---
title: Prompt Monitoring developer and agent resources
description: Read-only REST, NLWeb and MCP interfaces for public Prompt Monitoring facts.
canonical: https://www.prompt-monitoring.com/developers
updated: 2026-08-22
---

# Prompt Monitoring developer and agent resources

Prompt Monitoring publishes read-only interfaces for accurate product, pricing and guide information. They do not expose customer records, create accounts, execute monitoring runs or perform purchases.

## REST API

- [OpenAPI 3.0 specification](https://www.prompt-monitoring.com/openapi.json)
- **GET /v1/product**: product scope and measured surfaces.
- **GET /v1/pricing**: public pricing, trial and limits.
- **GET /v1/guides**: cursor-shaped public guide list.
- **POST /v1/guides/batch**: read up to twenty known guide identifiers.

Errors use **application/problem+json** with RFC 9457-compatible fields.

## NLWeb-compatible questions

Use **GET /ask?query=What+does+it+cost?** for a grounded JSON answer with Schema.org-typed results and source URLs. Send **Accept: text/event-stream** for SSE.

## MCP

The [MCP server card](https://www.prompt-monitoring.com/.well-known/mcp/server-card.json) points to the streamable HTTP endpoint at **/mcp**. Its four tools and two resources are public, read-only and idempotent.

## Authentication

Public interfaces require no authentication. Customer workspace sign-in uses email magic links; optional Google data connections use user-approved OAuth in the web application. See [auth.md](https://www.prompt-monitoring.com/auth.md).

## Versioning, deprecation and sunset

REST paths use URL versioning under **/v1**. When a successor version is published, the current version remains supported for at least 180 days. A deprecated response will carry **Deprecation: true**, an HTTP **Sunset** date and a **successor-version** Link before removal.

## Limits

Public REST (/v1/*), /ask and /mcp share a quota of **120 requests per minute per IP address**. Requests, including validation errors, consume this quota; OPTIONS does not. Responses expose **RateLimit-Limit**, **RateLimit-Remaining** and **RateLimit-Reset** (seconds until the next minute). Legacy X-RateLimit headers are also provided; X-RateLimit-Reset is a Unix timestamp. Exceeding the quota returns HTTP **429**, application/problem+json and **Retry-After** in seconds.

Metered responses are not cached. Static discovery documents remain cacheable and do not advertise per-client quotas. Counters use the configured shared Redis store; without Redis or during an outage, limits are best-effort per server instance. Only a hash of the client address is used as the counter key.