Site Exposure API
One request, one point in Australia, three readings back: the wind class to AS 4055, an indicative bushfire attack level to AS 3959, and the atmospheric corrosivity category to AS 4312 with the National Construction Code environment beside it. Send coordinates or an address; the answer names the state, the lot on plan and, where the state publishes it, the council it resolved to.
Keys are issued by RapidSiteplan. There is no self-serve signup: tell us what you are building and we set the quotas with you.
AS 4055 wind classAS 3959 bushfire attack levelAS 4312 corrosivityNCC 2022 durability environmentJSON over HTTPS
What it returns
Every block carries its own standard string and the response carries one notice: indicative planning-stage readings, not an assessment or a certificate under any standard. Both are part of the contract: show them wherever you show the readings.
Keys and authentication
Issued by hand, under a written agreement. Nothing here is self-serve.
Send your key in the x-api-key header on every request (an Authorization: Bearer header carrying the same key works too). There is no OAuth step, no token exchange and no secret key in the query string.
A key is shown once, when we create it, and we keep only its fingerprint, so keep it secret and keep it server-side. Test keys begin ex_test_, are capped at 25 calls a day, and mark every answer with "test": true. Live keys begin ex_live_. Browser keys begin ex_pub_: they are public by design, answer only the widget route from your recorded domains, and drive the panel described below. Tell us and we revoke a key immediately; the rest of yours keep working.
The subscription behind your keys
A monthly request quota, paid by card through Stripe and renewing until it is cancelled.
We register you, agree a monthly request quota with you and send a payment link. The link opens Stripe's payment page, which takes the card and your business details; your receipts come by email. Your keys answer at the paid quota from the moment the payment lands. Some agreements carry no quota for a set period, and v1/me then answers quota unlimited with the date it runs to.
- The quota is softRequests over it are still answered, up to twice the quota in a calendar month (UTC), and billed as overage at the rate in your agreement. The overage is charged at the end of the month, on the card that pays the subscription.
- You hear about it onceThe first request over the quota in a month sends one email to your contact address. Past twice the quota every key answers monthly_limit (429) until the 1st, or until we move you to a larger quota. A move takes effect at once; the new amount starts at your next renewal.
- Test keys never billA test key keeps its 25 calls a day and its marked answers, and none of its calls count toward the quota.
- Renewal and the endIf a renewal is not paid, or the subscription is cancelled, every key answers subscription_ended (402) from the end of the period paid. Paying the renewal, or a renewal link we send, brings every key back. To cancel or change it, write to billing@rapidsiteplan.au.
The subscription block says where your keys stand in plain figures: the status, the renewal date, the quota, the month's billable requests, the requests over the quota and the most the keys answer this month. A subscription by written agreement answers status by_agreement with its quota and the month's count.
Routes
Three, all GET, all JSON.
| Route | Parameters | What comes back |
|---|---|---|
| GET /api/exposure/v1/site | lat and lng, or address · state optional | The wind class, the indicative bushfire attack level and the corrosivity category for one point, with the site it resolved to. |
| GET /api/exposure/v1/me | none | Who the key belongs to, its label, whether it is a test key, the quotas on it, where the subscription stands (status, renewal date, quota and this month’s requests) and the routes it can call. |
| GET /api/exposure/v1/coverage | none | What is covered in each state, in the same words as the table below, so an integration can read it rather than hard-code it. |
On /site, give either lat and lng as decimal degrees, or a single address string of 140 characters or fewer. Coordinates are read as sent; an address is resolved first and the point it resolved to comes back in the answer, so you can check it. Add state only with coordinates whose state you already know: it must agree with the point, and with an address it is ignored. Every response, success or failure, carries an x-request-id header: quote it if you ever need to ask us about one.
