The public data API
A versioned, read only path to everything All Business Africa publishes: opportunities, contract awards, buyers, companies, investors and countries with their indicators.
What a key is, and what it is not
A key is not what makes this data reachable. The endpoints behind this website answer without any credential and always have. If you want to check that before reading any further, please do:
curl https://allbusiness.africa/api/indicators/kenyaThat returns 200 with no key, and nothing on this page is going to pretend otherwise.
What a key buys is three things, and all three are real:
A meter of your own
A daily allowance counted against your key rather than against the address you happen to be calling from. Without a key you share one bucket with every other anonymous caller, which is fine until somebody else fills it.
A path that stays still
Inside v1 the paths, the parameters and the response envelope do not change shape. The website’s own endpoints carry no such promise: they exist to serve pages and they change when the pages do.
Somebody to write to
A named contact who can tell you why a field changed, raise your allowance, or confirm a record. An unauthenticated caller is nobody we can find, and so nobody we can warn.
Getting a key
There is no sign up form, and that is deliberate rather than unfinished.
Keys are issued by hand by All Business Africa staff. Write to data@allbusiness.africa and name the project, what you intend to read, and roughly how often. You will be told the daily allowance the key carries before it is issued.
A key is shown once, at the moment it is created, and only a SHA-256 hash of it is stored. Nobody here can read it back to you afterwards. If you lose it, say so and it will be revoked and replaced.
Authentication
Either header. Nothing goes in a query string.
curl -H "Authorization: Bearer aba_YOUR_KEY" \
https://allbusiness.africa/api/public/v1/opportunities?type=tender&country=kenya
curl -H "X-API-Key: aba_YOUR_KEY" \
https://allbusiness.africa/api/public/v1/countries/kenyaA key never goes in a URL. A URL is written into access logs, browser history, referer headers and analytics, and every one of those is a place a credential outlives its request.
Endpoints
Every path below is relative to /api/public/v1. The full document, with every parameter and every response code, is at /api/public/v1/openapi.json.
| Method | Path | What it answers |
|---|---|---|
| GET | / | What the API serves and under what terms. No key needed. |
| GET | /openapi.json | The full OpenAPI 3.1 document. No key needed. |
| GET | /opportunities | Funding calls, tenders and programmes. Filter by type, country, sector, category, status and search. status takes open, closed, closing_soon, closing_month, cancelled, awarded_completed or all. |
| GET | /opportunities/{type}/{slug} | One opportunity, by its type and slug. |
| GET | /contract-awards | The public procurement award archive. |
| GET | /contract-awards/{slug} | One award: who bought what, from whom, for how much. |
| GET | /buyers | The public bodies behind the awards, with totals and categories. |
| GET | /buyers/{slug} | One buyer profile. |
| GET | /companies | The company directory. |
| GET | /companies/{slug} | One company profile. |
| GET | /investors | Capital providers held as records of their own. |
| GET | /investors/{slug} | One investor, with portfolio and geography. |
| GET | /countries | Country profiles. |
| GET | /countries/{slug} | One country, with its World Bank indicator series attached. |
| GET | /countries/{slug}/indicators | Only the indicator series for one country. |
Every list is paginated. ?page= and ?perPage=, capped at 100 a page, answering { items, total, page, perPage, pageCount }. Every response also carries a meta block with your remaining allowance and the attribution requirement, so a client that never reads a header still knows both.
What is served
Published records only. Draft records and deleted records are never serialised. That is not a filter this API applies on top of the data: every route here calls the same code the website calls, so there is no second set of visibility rules that could drift from the first and start letting something through.
The same fields the website shows. Where the platform withholds a field from a reader who is not signed in, this API withholds it too, names it in a paywall block on the record, and says what would unlock it. An API that handed over what the site withholds would be a way around the site, and that is not what is being sold here.
No writes. There is no POST, PUT, PATCH or DELETE anywhere under /api/public/v1. Corrections go through the contact form and are reviewed by the editorial team, the same as any other record.
Scopes
A key may be issued for everything, or for named resources only. Ask for what you need.
opportunities
Funding, tenders and programmes.
contract-awards
The procurement award archive.
buyers
Public bodies that award contracts.
companies
The company directory.
investors
Capital providers.
countries
Country profiles and indicators.
A key asking for a resource outside its scope is answered 403, and the message names the scopes the key does carry.
Limits
Each key carries a daily allowance, counted in requests, resetting at midnight UTC. The number is set per key when the key is issued and can be raised. Every response carries where you stand:
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 863
X-RateLimit-Reset: 1755734400
X-RateLimit-Reset-At: 2026-08-21T00:00:00.000ZWhen the allowance is spent the answer is 429 with Retry-After, and the body names the moment it comes back rather than leaving you to guess:
{
"statusCode": 429,
"error": "Too Many Requests",
"message": "Key aba_1a2b3c4d has used all 1000 requests in its daily allowance. The allowance resets at 2026-08-21T00:00:00.000Z, which is 6 hours and 12 minutes from now. Nothing was read, and this refused request was not counted against the allowance. A larger daily allowance is set per key by All Business Africa staff: write to data@allbusiness.africa.",
"limit": 1000,
"resetsAt": "2026-08-21T00:00:00.000Z",
"retryAfterSeconds": 22320
}A refused request is not counted against the allowance. You are not billed for being told no.
Attribution
Anything published from this API must name All Business Africa as the source and link to allbusiness.africa. Where a record carries its own source, that source must be named too: this platform aggregates public notices and does not replace the body that issued them.
The requirement is repeated in the meta block of every single response, so it cannot be something an integration never saw. Terms of use are in the Terms of Service.
Need a key?
Tell us the project, what you want to read, and roughly how often.