Which Maditon API endpoints can be called without authentication?

The default is closed. These are the exceptions, and they are exceptions because the data behind them is meant to be public.

Endpoint	What it returns
GET /health	Service health
GET /api/modules	Every regulatory module and its status
GET /api/modules/{code}	One module by code
GET /api/transparency/sitemap	The slugs of organisations that have published a transparency page
GET /api/transparency/{slug}	One organisation’s published AI transparency page

The transparency pair is the interesting one for an agent. An organisation can choose to publish a page describing the AI systems it operates and how they are classified. Those pages are public by the organisation’s own decision, and the sitemap endpoint enumerates them — so an agent asked “what AI systems does this company disclose, and under what risk tier?” has a structured answer to fetch rather than a marketing page to parse.

Everything else — systems, classifications, evidence, dossiers, billing — requires a bearer token and is scoped to the caller’s organisation.

There are also two unauthenticated write endpoints behind the free public tools: the EU AI Act pre-screen and the CRA readiness scan submit their results without an account, which is why those tools need neither a login nor an email address.