# GET /v1/sources

> Index: https://kartpunkt.se/llms.txt

operationId: `listSources`. The data sources and their terms.
Tag: `registries`.

Every data source: its licence, its attribution, the uses its terms allow and how long job results derived from it are kept. Read it before you hard-code a source id or a retention time. It costs a request and no calculation.

## Request

`GET https://api.kartpunkt.se/v1/sources` with `Authorization: Bearer $KARTPUNKT_API_KEY`, from your backend (never browser code: the key would leak, and CORS is not enabled).

## Response 200

Example:

```json
{
  "sources": [
    {
      "id": "lantmateriet",
      "name": "Lantmäteriet, Belägenhetsadress",
      "licence": "CC-BY-4.0",
      "attribution": "Belägenhetsadress Nedladdning, vektor ©Lantmäteriet, bearbetad av Kartpunkt, CC BY 4.0",
      "url": "https://creativecommons.org/licenses/by/4.0/",
      "terms": "Lantmäteriet decision LM2026/143671 of 2026-10-13 (docs/compliance.md §6): single answers via API, no extraction, no joins with owner or resident data, history at most 24 months; supplement LM2026/159999 of 2026-10-13 (docs/compliance.md §2b): route optimization from stored address ids (use 2), at most 1 000 a call and 50 000 a job, answering routes, times and the caller's own ids, never the addresses; and the customer's own list (use 3) validated, geocoded or reverse geocoded as a job of at most 50 000 rows, one row out per row in, only to that customer, its input deleted when the job ends and its result kept at most 7 days",
      "uses": [
        "single_answer",
        "id_resolution",
        "own_list"
      ],
      "result_ttl_hours": 24
    },
    {
      "id": "nvdb",
      "name": "Trafikverket, NVDB",
      "licence": "CC0-1.0",
      "attribution": "Vägdata från NVDB, Trafikverket, CC0 1.0",
      "url": "https://creativecommons.org/publicdomain/zero/1.0/",
      "terms": "CC0 1.0: no restriction",
      "uses": [
        "single_answer",
        "bulk",
        "aggregate",
        "derived_product"
      ],
      "result_ttl_hours": 168
    },
    {
      "id": "synthetic",
      "name": "Kartpunkt synthetic test addresses",
      "licence": "CC0-1.0",
      "attribution": "Syntetiska testadresser från Kartpunkt, inte verkliga adresser.",
      "url": "https://creativecommons.org/publicdomain/zero/1.0/",
      "terms": "Kartpunkt's own, made up: no restriction",
      "uses": [
        "single_answer",
        "bulk",
        "aggregate",
        "derived_product",
        "id_resolution",
        "own_list"
      ],
      "result_ttl_hours": 168
    }
  ],
  "provenance": {
    "synthetic": true,
    "sources": []
  }
}
```

- `sources` (array of object): Every source an answer can read.
  - `id` (string): The source's id, as provenance.sources[].id names it.
  - `name` (string): The source's name.
  - `licence` (string): The source's licence, as an SPDX id.
  - `attribution` (string): The credit to show wherever the source's data is shown or passed on.
  - `url` (string): The licence's URL.
  - `terms` (string): The licence or approval the allowed uses rest on.
  - `uses` (array of "single_answer" | "bulk" | "aggregate" | "derived_product" | "id_resolution" | "own_list"): What the terms allow: 'single_answer' a few records per answer, 'bulk' many in one answer or job result, 'aggregate' counts or statistics over them, 'derived_product' a published dataset made from them. 'id_resolution' resolves stored address ids inside an answer that never returns the addresses, and 'own_list' matches the caller's own list row by row.
  - `result_ttl_hours` (number): Hours a job result derived from the source is kept.
- `provenance` ([Provenance](https://api.kartpunkt.se/docs/shapes/Provenance.md))

## Errors

Every error is `{ error, message, param?, doc_url }`; `message` says what to do next. All codes: [https://api.kartpunkt.se/errors](https://api.kartpunkt.se/errors). What to do on each, with retries: [https://api.kartpunkt.se/docs/recipes/errors-and-retries.md](https://api.kartpunkt.se/docs/recipes/errors-and-retries.md).

- [`invalid_request`](https://api.kartpunkt.se/errors/invalid_request) (400): The request does not match the API schema. Fix the fields named in this message; see /openapi.json.
- [`unauthorized`](https://api.kartpunkt.se/errors/unauthorized) (401): Missing or unknown API key. Send it as 'Authorization: Bearer <key>' (or 'x-api-key'), read from the KARTPUNKT_API_KEY environment variable. The user creates a kp_test_ key on their Kartpunkt account page (https://kartpunkt.se/konto) and puts it in KARTPUNKT_API_KEY themselves; never ask them to paste a key into chat.
- [`live_access_required`](https://api.kartpunkt.se/errors/live_access_required) (403): This account is not approved for live data: kp_live_ keys are for customers under contract. Use a kp_test_ key. To ask for live access, the account holder writes to hej@kartpunkt.se, or orders a plan at https://kartpunkt.se/konto#plan.
- [`quota_exceeded`](https://api.kartpunkt.se/errors/quota_exceeded) (429): Request limit or plan quota reached (per minute, per day, or the account plan's monthly quota). Wait the number of seconds in the Retry-After header, then retry; without Retry-After, no wait helps: tell the account holder what this message says.
- [`internal_error`](https://api.kartpunkt.se/errors/internal_error) (500): Something failed on our side. Retry after a few seconds; if it keeps failing, contact hej@kartpunkt.se.
- [`live_data_unavailable`](https://api.kartpunkt.se/errors/live_data_unavailable) (503): Live data is not available yet: it opens when Kartpunkt's import of Lantmäteriet's address register completes. Use a kp_test_ key until then.

## Limits

none

## Metering

A request only: no calculations, no live call, no address limit.