Skip to main content

Overview

The API is how you run Hizura from your own stack — building lists on a schedule, wiring them into your own systems, or enriching records you already hold.
API keys are issued to Enterprise accounts. On every other plan, use the MCP server — it authenticates as you over OAuth, needs no key, and exposes the same research engine.

Authentication

Authenticate every request with your key in the x-api-key header.
Keep API keys server-side. Never expose them in browser code, public repositories, or logs.

Build a list

POST /tables/stream is the endpoint you’ll use most. Send your request as query and Hizura researches it, streaming progress as newline-delimited JSON (application/x-ndjson).
One JSON object per line, ending in exactly one result or error:
Write query the way you’d brief a person — there’s no interview in front of the API, so name every column you want and any criteria that matter. It accepts up to 8,000 characters.
Prefer POST /tables if you’d rather block until the run completes — same body, one JSON response, no stream to parse. Runs take several minutes, so set a long client timeout.
You can also create an empty table to fill yourself, which costs no credits:

Recovering a run

A run continues server-side even if your client disconnects, so don’t retry the request — a second generation while one is in flight returns 409. Poll instead:
processing tells you whether a run is live; lastRunStatus distinguishes a finished run from a failed one; lastRunTableId is the table it produced. While processing is true, progressLog carries the steps completed so far. Once streaming has begun, the HTTP status stays 200 and failures arrive in-band so partial progress survives:

Add verified emails

POST /tables/{tableId}/enrich-emails finds verified corporate emails for rows you already have. Requires edit access and a paid plan, takes up to 500 rowIds, and streams NDJSON.
You’re billed only for rows where found is true. When it isn’t, reason is one of insufficient_credits, unparseable_name, no_company_domain, no_deliverable_address, or lookup_failed.

Read the results

A table response carries its metadata, rows, owner summary, and your access level. Row values live in each row’s data object, keyed by column name. Researched values arrive as { "result": …, "source": [{ "url": … }] }; link and email columns have their own shapes. Filter rows on one field with an exact match — useful for pulling a single segment out of a larger table:

Write back

Rows hold flexible JSON in data, so you can push your own records in and update them as deals progress.
Include tableId in the body as well as the path when adding a row. The path value is what selects the table.
Tables themselves take PATCH /tables/{tableId} for name and description, and DELETE /tables/{tableId} if you own them.

Access and limits

  • Your key acts as your account: you can read tables you own or that are shared with you, write where you have edit access, and delete only what you own.
  • One run at a time per account. Generating while a run is in flight returns 409.
  • Runs are capped at 30 minutes.
  • Generating tables and finding emails spends credits unless you’re on Enterprise, which isn’t metered. See Credits.
  • Sharing, collaborator management, and API-key management are session-authenticated — do those in the app.

Errors