Welcome
Store, query and manage regulated data in country-specific InCountry Data Residency-as-a-Service vaults.
The InCountry REST API lets your application store and query regulated data (PII, health, financial records) inside a specific country, using InCountry's Data Residency-as-a-Service (DRaaS). Each country has its own REST API instance; records are hashed or encrypted (AES-GCM, 256-bit) and never leave that country's InCountry Vault.
What you'll find here
- API Reference: all 18 operations, grouped into Authentication, Records, Tokenization, Database Attachments and Object Storage Attachments, with request and response schemas, examples and a live API playground.
- SDKs: client libraries for C#, Python and TypeScript, generated by APIMatic, with code samples on every endpoint.
- Context Plugin: brings the API and SDKs into AI coding assistants such as Claude Code, Cursor and Codex.
Base URLs
| Purpose | URL |
|---|---|
| Data (records and attachments) | https://{country}-restapi-mt-01.api.incountry.io (e.g. se for Sweden) |
| Access tokens | https://idp.incountry.com/oauth2/token |
The exact REST API address of your environment is shown on the InCountry Portal when you create a REST API integration.
Authentication
- Create a REST API integration on the InCountry Portal to get a Client ID, Client Secret and environment ID.
- Exchange them for an access token with
POST /oauth2/token(Basic auth with the Client ID and Secret; form fieldsgrant_type=client_credentials,audienceandscope). - Send the token on every data call. Tokens expire after 300 seconds.
Authorization: Bearer <ACCESS_TOKEN>Common tasks
- Store a record:
POST /api/records - Search for records:
POST /api/records/find - Store many records at once:
POST /api/records/batch - Count or sum records:
POST /api/records/aggregate - Attach a file to a record:
POST /api/records/{country}/{key}/files - Delete a record:
DELETE /api/records/{country}/{key}