) do real prospecting and meter normally.

Every key carries scopes so you can hand a read-only key to a dashboard and keep search on a server key:

  • sites:search — run prospecting searches and scans (uses lookups on live keys)
  • sites:read — read a site you already have by id
  • usage:read — read plan, quota and rate-limit status

A call outside a key's scopes is refused with 403 before anything is billed. Validate any key — live or test — against the free diagnostic endpoint, which reports mode, scopes, allowlist and rate-limit headers without charging your account:

curl https://sitefinderai.com/api/public/v1/test \
  -H "Authorization: Bearer $SITEFINDER_API_KEY"

Key security events — sharing warnings, automatic or admin revocation and suspected reselling — are delivered as in-app notifications, email alerts and webhooks (api_key_warning, api_key_revoked, suspected_reselling) so your systems can rotate or pause immediately. Add an endpoint in Settings → Webhooks; every delivery is signed with X-SiteFinderAI-Signature.

Key safety and fair use

The examples on this page are only the request format — headers and field names. They contain no secret and no SiteFinderAI code: the site matching, the 500 m competitor scan, the opportunity scoring and the AI pitch notes all run on our servers and are never shipped to your app. A copied snippet does nothing without a live key on a paid seat.

Server-side keys only

Call the API from your backend, agent runtime or automation tool. Never put a key in browser JavaScript, a mobile app bundle, a public repo or a shared notebook — anything in a browser is readable by the visitor.

Store it as an environment variable (SITEFINDER_API_KEY) and rotate it if it ever leaks.

What protects your balance

Keys are hashed at rest and shown once, so a leak of our database cannot expose them.

Each key can carry its own daily lookup cap and an IP allowlist, so a stolen key used from an unknown address is refused outright.

Instant revocation, per-account rate limits and a full audit log of every key action in Settings.

One account, one seat

Keys are tied to your subscription. Sharing a key with another business, or reselling access to the API, is a breach of the terms and ends in revocation without refund.

Extra people need extra seats — that is what team seats are for.

Results are licensed, not sold

Returned sites, scores and pitch notes are licensed for your own prospecting and your own clients. You may not republish them as a competing site-lead database or feed them into a product that resells site lists.

Every request is logged against your key, so bulk scraping patterns are visible to us.

2. Search for sites

POST
/api/public/v1/site-search — "find me 20 blue-collar sites in Ipswich" in one call.

curl -X POST https://sitefinderai.com/api/public/v1/site-search \
  -H "Authorization: Bearer $SITEFINDER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: ipswich-blue-collar-2026-06-01" \
  -d '{
    "location": "Ipswich QLD",
    "machineType": "combo",
    "collarType": "blue_collar",
    "businessCategories": ["warehouse", "factory", "distribution_centre"],
    "radiusM": 500,
    "limit": 20
  }'

Response (trimmed):

{
  "requestId": "8f2c...",
  "location": { "query": "Ipswich QLD", "lat": -27.6146, "lng": 152.7608 },
  "lookupsCharged": 20,
  "lookupsRemaining": 480,
  "sites": [
    {
      "id": "b0d1...",
      "name": "Riverside Cold Storage",
      "address": "12 Kerry Rd, Wacol QLD 4076",
      "suburb": "Wacol",
      "state": "QLD",
      "postcode": "4076",
      "phone": "+61 7 3271 0000",
      "website": "https://example.com.au",
      "category": "distribution_centre",
      "collarType": "blue_collar",
      "hours": "Mon-Sat 05:00-22:00",
      "staffEstimate": { "min": 80, "max": 120 },
      "competitors": {
        "count": 0,
        "nearestM": null,
        "mix": { "coffee": 0, "takeaway": 0, "convenience": 0, "other": 0 }
      },
      "opportunityScore": 94,
      "opportunityTier": "hot",
      "opportunityReasons": [
        "No food or coffee outlet within 500 m",
        "Distribution centre with long shift hours"
      ],
      "pitchSummary": "Nothing to eat or drink within 500 m..."
    }
  ]
}

3. Check usage and quota

GET
/api/public/v1/usage — free, and the endpoint an agent should call before a large batch.

curl https://sitefinderai.com/api/public/v1/usage \
  -H "Authorization: Bearer $SITEFINDER_API_KEY"

{
  "plan": "crew",
  "planLookupsIncluded": 1000,
  "planLookupsUsed": 1020,
  "planLookupsRemaining": 480,
  "topupLookupsRemaining": 100,
  "totalLookupsRemaining": 580,
  "resetsAt": "2026-07-01T00:00:00.000Z",
  "rateLimit": { "perMinute": 60, "perDay": 2000, "remainingToday": 1893 }
}

4. Other endpoints

GET
/api/public/v1/sites/{siteId} — re-fetch a saved site with its confidence breakdown. Free.

GET
/api/public/v1/coverage — supported states, machine types and categories. Free, no key required.

GET
/api/public/v1/openapi.json — machine-readable schema for agent tool registries.

Limits, retries and idempotency

Rate limits
60 requests per minute and 2,000 per day per account, with an additional per-IP ceiling. Exceeding either returns 429 with a Retry-After header.
Idempotency
Send an Idempotency-Key on every search. A repeat of the same key and body replays the stored response without charging lookups again — essential for agent retries.
Per-key caps
Give each key its own daily lookup cap so an experiment or a runaway agent cannot spend the whole month's allowance.

Error codes

HTTPcodeMeaningWhat to do
400invalid_requestBody failed validation — missing location, unknown machine type, limit out of range.Check the message field; it names the offending parameter.
401unauthorizedMissing, malformed, or revoked API key.Send Authorization: Bearer sfa_live_… and confirm the key is still active in Settings.
402quota_exhaustedMonthly plan lookups and top-up balance are both empty.Buy a 100-lookup top-up bundle or wait for the monthly reset date returned by /usage.
402subscription_requiredThe account has no active paid seat (or the trial has ended).Start a subscription on the billing page. Trial accounts cannot use the API.
403key_cap_reachedThis individual key hit its own daily lookup cap.Raise the cap in Settings, or route traffic through another key.
409idempotency_conflictThe same Idempotency-Key was reused with a different request body.Use a fresh key for a new request; reuse it only for retries of the identical body.
429rate_limitedPer-minute, per-day or per-IP request limit exceeded.Honour the Retry-After header and back off exponentially.
503upstream_unavailableThe mapping provider failed or timed out. No lookups are charged.Retry with the same Idempotency-Key after a short delay.

Every error uses the same envelope:

{ "error": { "code": "quota_exhausted", "message": "No lookups remaining.", "retryAfter": null } }

Using it as an AI agent tool

Point your agent framework at the OpenAPI schema and expose siteSearch as a single tool. A prompt like "find me 20 blue-collar sites in Ipswich" maps directly to one call. Two rules keep costs sane:

  • • Call /usage first and refuse the tool call when remaining lookups are lower than the limit.
  • • Always set Idempotency-Key so a retried tool call never double-charges.