Connect to the API

corpus.search looks up the public catalogue by keyword and/or language. It never returns the code itself — only metadata (title, language, trust tier, price, an estimated token count and a locked preview). Anonymous requests are allowed against the public Corpus project, identified by the X-Projectheader below — don't change that value.

curl -s -X POST https://data.moresq.com/data/v1/functions/corpus.search \
  -H 'Content-Type: application/json' \
  -H 'X-Project: 6de3a80729a9cbaa534a060ebac7a88e' \
  -d '{"q": "stripe webhook", "language": "typescript", "limit": 10}'

Response shape:

{
  "data": {
    "results": [
      {
        "_id": "snip_...",
        "title": "Stripe webhook handler (signed, idempotent)",
        "language": "typescript",
        "trust_tier": "battle_tested",
        "access_fee_credits": 5,
        "access_price_usd": 0.05,
        "estimated_tokens": 640,
        "preview": "// aperçu protégé · typescript · 42 lignes",
        "loc": 42
      }
    ],
    "count": 1,
    "miss": null
  },
  "error": null
}

The endpoint is POST only — there is no GET form for executing a function. Supplying any credential (a session Bearer token, an X-API-Key, or the master key) also works and is required for any project other than the public Corpus one.

corpus.retrievereturns the full, verified code for a snippet found via search. It debits your wallet by the snippet's access_fee_credits(a few cents, typically 5 credits), atomically pays the contributor's revenue share, and logs the access. It requires authentication as a real account — send your key in the X-API-Key header.

curl -s -X POST https://data.moresq.com/data/v1/functions/corpus.retrieve \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: md_your_key_here' \
  -d '{"snippet_id": "snip_..."}'

Response includes the code, dependencies, a provenance/guarantee stamp and the billing breakdown:

{
  "data": {
    "snippet_id": "snip_...",
    "title": "Stripe webhook handler (signed, idempotent)",
    "language": "typescript",
    "code": "…verified implementation…",
    "dependencies": ["stripe"],
    "guarantee": {
      "trust_tier": "battle_tested",
      "license": "MIT",
      "content_sha256": "…",
      "warranty": "Verified by the Moresq Corpus process. Guarantees the review, not the absence of every bug."
    },
    "billing": {
      "charged": 5,
      "estimated_usd": 0.05,
      "wallet_after": 95
    }
  },
  "error": null
}

If your wallet balance is below the fee, the call fails with an error and nothing is charged — top up credits from the console first.

Create the account once, then open the Agent connection page. Select Create agent API key and copy the value prefixed md_. The full secret is displayed only once; Moresq stores its SHA-384 hash and shows only the prefix afterwards.

Keep the key secret and pass it as X-API-Key. Each personal key is linked to your wallet, limited to read/write agent scopes and independently revocable from the same panel. Browser session tokens and project master keys should never be copied into an agent.

export MORESQ_API_KEY="md_..."
export MORESQ_PROJECT="6de3a80729a9cbaa534a060ebac7a88e"

Anonymous corpus.search calls are limited to 60 requests per minute per IP. Exceeding it returns an HTTP 429 with { "error": { "code": "RATE_LIMIT" } }. Authenticated calls (search or retrieve, with an API key or session) are scoped to your account instead of your IP. Retrieval is additionally gated by your wallet balance, not just a rate limit.