API Reference

Regions & sectors

The region and sector values are closed-vocabulary — send one of the exact values below (case-sensitive). Every endpoint rejects anything else with a 400, and a rejected call does not count towards your monthly quota.

Matching filters

Add a filters object to a /v1/match call to leave out grants that rule your organisation out. Every filter is optional and only applies when you send it, so a call without filters behaves exactly as before. The allowed values are listed below the table, read live from GET /v1/match/vocab (no key needed), so they are always the ones the API checks. Anything else gets a 400 naming the field and its allowed values.

A grant that doesn't say is kept.If a funder's page doesn't state who can apply, where, or who it helps, the grant stays in your results. A grant is only left out when what it states clashes with what you sent, for example Kent only when you sent a Leeds council.

Limits & errors

Dev Starter and Dev Pro have three limits: calls per month, results per call, and distinct grants per month. A grant counts once, the first time any endpoint or webhook shows it to your account. After that it is free to see again, in any month. Calls and distinct grants both reset on the 1st of each month. Only successful calls count towards your monthly calls. Your developer dashboard shows how much of each you have used. Enterprise gives you the full grants database and unlimited matching under a signed data licence, with no distinct-grant limit.

When some results are held back because of the distinct-grant limit, you still get a 200 with the grants you can see, and distinct_grant_cap_notice says how many were held back.

We keep the details you send with each call - such as sector, region, description and amount - for 30 days, so we can look into a result with you if something doesn't look right and keep improving matches. After 30 days they are deleted. Your API key is never stored with them.

Add a webhook in your developer dashboard with an https URL, an optional sector and region, and a match threshold. Once a day we check the grants added since its last delivery against it, then POST any that score at or above the threshold. Grants sent by webhook count towards your distinct-grant limit like any other response. Return any 2xx status to confirm delivery.

Content-Type: application/json
X-GrantsHub-Signature: sha256=5d41402abc4b2a76b9719d911017c592...

{
  "event": "new_match",
  "webhook_id": 42,
  "grants": [
    {
      "master_id": "a1b2c3d4e5f6",
      "title": "Scottish Arts Community Fund",
      "funder": "Creative Scotland",
      "close_date": "2026-12-15",
      "url": "https://www.creativescotland.com/funding/...",
      "score": 82.5
    }
  ]
}

Verifying the signature

Every delivery is signed with the webhook's signing secret, which you can see in your dashboard. X-GrantsHub-Signature is sha256= followed by the hex HMAC-SHA256 of the raw request body. Compute it over the bytes exactly as received, before parsing the JSON, and compare in constant time.

import hmac, hashlib

def is_valid(raw_body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header or "")

const crypto = require('crypto');

function isValid(rawBody, header, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(header || '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}