Meridian Data API reference

Quickstart

Issue a key on the signup page, put it in an environment variable, and make one request. That is the whole setup.

export MERIDIAN_API_KEY="mc_live_…"
export MERIDIAN_BASE="https://api.meridian-data.example/v1"

curl -s "$MERIDIAN_BASE/commodities/XAU" \
  -H "Authorization: Bearer $MERIDIAN_API_KEY" \
  -H "Accept: application/json"

The response:

{
  "data": {
    "symbol": "XAU",
    "name": "Gold",
    "category": "Metals",
    "unit": "USD/oz",
    "price": 2412.35,
    "change": 18.4,
    "changePct": 0.77
  },
  "meta": {
    "request_id": "req_8f2c41d0a7b94e13",
    "as_of": "2026-10-29T09:14:02Z",
    "count": 1,
    "api_version": "v1"
  }
}

Try the live demo endpoint without a key: GET /api/v1/commodities

Authentication

Pass your key as a bearer token in the Authorization header. Keys are prefixed mc_live_ and are scoped to your account, not to a region.

Authorization: Bearer mc_live_9f3c…

• · Never put the key in a query string — it will be logged by proxies.
• · Rotate keys from the dashboard; old keys keep a 24-hour grace period.
• · Missing keys return 401 missing_api_key; suspended keys return 403 key_disabled.

Rate limits

Limits are enforced per key with a token bucket. Responses include the standard headers on every request, including the ones that succeed.

X-RateLimit-Limit: 50
X-RateLimit-Remaining: 49
X-RateLimit-Reset: 1761734100

# When exceeded
HTTP/1.1 429 Too Many Requests
Retry-After: 1

Endpoints

All endpoints are HTTPS-only GETs. Responses are cacheable for the duration of the as-of window.

The demo server also exposes unauthenticated /api/prices and /api/v1/* endpoints with the same response shape, so you can inspect the contract before signing up.

Pagination

List endpoints return up to 100 records and a cursor. Pass the cursor back unchanged; do not construct or modify it. An empty next_cursor means you have the last page.

GET /v1/commodities?category=Energy&limit=2
GET /v1/commodities?category=Energy&limit=2&cursor=eyJvIjoyfQ…

{
  "data": [ … ],
  "meta": {
    "request_id": "req_…",
    "count": 2,
    "next_cursor": "eyJvIjo0fQ…"
  }
}

Errors

Errors use conventional HTTP status codes and a stable machine-readable code. Branch on the code, never on the message.

{
  "error": {
    "type": "invalid_request_error",
    "code": "unknown_symbol",
    "message": "No instrument matches \"XYZ\"."
  },
  "meta": { "request_id": "req_…", "api_version": "v1" }
}

Versioning & support

The version is part of the path (/v1). Additive fields may appear at any time — ignore unknown keys. Breaking changes ship under a new version with at least twelve months' notice.