Public, read-only interfaces.

Quick reference

Authentication

The endpoints listed above contain public information and require no API key, account, cookie or OAuth token. Do not send credentials. DDQ Cloud applications and customer systems are separate services with their own access controls; publication of these read-only interfaces does not grant access to them.

JSON API

The company endpoint is the canonical machine-readable representation of DDQ’s public company record. Request it with an identifying user agent and cache stable data instead of polling it unnecessarily.

curl --fail-with-body \
  -H 'Accept: application/json' \
  -H 'User-Agent: ExampleAgent/1.0 ([email protected])' \
  https://ddq.nl/api/company.json

Successful responses use application/json. Failures anywhere below /api/ use RFC 9457 problem details with type, title, status, detail and instance. Clients should branch on the HTTP status and type, not on the prose in detail.

HTTP/1.1 404 Not Found
Content-Type: application/problem+json

{
  "type": "https://ddq.nl/developers/#problem-not-found",
  "title": "Not found",
  "status": 404,
  "detail": "No API resource exists at this path.",
  "instance": "/api/missing"
}

Rate limits

Requests to /api/company.json and /status.json share a limit of 100 requests per client address in each fixed one-hour window. Every API response includes the current RateLimit-Policy and RateLimit structured fields plus RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset for older clients. Reset values are seconds until the current window ends.

RateLimit-Policy: "hourly";q=100;w=3600
RateLimit: "hourly";r=99;t=1800
RateLimit-Limit: 100
RateLimit-Remaining: 99
RateLimit-Reset: 1800

After the quota is exhausted, the API returns 429 problem details and a Retry-After header. Respect that value before retrying. The MCP endpoint has no separately published numerical application quota, but abusive or unsafe traffic may be restricted. Cache tools/list using the hints returned by the current protocol.

MCP negotiation

The MCP server is stateless and read-only. It supports current MCP 2026-07-28 discovery and the legacy initialize handshake for 2024-11-05, 2025-03-26, 2025-06-18 and 2025-11-25. Current requests mirror the method in Mcp-Method, carry the protocol version in the HTTP header and request _meta, and use Mcp-Name when a method addresses a named tool.

Current stateless discovery

curl https://ddq.nl/mcp/ \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: server/discover' \
  --data '{
    "jsonrpc":"2.0",
    "id":"discover-1",
    "method":"server/discover",
    "params":{"_meta":{
      "io.modelcontextprotocol/protocolVersion":"2026-07-28",
      "io.modelcontextprotocol/clientInfo":{"name":"example-client","version":"1.0.0"},
      "io.modelcontextprotocol/clientCapabilities":{}
    }}
  }'

List capabilities without invoking a tool

curl https://ddq.nl/mcp/ \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/list' \
  --data '{
    "jsonrpc":"2.0",
    "id":"tools-1",
    "method":"tools/list",
    "params":{"_meta":{
      "io.modelcontextprotocol/protocolVersion":"2026-07-28",
      "io.modelcontextprotocol/clientInfo":{"name":"example-client","version":"1.0.0"},
      "io.modelcontextprotocol/clientCapabilities":{}
    }}
  }'

The deterministic list exposes company_info, cloud_services and contact. Each definition contains an object inputSchema with no accepted properties. Listing these definitions does not execute a tool.

Legacy initialize

curl https://ddq.nl/mcp/ \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  --data '{
    "jsonrpc":"2.0",
    "id":1,
    "method":"initialize",
    "params":{
      "protocolVersion":"2025-11-25",
      "capabilities":{},
      "clientInfo":{"name":"example-client","version":"1.0.0"}
    }
  }'

After initialization, a legacy client sends notifications/initialized and may request tools/list. The server does not issue a session identifier because none of its public tools requires connection state.

MCP errors

MCP failures remain JSON-RPC responses. Invalid JSON uses -32700, invalid request envelopes use -32600, unknown methods use -32601, and invalid parameters or unknown tool names use -32602. Current stateless requests also use -32020 for request/header mismatches and -32022 for unsupported protocol versions. Clients should preserve the request id when correlating responses.

API problem: not found

The request path does not identify a published API resource. The response status is 404.

API problem: method not allowed

The resource exists, but the request method is not supported. The response status is 405 and the Allow header lists supported methods.

API problem: rate limit exceeded

The client address has exhausted its fixed hourly quota. The response status is 429; wait for the number of seconds in Retry-After.

API problem: internal error

The server could not produce the requested representation. The response status is 500; retry cautiously or contact DDQ if the condition persists.

Discovery and change policy

• AGENTS.md gives concise guidance for automated visitors.
• llms.txt and index.md provide readable company context.
• The API catalog, AI Catalog, agent card and WebMCP manifest link the machine interfaces.

The public interfaces are versioned conservatively, but consumers should tolerate new object properties. Material changes will be reflected in the OpenAPI document, discovery metadata and this page. Questions can be sent to [email protected].