On a large lot, send the building site's coordinates: the wind terrain, the shielding, the bushfire distance and the corrosion distance are read at the point, so the spot where it will be built can read differently from the street address. Every answer carries point with the coordinates read and from, pin when you sent lat and lng or address when the point came from the address. In the panel, put data-lat and data-lng on the container beside the address and its address line says at the pin.
A call, and what comes back
One property in Logan City, Queensland. The shape is the contract.
coverage repeats, for this point, what the table below says for its state, and not_covered names anything that could not be read there. Fields are added over time; nothing shown here is removed without a new version.
The readings inside your own software
A drop-in script draws the wind, bushfire and corrosion readings in your page, for the address your form already holds.
Load the script, give it your browser key and the element to draw in, and pass the site address. The panel draws a small bordered card with the three readings, the coverage line for the state, the notice and Readings by RapidSiteplan with a link. When your address field changes, call update and it redraws.
- The address comes firstThe readings follow the address your form holds, so capture it before the design starts. A form with no address yet shows the line to enter it, and the answer carries the address as the lot records it, so you can show it back to your customer.
- A browser key, bound to your domainsBrowser keys begin ex_pub_. They are public by design, so they answer only from the domains we record for you; each domain covers its subdomains, and localhost works while you build. A page anywhere else gets domain_not_bound and spends nothing.
- Quiet when something is wrongA wrong key, a domain not recorded, a quota used up or an address not found draws one plain line in the card, never a blank space in your screen.
- Nothing kept in your pageNo cookies, no tracking and nothing stored. One request per address, sent only when the address changes and after a short pause while someone types. Each reading counts against the same quota as your server calls.
If your page sets a Content Security Policy, allow https://www.rapidsiteplan.au in script-src and in connect-src. The card draws in your page's own document with its own small style, and keeps the attribution the API asks for.
The route takes key and address, or key with lat and lng, and answers with CORS for your recorded domains. Sent with an address, the address block carries it as you sent it and as the lot records it; sent with a point, the lot alone. Each reading carries its value, its line, one fact line and its standard; where a reading is not available its line says why in the coverage words. A refusal carries a line written for your customer beside the hint for your developers.
Attribution
Our name or mark, beside the reading, with a link back.
Every response carries an attribution block. Wherever a reading from this API is shown to a person, show the RapidSiteplan name or mark beside it with a link to www.rapidsiteplan.au. It is a condition of the key, it travels in every response, and it is not removable. The block carries the wording to use and three assets:
The badges are drawn for a light and a dark background. Use whichever suits yours.
Coverage, state by state
Wind and corrosivity everywhere. What bushfire can say depends on what the state publishes.
| State | Wind | Bushfire | Corrosivity |
|---|---|---|---|
| QLD | Wind class to AS 4055 | Bushfire attack level to AS 3959 Method 1, indicative | Corrosivity category to AS 4312 |
| NSW | Wind class to AS 4055 | Bushfire attack level to AS 3959 Method 1, indicative | Corrosivity category to AS 4312 |
| VIC | Wind class to AS 4055 | The published floor level, with a Method 1 estimate beside it | Corrosivity category to AS 4312 |
| SA | Wind class to AS 4055 | The deemed level, with a Method 1 estimate beside it | Corrosivity category to AS 4312 |
| WA | Wind class to AS 4055 | Bushfire attack level to AS 3959 Method 1, indicative | Corrosivity category to AS 4312 |
| TAS | Wind class to AS 4055 | Bushfire attack level to AS 3959 Method 1, indicative | Corrosivity category to AS 4312 |
| ACT | Wind class to AS 4055 | Bushfire attack level to AS 3959 Method 1, indicative | Corrosivity category to AS 4312 |
| NT | Wind class to AS 4055, open terrain assumed | No bushfire prone designation exists | Corrosivity category to AS 4312 |
The wind class is returned in every state. Where a state publishes no bushfire designation, the bushfire block says so rather than guessing.
