API documentation
BuildRules exposes a read-only public index of cited municipal permit answers, plus an endpoint for explicitly consented project enquiries. Neither endpoint grants permits, validates a property or determines legal compliance.
OpenAPI specification ยท API catalog
Read cited permit guidance
GET https://buildrules.ca/api/public/permit-answers
Anonymous and read-only. Returns reviewed, published city/project answers with links to original municipal sources. Current data in this endpoint is Ontario-focused. National address entry on the main site does not imply verified permit-answer coverage everywhere in Canada.
Optional query filters: city (for example, toronto) and project (for example, deck-permit). Both filters are lowercase slugs containing letters, digits and hyphens. Missing guidance returns an empty set, not permission to build.
Response: 200 with count, entries, resourceGuides, and source review dates; 400 on an invalid filter; 429 when a Cloudflare native read quota applies; 503 if the published-data service is temporarily unavailable. Each error has a JSON error string.
When running behind Cloudflare, the read endpoint has an approximate per-IP, per-location threshold of 120 requests per 60 seconds. The RateLimit-Policy header is sent only when the native quota was enforced. On 429, follow Retry-After. Per-location quotas may exceed the published threshold and do not publish a global remaining-request counter. The read endpoint sends API-Version: 1.
Every answer must be interpreted alongside its municipality, source URLs, scope and review date. No addresses or parcel decisions are exposed by this API.
Submit a project request
POST https://buildrules.ca/api/leads
Content-Type: application/json
No API key is required. Obtain the person's explicit consent before submitting their name or email. This endpoint saves a request and can trigger follow-up. Do not submit invented contact details or use it for health checks.
| Field | Requirement |
|---|---|
name | Required non-empty name. Trimmed and truncated to 120 characters. |
email | Required email. Trimmed, lowercased and truncated to 200 characters before validation. |
consent | Must reflect the person's explicit consent. |
phone | Optional phone number. Trimmed and truncated to 40 characters. |
project | Optional project label, trimmed and truncated to 120 characters. Used to derive a slug when projectSlug is empty. |
projectSlug | Optional slug, lowercased, restricted to letters, digits and hyphens and truncated to 120 characters. |
jurisdiction | Optional slug, sanitized like projectSlug. Defaults to toronto when empty. |
intent | Required. One of professional_help, permit_designer, contractor_quote, structural_engineer, application_help, or other_professional_help. |
website | Spam honeypot. Omit or leave empty. Non-empty values return ok without storing a request. |
Responses
| Status | Meaning |
|---|---|
| 200 | {"ok":true,"saved":true} means stored; saved:false acknowledges a honeypot without storing it. |
| 400 | Invalid JSON or submission. A supported intent, name, valid email and explicit consent are required. |
| 429 | Submission rate limited; follow the Retry-After header when provided. |
| 500 | Request could not be saved. |
| 503 | Request backend is not configured. |
Error responses contain a JSON error string, documented in the OpenAPI ApiError model. Only POST is supported for project submissions. There is no public API to read, update or delete personal enquiries, and no published health endpoint.
Access and stability: Public reading needs no API key. The project request endpoint requires explicit user consent. These endpoints currently use unversioned paths; no automatic delegated OAuth, agent accounts or formal backward-compatibility/deprecation window is promised. See authentication limits and agent usage guidance.
Consult the privacy policy before submitting personal information.