Ship your first import.

API keys are HMAC-signed, self-contained credentials: everything needed to authenticate — the workspace (tenant_id), the name, and the granted scopes — is carried in the token and verified by signature, so there is no per-request key lookup. Pass the key as a bearer token in the Authorization header on every call.

• Name + scopes. Each key is labelled and carries the scopes it may exercise; a schema-only key can never reach the full-data path.
• Reveal once. The secret value is shown a single time at mint. Store it then — it is not recoverable afterward, only rotatable.
• Revoke. Revocation is enforced by a server-side deny-list checked on every request, so a revoked key fails closed immediately — signature validity alone is never sufficient.

Rotating the signing secret is a two-step swap that never breaks live keys: move the current MAPR_KEY_SECRET to MAPR_KEY_SECRET_PREVIOUS, set the new value as MAPR_KEY_SECRET, and re-mint at your own pace. Verification does a constant-time compare against both secrets, so keys signed by the old secret keep working through the overlap window; drop MAPR_KEY_SECRET_PREVIOUS once everything is re-minted. Mint, rotate, and revoke keys in the dashboard.

AdaptivMapr ships an MCP server so an AI coding environment can call the cascade directly. Add the block below to your MCP config — ~/.cursor/mcp.json for Cursor, or the Claude Desktop config file — and restart the client. The ADAPTIVMAPR_API_KEY is optional: a set of no-key preview tools runs with no key at all.

Every map bills a small flat per-map fee (a few tokens), even a fully-deterministic map or a cache-hit re-map. On top of that, every header runs through five layers, cheapest-first, and the moment a layer accepts a column, the layers below it never run. Only the metered LLM layer bills real AI tokens, so keeping columns out of it is the single biggest cost lever in the system.

1. 1 · Statistics — no AI cost, deterministic. Confirmed mappings from past imports resolve the same header instantly.
2. 2 · Heuristic — no AI cost. Normalized comparison against the field’s column, label, and every multilingual hint.
3. 3 · Fuzzy — no AI cost, pure compute. Token-set ratio + Levenshtein tolerate typos and token-order drift.
4. 4 · Semantic — cheap, cached embeddings. Only runs when configured.
5. 5 · LLM — metered at provider cost cost × margin. Every header that fell through layers 1–4 is resolved in one collision-aware batched call.

Layers 1–3 are always on and never touch AI. The highest-leverage thing you can do to lower your LLM share is add multilingual hints to your templates: a hint that catches a header’s vocabulary pulls it up into the free heuristic layer, so it never reaches the metered call again. Every operation draws down a prepaid token wallet (a $10 minimum, shared across our suite). Read back consumption via GET /v1/usage.

Schema-only is the default data-minimization mode: only headers plus ≤3 sample rows (≤80 chars each) ever leave your environment — the clamp is enforced at the HTTP edge on every route that accepts sample rows. It is the safest way to map, though a map still bills the small flat per-map fee.

Full-data is gated behind an active AdaptivMapr subscription. The cascade still runs in-process exactly like schema-only; only the layer-5 LLM call goes out — to a PHI-eligible provider with X-PHI: true and an X-Region header, so the gateway forces a PHI-eligible, in-region model under BAA. Full-data PHI routing fails closed if the target host is not on the BAA-covered allow-list.

Retention. Uploads are held in edge storage (Cloudflare KV) with a 24-hour TTL and then expire automatically — the response carries an expires_at. AdaptivMapr does not retain your raw records beyond that window. For the full data-flow, sub-processors, and controls, see /legal/security.

Every correction you confirm feeds the statistics layer, so the same header resolves without AI next time. Crucially, what is recorded is header-to-field statistics only — the normalized column name and the target field it was confirmed against. No cell values, no sample rows, and no record content are stored in the learning signal.

• Scoped to your workspace. Learning is keyed by tenant_id and enforced by row-level security — there is no cross-tenant sharing of statistics or layouts.
• Leaves the workspace: nothing. The signal is header names and the field they mapped to, retained inside your tenant only.
• Never leaves: raw records, cell values, and sample rows are never part of what one import teaches the next.

Connectors are ingest sources — a file drop, a URL, or an inbound webhook — configured per workspace under /v1/connectors, with their secrets encrypted at rest. A connector can run sync-on-demand (you trigger a sync) or on a schedule (a cron picks up new data automatically).

Outbound webhooks deliver validated rows to your endpoint on commit. Each delivery carries an X-AdaptivMapr-Signature header: an HMAC-SHA256 computed with the webhook secret you set, over the string ${timestamp}.${body}. The timestamp prefix gives you replay protection — reject any request whose signature does not recompute, or whose timestamp is stale. Failed deliveries are retried and dead-lettered.

Beyond per-pair statistics, the whole confirmed mapping for an exact header row is cached as a layout, keyed by a sha256 fingerprint of the normalized header row. Commit records the layout automatically, and when the same header row arrives again POST /v1/layouts/lookup returns it so an importer can offer one-click “reuse last mapping.” A re-map that hits this cache uses no AI — you pay only the flat per-map fee. Layouts are workspace-scoped — no cross-tenant sharing.

A schema (template) is the shape you map onto. Templates ship in packs — Core, CRM, E-commerce, Healthcare, Finance & Payments (PCI), and HR & People (PII) — and each field carries multilingual hints (DE/FR/IT/EN/ES) and typed validators (regex, IBAN, BIC, GTIN, LOINC, ICD-10, ATC, CPT, NPI, GLN, and more). Healthcare templates additionally carry a fhir_resource mapping.

Every template declares a risk level (low / medium / high). Any medium/high template surfaces requires_hitl: true on the mappings response so you can gate your own review before commit. List them via GET /v1/templates, read one schema with GET /v1/templates/:id, or browse the catalogue. For the FHIR emit path, see FHIR mapping.

Every commit and confirmation is hashed and written to an append-only audit trail with the mapping fingerprint and accepted/skipped counts, so you can reconstruct exactly which rows landed from which file and when. The dashboard exposes your compliance posture and a print-for-auditor view over that trail.

Schema-only mode minimises exposure because raw records never leave your environment; full-data mode is covered by a BAA and in-region PHI routing (see PHI mode). Data-flow, sub-processors, and security controls are documented at /legal/security.