SiteFinderAI API
Vending machine locations simplified for developers and AI agents: request ranked, callable Australian sites over a metered REST API with per-account lookup quotas, rate limits and idempotency.
These snippets are request formats only — never paste a real key into a web page
Every example below shows headers and field names with $SITEFINDER_API_KEY as a placeholder. The "Safe copy" buttons strip any secret-looking value before it reaches your clipboard, so nothing you copy from this page can leak a live key. Keep keys on your server, in an environment variable.
Keys are watched for sharing: use from 4 or more separate networks in 24 hours triggers a warning, and 8 or more revokes the key automatically with an email and in-app notice. Pin a key to an IP allowlist in Settings if your traffic legitimately moves around.
One site returned = one lookup. A request that returns 20 sites consumes 20 lookups from your monthly plan allowance, then from any purchased top-up bundles.
Free endpoints. /usage, /coverage and /sites/{siteId} never consume lookups.
Paid seats only. API keys require an active subscription; trial accounts are app-only.
Failed calls are free. Errors and upstream failures are never charged.
Try it in the console
Set the parameters you want, copy the ready-made request, and see the quota impact and response shape before you spend a single lookup. Our Ai Bot "Fredie Finder" restricts every search to Australia, so results never drift offshore.
Generated request
curl -X POST https://sitefinderai.com/api/public/v1/site-search \
-H "Authorization: Bearer $SITEFINDER_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: ipswich-qld-combo-001" \
-d '{ "location": "Ipswich QLD", "machineType": "combo", "collarType": "blue_collar", "radiusM": 500, "limit": 20 }'$SITEFINDER_API_KEY stays a placeholder on purpose — run this from your server or terminal with the key in an environment variable, never from browser code.
Example response
{
"requestId": "sample-request-id",
"machineType": "combo",
"location": {
"query": "Ipswich QLD"
},
"lookupsCharged": 4,
"lookupsRemaining": "<your remaining balance>",
"sites": [
{
"id": "sample-1",
"name": "Sample — Riverside Cold Storage",
"address": "Industrial estate, Ipswich QLD",
"category": "Distribution centre",
"collarType": "blue_collar",
"hours": "Mon–Sat, 5am–10pm",
"staffEstimate": "80–120 across two shifts",
"competitors": {
"count": 0,
"nearestM": null,
"mix": "No coffee, takeaway or convenience outlet inside 500 m"
},
"opportunityScore": 94,
"opportunityTier": "hot",
"pitchSummary": "Nothing to eat or drink within 500 m. Every break turns into a drive off site and paid time the business does not get back — the strongest wage-loss pitch you can open with."
},
{
"id": "sample-2",
"name": "Sample — Northgate Precision Engineering",
"address": "Light industrial, Ipswich QLD",
"category": "Factory / workshop",
"collarType": "blue_collar",
"hours": "Mon–Fri, 6am–4pm",
"staffEstimate": "35–60",
"competitors": {
"count": 1,
"nearestM": 420,
"mix": "1 convenience store at 420 m; no cafés"
},
"opportunityScore": 81,
"opportunityTier": "hot",
"pitchSummary": "One convenience store a 420 m walk away. An on-site combo machine still saves the round trip and captures the afternoon top-up."
},
{
"id": "sample-3",
"name": "Sample — Meridian Business Park, Tower 2",
"address": "Suburban office park, Ipswich QLD",
"category": "Corporate office",
"collarType": "blue_collar",
"hours": "Mon–Fri, 7am–7pm",
"staffEstimate": "150+ across tenancies",
"competitors": {
"count": 3,
"nearestM": 260,
"mix": "2 cafés, 1 takeaway inside 500 m"
},
"opportunityScore": 64,
"opportunityTier": "warm",
"pitchSummary": "Cafés close by, so lead with convenience and after-hours cover: the machine serves early starters, late finishers and the floors that never leave the building."
