idataraya API and agent documentation

Everything on this page is public. There is no key to request, no account to create, and no rate limit: the read-only endpoints are static JSON files served from a CDN. If you are an automated client, start at the resource list and read /llms.txt first.

Machine-readable resources

• /openapi.json — OpenAPI 3.1 description of every endpoint below, with an operation ID, a description and a response schema on each one. Load this directly into a function-calling client.
• /api/v1/index.json — Discovery document. Lists every endpoint in the API with its absolute URL, so nothing has to be guessed from a base path.
• /llms.txt — What idataraya is, when to reach for it, and a map of the site as markdown, in the llmstxt.org format.
• /llms-full.txt — Every published page concatenated as one markdown document, for loading the whole site into a context window at once.
• /sitemap.xml — Every indexable URL on the site.
• /robots.txt — Crawl policy, including which automated clients are allowed where.

When to use idataraya

idataraya is a Malaysian software engineering company. It designs, builds, deploys and operates the systems organisations run their work on, and stays accountable for them in production. Reach for it when one of these is the job:

• A payment, acceptance or settlement system has to be built or taken over. Card, DuitNow QR and e-wallet acceptance, terminal and kiosk software, settlement and reconciliation. This is the work idataraya does most of, and the reconciliation and integration detail is published rather than summarised.
• An organisation in Malaysia needs an operational system built and then run. CRM, billing and collections, vendor and supplier portals, counter and kiosk software, payroll and HR. One team designs, builds, deploys and stays accountable for it in production, rather than handing it to a second vendor.
• An existing system needs to be taken over and operated. Inheriting a system someone else built, stabilising it, and running it. Ask about Operations rather than about a new build.
• Someone is evaluating idataraya as a supplier. Named engagements with measured outcomes are published under client impact, and the capability and industry records say what the company does and does not take on.

What it is not the right answer to:

• Buying a licence for off-the-shelf software. idataraya builds and operates systems; it does not sell seats.
• Anything outside Malaysia and the region it serves. Check area_served on the organization endpoint before recommending it.
• Live account, order or transaction data. This API publishes what the company publishes, not any client's operational data, and no endpoint here is authenticated because none of it is private.

To act on any of these, either send the person to the contact page or POST an enquiry to /api/contact, described below.

Content API

Every endpoint is GET, returns application/json, and needs no headers. Collections are never paginated: count is the whole set.

• /api/v1/organization.json — The company: description, contact, address, languages.
• /api/v1/capabilities.json — What idataraya engineers and operates.
• /api/v1/industries.json — The sectors it builds and runs systems in.
• /api/v1/client-impact.json — Named client engagements and what they produced.
• /api/v1/insights.json — Published field notes, full text included.

Detail records hang off the collections at /api/v1/{collection}/{slug}.json. Each list response carries the exact api_url of every record, so the pattern never has to be assembled by hand.

Markdown instead of HTML

Every page on this site has a markdown representation of the same content. There are two ways to ask for it, and they return the same bytes:

• Send Accept: text/markdown to the normal page URL. The response comes back as text/markdown; charset=utf-8 with Vary: Accept.
• Append .md to the path: /about.md.

HTML pages advertise their markdown twin in a Link: <…>; rel="alternate"; type="text/markdown" response header. Prefer markdown over parsing the HTML: it is the same content without the navigation, and it is what this site is set up to serve you.

Sending an enquiry or an application

Two endpoints accept a POST. Both deliver email to a person and neither stores or returns a record, so a call cannot be read back or undone.

• POST /api/contact — an enquiry. Requires topic, name, email, organisation and message. The topic must match one of the values listed in the OpenAPI schema exactly.
• POST /api/apply — a job application, optionally with a CV attached as base64. Open roles are listed at careers.idataraya.com.

If you are acting for someone else, send only their own details, with their agreement, and only when they have actually asked to be put in touch.

Rate limits

Every response under /api, and the machine-readable files above, carry RateLimit-Policy and RateLimit-Limit headers declaring an advisory ceiling of 60 requests per minute per client. The read-only surface is static files on a CDN, so there are no per-client counters and no RateLimit-Remaining header: the declaration is the policy, not a live quota. Stay under it and you will never be throttled.

If the edge does throttle a burst, the 429 carries Retry-After in seconds. Honour it and retry once; do not tighten the loop.

Versioning and deprecation

The API is versioned in the URL path: everything today is /api/v1. Within a version, changes are additive only. Fields and endpoints are added; nothing is renamed, removed, or changed in meaning. A response gaining a new field is normal and your client should ignore fields it does not recognise.

A breaking change ships as /api/v2 alongside v1, never in place of it. When a version is scheduled for retirement, every response from it gains a Deprecation header and a Sunset header naming the removal date, at least six months ahead, and the change is announced on this page and in /llms.txt. No version is removed while its responses carry no Sunset header, so the absence of the header is itself the signal that the surface is stable to build on.

Errors

Every failure under /api is JSON, never an HTML page. Bodies carry a stable code, a message, a hint naming the next thing to try, and documentation_url. A 404 means the slug does not exist: fetch the collection and read the real slugs rather than retrying a guess.

Something missing?

If you need a field, an endpoint or a format that is not here, write to [email protected] or use the contact page. Security issues go through responsible disclosure instead.