API Documentation

Base URL: https://api.mapriot.com

All API requests require an API key. Get yours from the dashboard.

Authentication

Append ?apiKey=<your-key> to every request:

https://api.mapriot.com/planet/14/8873/5504?apiKey=<your-key>

When using the outdoor style with a map library, the style JSON triggers additional requests for tiles, fonts, and sprites — all of which also need your API key. Each platform handles this differently:

• MapLibre GL JS — use transformRequest (example)
• Leaflet — use transformRequest via maplibre-gl-leaflet, or include the key directly in the raster tile URL (example)
• Android — use an OkHttp interceptor (example)
• iOS — use a URLProtocol interceptor (example)
• OpenLayers — include the key directly in the raster tile URL (example)

The key goes in the query string for POST requests too (e.g. POST /route?apiKey=<key>), never in the body.

If you use an API key in a browser, restrict it to your site’s origin in the dashboard.

Billing units

Each API request consumes units against your monthly plan limit. Limits are soft on paid plans — requests are never blocked. You receive an email notification when approaching or exceeding your limit. The free plan stops at 200% of its limit (HTTP 429).

What each plan includes

A request for a feature your plan doesn’t include returns 403 with a plain-text body and is not billed:

This feature is not available on your plan. See https://mapriot.com/pricing for details or contact us at support@mapriot.com.

See Pricing for the plans. Individual features can also be enabled for a single account on request — contact us.

Rate limits

Separate from your monthly units: each API key also has a request rate limit, so one misbehaving script can’t slow the service down for everyone. The limits are generous — normal apps never reach them. If you do, it almost always means a retry loop with no backoff.

Limits are per API key, so separate keys for your app, your staging environment and your batch jobs get separate budgets.

Fonts, sprites, style JSON, TileJSON, offline downloads and CORS preflights are not rate limited.

When you go over

HTTP/1.1 429 Too Many Requests
Retry-After: 7
X-RateLimit-Limit: 10
X-RateLimit-Remaining: 0
X-RateLimit-Class: routing_heavy
Content-Type: application/json

{
  "error": "rate_limit_exceeded",
  "message": "Too many isochrone, matrix and optimized-route requests for this API key…",
  "class": "routing_heavy",
  "limit": 10,
  "retry_after": 7
}

Wait the number of seconds in Retry-After and the request will succeed. Retrying sooner just gets another 429 — it does not extend the wait, but it wastes your own throughput. Exponential backoff on top of Retry-After is the safest client behaviour.

The free plan’s 200% hard cap also returns 429, but as plain text and without a Retry-After header — check Retry-After to tell the two apart.

Request size

POST bodies are capped at 512 KB for routing and 1 MB for batch elevation; anything larger gets a 413. Routing requests also have their own shape limits (locations, matrix size, contours, trace points) — see Routing limits.

Need a higher limit? Email support@mapriot.com with your key name and what you’re building. Raising a limit is a one-line change on our side.

Endpoints

Styles

Tile sources

APIs

Errors

CORS

Every endpoint can be called from a browser on any origin. Responses carry Access-Control-Allow-Origin: *.

Requests that trigger a CORS preflight, such as POST with Content-Type: application/json (routing, batch elevation) or a custom header, are handled automatically: the OPTIONS preflight is answered without an API key and is not billed. Only the actual request counts.