Errors
Every failure from the API is a JSON body with an error code; match the code, not the message. A first call after idle on a large Queensland lot can take close to ten seconds, and a platform timeout answers with an HTML page instead of JSON: treat any non-JSON body as a retry.
| Code | HTTP | What it means |
|---|---|---|
| invalid_key | 401 | The key is missing, malformed, unknown or revoked, or a browser key was sent to a server route (or a secret key to the widget route). |
| subscription_ended | 402 | The subscription ended, or its renewal is unpaid. Every key answers this from the end of the period paid until it is renewed. |
| subscriber_inactive | 403 | The key is real but the subscriber it belongs to is paused. |
| domain_not_bound | 403 | Widget route: the page calling it is not on a domain recorded for the browser key. Nothing is counted. |
| missing_site | 400 | Neither a lat and lng pair nor an address was given. |
| address_required | 400 | Widget route: no address yet. Capture the site address before the design starts. |
| bad_coordinates | 422 | lat and lng must both be present and both be decimal degrees. |
| address_too_long | 422 | Keep the address to 140 characters or fewer. |
| outside_australia | 422 | The point resolves outside Australia, where nothing here applies. |
| bad_state | 422 | The optional state was not one of the covered states, or the point is not inside it. |
| no_parcel | 422 | No land parcel is mapped at the point: the sea, or a gap in the cadastre. No reading was formed. |
| address_not_found | 404 | The address could not be resolved to a point. Send coordinates instead. |
| unknown_endpoint | 404 | Not one of the three routes. |
| method_not_allowed | 405 | The API is read-only. Use GET. |
| slow_down | 429 | Past 120 calls in the last minute from one IP address. The per-key limits are separate; space the calls. |
| per_minute | 429 | Past 60 calls in the last minute on this key. |
| daily_limit | 429 | By written agreement, the day’s quota is used, every key counted together; a test key has 25 a day of its own. The count resets at midnight UTC. |
| monthly_limit | 429 | By written agreement, the calendar month’s quota is used. On a subscription, twice the quota is used; the requests over the quota are billed as overage. It resets on the 1st. |
| upstream_failed | 502 | A mapping service the reading depends on did not answer. The body carries retry: true; the same call usually succeeds shortly after. |
| internal_error | 500 | The reading could not be formed. Quote the request id if it repeats. |
| metering_unavailable | 503 | The call could not be counted, so it was refused rather than served unmetered. |
| knowledge_unavailable | 503 | The rules knowledge did not load, so no reading was formed and the call was not counted. |
A 429 or a 502 is worth retrying; a 400, 401, 403, 404 or 422 is not, until the request or the key changes.
Limits
- 60 calls a minutePer key. Past that the answer is per_minute, 429. A separate 120 a minute applies per IP address. v1/me and v1/coverage are never counted.
- A monthly quotaSet with you in your subscription and counted over the calendar month in UTC. On a subscription it is soft: answered up to twice the quota, the part over it billed as overage, then monthly_limit, 429. By written agreement the quotas are a day and a month, and past them the answer is daily_limit or monthly_limit, 429.
- Test keys: 25 calls a daySame readings, marked test, so an integration can be built before anything is signed.
- What your key is allowedCall v1/me: it returns the quotas standing on your key, so nothing has to be hard-coded.
Cache what you fetch. A property’s exposure does not change between two calls a minute apart, and the quota you save is your own.
What these readings are, and what they are not
The same words the response carries, said once in full.
They are indicative, planning-stage readings at the point you send: enough to price a frame, choose a coating or flag a site before anyone visits it. They are not a wind, bushfire or corrosivity assessment, certificate or determination under AS 4055, AS 3959, AS 4312 or any other standard, and they do not replace the site assessment a state, a council or a certifier requires. The certifier’s site assessment governs.
Show the notice string from the response wherever you show the readings, and do not present a response as an assessment. The full terms are in our .
Tell us what you are building.
We register you, set the quotas with you in writing and hand you a key. A test key comes first if you want one: the same readings, marked test, 25 calls a day.