},
{
"id": "sample-4",
"name": "Sample — Harbour View Bowls Club",
"address": "Coastal town, Ipswich QLD",
"category": "Club / RSL",
"collarType": "blue_collar",
"hours": "7 days, 10am–late",
"staffEstimate": "12 staff, 300+ members weekly",
"competitors": {
"count": 2,
"nearestM": 340,
"mix": "1 takeaway, 1 convenience inside 500 m"
},
"opportunityScore": 58,
"opportunityTier": "warm",
"pitchSummary": "Seven-day trading and member traffic beats headcount here. Pitch a drink and snack combo plus an ATM for the bar."
}
]
}1. Generate a key
Go to Settings → API access, name the key (for example "Agent tool — production") and optionally set a daily lookup cap for that key. The full secret is shown once only; only a hash is stored. Revoke a key any time and it stops working immediately.
Authorization: Bearer $SITEFINDER_API_KEY
Content-Type: application/jsonSandbox keys, scopes and the test endpoint
Create a sandbox key (sfa_test_…) in Settings → API access to build and test your integration. Sandbox keys return fixed sample sites, never call Google, never consume a lookup and are exempt from fair-use ceilings and sharing detection — so CI runs and demos cost you nothing. Live keys (sfa_live_…) do real prospecting and meter normally.
Every key carries scopes so you can hand a read-only key to a dashboard and keep search on a server key:
sites:search— run prospecting searches and scans (uses lookups on live keys)sites:read— read a site you already have by idusage:read— read plan, quota and rate-limit status
A call outside a key's scopes is refused with 403 before anything is billed. Validate any key — live or test — against the free diagnostic endpoint, which reports mode, scopes, allowlist and rate-limit headers without charging your account:
curl https://sitefinderai.com/api/public/v1/test \
-H "Authorization: Bearer $SITEFINDER_API_KEY"Key security events — sharing warnings, automatic or admin revocation and suspected reselling — are delivered as in-app notifications, email alerts and webhooks (api_key_warning, api_key_revoked, suspected_reselling) so your systems can rotate or pause immediately. Add an endpoint in Settings → Webhooks; every delivery is signed with X-SiteFinderAI-Signature.
Key safety and fair use
The examples on this page are only the request format — headers and field names. They contain no secret and no SiteFinderAI code: the site matching, the 500 m competitor scan, the opportunity scoring and the AI pitch notes all run on our servers and are never shipped to your app. A copied snippet does nothing without a live key on a paid seat.
Call the API from your backend, agent runtime or automation tool. Never put a key in browser JavaScript, a mobile app bundle, a public repo or a shared notebook — anything in a browser is readable by the visitor.
Store it as an environment variable (SITEFINDER_API_KEY) and rotate it if it ever leaks.
Keys are hashed at rest and shown once, so a leak of our database cannot expose them.
Each key can carry its own daily lookup cap and an IP allowlist, so a stolen key used from an unknown address is refused outright.
Instant revocation, per-account rate limits and a full audit log of every key action in Settings.
Keys are tied to your subscription. Sharing a key with another business, or reselling access to the API, is a breach of the terms and ends in revocation without refund.
Extra people need extra seats — that is what team seats are for.
Returned sites, scores and pitch notes are licensed for your own prospecting and your own clients. You may not republish them as a competing site-lead database or feed them into a product that resells site lists.
Every request is logged against your key, so bulk scraping patterns are visible to us.
