REST API

Connect Rembrandt to external applications, webhooks, and third-party tools using our REST API.

Overview

The Rembrandt REST API provides programmatic access to your data through standard HTTP requests.

Authentication

All API requests require authentication using an API key (format: rk_*).

Getting Your API Key

API keys are created through Service Accounts in your Rembrandt dashboard:

1. Log in to your Rembrandt account

2. Navigate to Settings > Organization > API Tokens

3. Create a Service Account (if you don't have one)

4. Click Create API Key in your service account

5. Enter a name for your API key

6. Important: Copy the API key immediately. It starts with rk_ and is only shown once

7. Store it securely (password manager, environment variables, secrets management)

Using Your API Key

Include your API key in the Authorization header:

Authorization: Bearer rk_your_api_key_here

Security Best Practices:

• Keep your API key secret - never commit it to version control

• Never share your API key publicly or in screenshots

• Use different API keys for different environments (production, staging, development)

• Rotate API keys regularly

• Revoke keys immediately if compromised

Base URL

https://api.rembrandtagents.com

API Version: v1

API documentation

• Interactive Documentation: https://api.rembrandtagents.com/docs

• OpenAPI Specification: https://api.rembrandtagents.com/docs/json

Response format

All list endpoints return a consistent response with pagination metadata:

{
  "success": true,
  "data": {
    "accounts": [...],
    "totalCount": 150,
    "pagination": {
      "offset": 0,
      "limit": 20,
      "totalCount": 150,
      "hasMore": true
    }
  },
  "timestamp": "2026-04-21T10:30:00.000Z"
}

Use pagination.hasMore to determine if more pages exist. To fetch the next page, set offset to offset + limit.

Available endpoints

The REST API exposes four resource families, each with a list and a details endpoint. Eight endpoints in total:

• Accounts: companies tracked inside Rembrandt

• Opportunities: buying opportunities detected for an account

• Pain Clusters: buying-pain definitions that drive opportunity generation

• Signal Domains: top-level groupings that contain signal frameworks

Always check the live specification. The OpenAPI specification is generated from the running API, so it is the authority on what exists today.

Accounts

GET /v1/accounts

List and filter accounts (companies) in your organization.

Query Parameters:

• Filters: name (contains match), industry, status (default: ACTIVE)

• Sorting: sortBy (name, createdAt. Default: name), sortOrder (asc, desc. Default: asc)

• Pagination: limit (1-100, default: 50), offset (default: 0)

Accepted status values:

ACTIVE
INACTIVE
ARCHIVED

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/accounts?industry=Technology&limit=20"

Each account in the response includes:

• id (UUID), name, industry (nullable), website (nullable)

• headquartersCountry (lowercase ISO-2, e.g. nl, us)

• status (see the accepted values above)

• opportunityCount (number of opportunities for this account)

• createdAt, updatedAt (ISO-8601 timestamps)

GET /v1/accounts/:id

Get full details for a single account.

Path Parameter: id (UUID)

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/accounts/123e4567-e89b-12d3-a456-426614174000"

To retrieve the opportunities (and their signal intelligence) for an account, call GET /v1/opportunities?accountId=....

Pain Clusters

GET /v1/pain-clusters

List pain clusters (the buying-pain definitions configured for your organization).

Query Parameters:

• Filters: name (contains match), isActive (true/false), domainId (UUID)

• Pagination: limit (1-100, default: 20), offset (default: 0)

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/pain-clusters?isActive=true"

Each pain cluster in the response includes:

• id (UUID), name, prompt, isActive

• domains (array with id, name). The signal domains this pain cluster targets

• outputFields (array with id, fieldName, fieldLabel, fieldType, description, isRequired, displayOrder)

• opportunityCount, createdAt, updatedAt

GET /v1/pain-clusters/:id

Get pain cluster details.

Path Parameter: id (UUID)

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/pain-clusters/123e4567-e89b-12d3-a456-426614174000"

Opportunities

GET /v1/opportunities

List opportunities with filters.

