# IndiAndes public API

The IndiAndes website exposes a narrow browser API for its consented inquiry
form and a public health check. Full developer documentation, including a
quickstart and the complete error-code table, is at
`https://indiandes.com/developers`.

## Discovery

- Developer portal: `https://indiandes.com/developers`
- OpenAPI description: `https://indiandes.com/openapi.json`
- API catalog: `https://indiandes.com/.well-known/api-catalog`
- Agent index (llms.txt): `https://indiandes.com/llms.txt`
- Agent skills: `https://indiandes.com/.well-known/agent-skills/index.json`
- Health: `GET https://indiandes.com/api/health`

## Health

`GET https://indiandes.com/api/health` returns
`{"status":"ok","service":"indiandes.com"}`. It needs no key, allows any
origin, and is the endpoint to exercise while building an integration.

## Contact inquiries

`POST https://indiandes.com/api/contact` accepts the website's inquiry form.
The request must use JSON, originate from an approved IndiAndes website origin,
include the fields described by the OpenAPI document, and pass the service's
anti-abuse checks.

This endpoint creates a business lead and can trigger an email notification.
Agents must not submit it without the user's explicit approval. Server-to-server
agents should direct the user to `https://indiandes.com/en/contact` or
`https://indiandes.com/es/contacto` instead of bypassing the website's consent
and origin controls.

Successful submissions return HTTP `202 Accepted`.

## Errors

Every `4xx` and `5xx` response under `/api/` is an RFC 9457 problem document
served as `application/problem+json`:

```json
{
  "type": "https://indiandes.com/developers#invalid-fields",
  "title": "One or more fields are invalid",
  "status": 422,
  "detail": "A required field is missing, malformed, or outside its allowed values.",
  "code": "invalid_fields",
  "hint": "Validate the body against the ContactInquiry schema in https://indiandes.com/openapi.json.",
  "documentation": "https://indiandes.com/developers",
  "instance": "/api/contact",
  "error": "invalid_fields"
}
```

`code` is the stable machine-readable identifier; `error` repeats it and is
kept only for the website's original clients. The full enumeration lives in
`components.schemas.Problem` of the OpenAPI document. A `405` always carries an
`Allow` header and a `429` always carries `Retry-After`.

`/api/analytics` and `/api/marketing-config` serve the website's own browser
code, are not part of this contract, and may change without notice. Any other
path under `/api/` returns a `404` problem document.

## Authentication

These endpoints do not use OAuth, OpenID Connect, or API keys. The health check
is public; the contact endpoint relies on same-site origin validation, explicit
consent, input validation, bot checks, and rate limiting.

## Site conventions

- Any page URL returns Markdown when the request sends `Accept: text/markdown`.
- Nonexistent paths return a real HTTP `404`; clients that did not ask for HTML
  receive a short Markdown note pointing at the sitemap, `llms.txt` and the
  developer portal.
- Every response carries `Content-Signal: ai-train=no, search=yes, ai-input=yes`.