2. Search for sites
/api/public/v1/site-search — "find me 20 blue-collar sites in Ipswich" in one call.curl -X POST https://sitefinderai.com/api/public/v1/site-search \
-H "Authorization: Bearer $SITEFINDER_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: ipswich-blue-collar-2026-06-01" \
-d '{
"location": "Ipswich QLD",
"machineType": "combo",
"collarType": "blue_collar",
"businessCategories": ["warehouse", "factory", "distribution_centre"],
"radiusM": 500,
"limit": 20
}'Response (trimmed):
{
"requestId": "8f2c...",
"location": { "query": "Ipswich QLD", "lat": -27.6146, "lng": 152.7608 },
"lookupsCharged": 20,
"lookupsRemaining": 480,
"sites": [
{
"id": "b0d1...",
"name": "Riverside Cold Storage",
"address": "12 Kerry Rd, Wacol QLD 4076",
"suburb": "Wacol",
"state": "QLD",
"postcode": "4076",
"phone": "+61 7 3271 0000",
"website": "https://example.com.au",
"category": "distribution_centre",
"collarType": "blue_collar",
"hours": "Mon-Sat 05:00-22:00",
"staffEstimate": { "min": 80, "max": 120 },
"competitors": {
"count": 0,
"nearestM": null,
"mix": { "coffee": 0, "takeaway": 0, "convenience": 0, "other": 0 }
},
"opportunityScore": 94,
"opportunityTier": "hot",
"opportunityReasons": [
"No food or coffee outlet within 500 m",
"Distribution centre with long shift hours"
],
"pitchSummary": "Nothing to eat or drink within 500 m..."
}
]
}3. Check usage and quota
/api/public/v1/usage — free, and the endpoint an agent should call before a large batch.curl https://sitefinderai.com/api/public/v1/usage \
-H "Authorization: Bearer $SITEFINDER_API_KEY"
{
"plan": "crew",
"planLookupsIncluded": 1000,
"planLookupsUsed": 1020,
"planLookupsRemaining": 480,
"topupLookupsRemaining": 100,
"totalLookupsRemaining": 580,
"resetsAt": "2026-07-01T00:00:00.000Z",
"rateLimit": { "perMinute": 60, "perDay": 2000, "remainingToday": 1893 }
}4. Other endpoints
/api/public/v1/sites/{siteId} — re-fetch a saved site with its confidence breakdown. Free./api/public/v1/coverage — supported states, machine types and categories. Free, no key required./api/public/v1/openapi.json — machine-readable schema for agent tool registries.Limits, retries and idempotency
Retry-After header.Idempotency-Key on every search. A repeat of the same key and body replays the stored response without charging lookups again — essential for agent retries.Error codes
| HTTP | code | Meaning | What to do |
|---|---|---|---|
| 400 | invalid_request | Body failed validation — missing location, unknown machine type, limit out of range. | Check the message field; it names the offending parameter. |
| 401 | unauthorized | Missing, malformed, or revoked API key. | Send Authorization: Bearer sfa_live_… and confirm the key is still active in Settings. |
| 402 | quota_exhausted | Monthly plan lookups and top-up balance are both empty. | Buy a 100-lookup top-up bundle or wait for the monthly reset date returned by /usage. |
| 402 | subscription_required | The account has no active paid seat (or the trial has ended). | Start a subscription on the billing page. Trial accounts cannot use the API. |
| 403 | key_cap_reached | This individual key hit its own daily lookup cap. | Raise the cap in Settings, or route traffic through another key. |
| 409 | idempotency_conflict | The same Idempotency-Key was reused with a different request body. | Use a fresh key for a new request; reuse it only for retries of the identical body. |
| 429 | rate_limited | Per-minute, per-day or per-IP request limit exceeded. | Honour the Retry-After header and back off exponentially. |
| 503 | upstream_unavailable | The mapping provider failed or timed out. No lookups are charged. | Retry with the same Idempotency-Key after a short delay. |
Every error uses the same envelope:
{ "error": { "code": "quota_exhausted", "message": "No lookups remaining.", "retryAfter": null } }Using it as an AI agent tool
Point your agent framework at the OpenAPI schema and expose siteSearch as a single tool. A prompt like "find me 20 blue-collar sites in Ipswich" maps directly to one call. Two rules keep costs sane:
- • Call
/usagefirst and refuse the tool call when remaining lookups are lower than the limit. - • Always set
Idempotency-Keyso a retried tool call never double-charges.