Query Parameters:

• Filters: accountId (UUID), painClusterId (UUID), country (ISO 2-letter, case-insensitive), minConvictionScore (0-5)

• Sorting: sortBy (convictionScore, momentToActDate, createdAt. Default: createdAt), sortOrder (asc, desc. Default: desc)

• Pagination: limit (1-100, default: 20), offset (default: 0, max: 9900)

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/opportunities?minConvictionScore=3&sortBy=convictionScore&sortOrder=desc&limit=20"

# All opportunities for one account
curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/opportunities?accountId=123e4567-e89b-12d3-a456-426614174000"

Each opportunity in the response includes:

• id (UUID), accountId, accountName, headquartersCountry

• painClusterId, painClusterName

• momentToActDate, evidence, convictionScore (0-5)

• customOutput (the pain cluster's output fields, or null)

• createdAt, updatedAt

GET /v1/opportunities/:id

Get opportunity details including related signal matches.

Path Parameter: id (UUID)

Response includes (beyond list fields): signalMatches (array with id, content, sourceType, confidence, createdAt).

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/opportunities/123e4567-e89b-12d3-a456-426614174000"

Domains

GET /v1/domains

List signal domains.

Query Parameters:

• Filters: includeArchived (true/false, default: false)

• Pagination: limit (1-100, default: 50), offset (default: 0)

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/domains?limit=50"

Each domain in the response includes:

• id (UUID), name, description (nullable)

• frameworkCount, recentSignalMatches (signal matches in the last 30 days)

• isArchived, createdAt, updatedAt

GET /v1/domains/:id

Get domain details including frameworks and statistics.

Path Parameter: id (UUID)

Response includes (beyond list fields): frameworks (array with id, name, description), painClusterCount (number of pain clusters linked to this domain).

curl -H "Authorization: Bearer rk_your_api_key" \
  "https://api.rembrandtagents.com/v1/domains/123e4567-e89b-12d3-a456-426614174000"

Public Endpoints (No Authentication Required)

• GET / - API information and available endpoints

• GET /health - Health check endpoint

• GET /docs - Interactive Swagger/OpenAPI documentation

Use cases

The REST API can be used for:

• Custom integrations with your own systems

• Automation scripts and workflows

• Reporting and data warehouse loads

Looking for something more direct? To connect your CRM, see CRM. To query Rembrandt from Claude or ChatGPT, see AI Assistants, which needs no code.

Rate limits

Rate limits are applied per API key:

• Per API Key: 1,000 requests/hour (regular), 2,000 requests/hour (burst)

• Per Organization: 5,000 requests/hour (regular), 10,000 requests/hour (burst)

• Per IP: 100 requests/minute (regular), 1,000 requests/hour (burst)

Rate limit information is included in response headers:

• X-RateLimit-Remaining-Key - Remaining requests for your API key

• X-RateLimit-Reset-Key - Timestamp when the limit resets

• X-RateLimit-Remaining-Org - Remaining requests for your organization

• X-RateLimit-Reset-Org - Timestamp when the org limit resets

If you exceed rate limits, you'll receive a 429 Too Many Requests response.

Error handling

All endpoints return a consistent error format:

{
  "success": false,
  "error": "Error message",
  "errorCode": "ERROR_CODE",
  "errorId": "uuid-for-tracking",
  "timestamp": "2024-01-15T10:30:00Z",
  "path": "/v1/accounts",
  "method": "GET"
}

Common error codes

• 400 Bad Request (VALIDATION_ERROR): Invalid parameters (e.g., invalid country code, limit out of range, malformed UUID)

• 401 Unauthorized: Missing, malformed, or invalid API key

• 404 Not Found (NOT_FOUND): Account, opportunity, pain cluster, or domain not found

• 429 Too Many Requests: Rate limit exceeded. The body carries a retryAfter timestamp

• 500 Internal Server Error (INTERNAL_ERROR): Server-side issue

Authentication and rate-limit responses (401 and 429) are produced before the request reaches a route, so they return only success and error, plus retryAfter on a 429. The fuller envelope above applies to 400, 404, and 500.

Always check the success field in responses and handle errors gracefully.

Security best practices

1. Keep API keys secure - Never commit API keys to version control

2. Use environment variables - Store keys in secure configuration

3. Rotate keys regularly - Regenerate keys periodically

4. Monitor usage - Review API usage in Settings > Organization > API Tokens

5. Use HTTPS only - Always connect over HTTPS

6. Never share keys publicly - Don't include keys in screenshots or public documentation

7. Use different keys per environment - Separate keys for production, staging, and development

Need help

For API support and questions:

• Review the API documentation

• Check our Troubleshooting Guide

• Contact support at api-support@rembrandtagents.com