How it works
A dossier is at most 5page fetches, one plain GET, two searches and a single model call — and then a check that throws away anything the model produced that the pages don’t support.
Before anything costs money, the input is parsed and the host is resolved. A scheme that isn't http, an IP literal, a port, a reserved TLD, a name that resolves to a private network, a domain that doesn't resolve at all — each is refused with a 4xx and no charge. On the x402 rail this happens before a price is even quoted, so an agent is never asked to sign a payment for work that cannot happen.
The homepage plus 4 candidates — /about, /pricing, /careers, /contact — with one alternate each (/about-us, /company, /jobs, /contact-us…). Pages are rendered, not just downloaded, because a modern company site is a JavaScript shell. Chrome is kept, not stripped: the footer is where the address, the support inbox and the social links live.
One ordinary GET, for the response headers and the assets the page loads. That single free request is the whole tech-stack section — no vendor, no per-lookup fee. It is also where the discipline matters most: the Content-Security-Policy header is deliberately ignored, because it lists every host a site is permitted to contact rather than one it uses.
Emails, phone numbers, social profiles, live job links, headcount phrasing and the page list are read out of the fetched text with regular expressions. These are substrings of something we downloaded — there is no judgement involved and therefore nothing to invent. Roughly two thirds of a typical dossier is produced here.
Name, description, industry, headcount phrasing and postal addresses need reading comprehension, so those five go to a model — with the fetched pages as the only permitted source and an explicit instruction that a plausible invention is a defect.
Every model claim must arrive with a verbatim quote. We search for that quote in the pages we fetched. If it isn't there, the claim is deleted — and the count comes back to you as dropped_claims. A name is held to a second condition: it must appear inside its own quote, which is what stops "Acme Corporation" being produced from a page that only ever said "Acme".
Fewer than two of the nine signal groups resolved, or no page rendered at all? That is thin: 12 credits go back to the exact pools they came from and nothing is billed. Everything else settles, including the very sparse dossiers, because "this company publishes almost nothing" is a real finding.
What’s in one
The source check
Without it, the natural output for an obscure two-page website is a confident, complete and entirely invented company profile — which is worse than no product at all, because it is the kind of wrong an agent will act on.
For developers & AI agents
Three rails, one meter. Every call refuses rather than overdraws: an agent that runs out of credits gets a 402 with the exact shortfall and a link to top up, never a silent debt.
Bearer key or the shared Ounie session cookie. Synchronous — the dossier comes back on the same request, with every source URL attached.
curl -X POST https://company.ounie.com/api/dossiers \
-H "Authorization: Bearer cin_live_…" \
-H "Content-Type: application/json" \
-d '{"domain":"stripe.com",
"sections":["identity","stack","contact"]}'build_company_dossier, get_dossier, list_dossiers, get_dossier_schema, get_credit_balance, get_pricing, whoami. Works in Claude, Cursor, ChatGPT and the Ounie AI Team — that last one can't set headers, so the key rides the URL.
Endpoint https://company.ounie.com/api/mcp (legacy SSE: /api/sse)
Auth Authorization: Bearer cin_live_…
# Hosts that can't set headers (e.g. the Ounie AI Team):
https://company.ounie.com/api/mcp?api_key=cin_live_…Keyless agents pay on Base. A domain we can never research is refused for free, before a price is quoted; a domain that turns out to hold nothing is refused after verification but before settlement. Neither one takes your money.
curl -X POST https://company.ounie.com/api/x402/dossier \
-H "Content-Type: application/json" \
-d '{"domain":"stripe.com"}'
# → 402 { accepts: [{ scheme:"exact", network:"base",
# maxAmountRequired:"144000", payTo:"0x…" }] }
curl -X POST https://company.ounie.com/api/x402/dossier \
-H "X-Payment: <base64 signed payload>" -d '{"domain":"stripe.com"}'12 credits per dossier on the credit rails · $0.144 per dossier on x402 · the dashboard keeps every dossier you have built, free to re-read.
Questions
A model asked about a company answers from memory, and memory is where invented headcounts come from. Company Intel fetches the company's own pages first and builds the record only from what came back. Most of the dossier never touches a model at all — emails, phones, socials, the tech stack and the page list are read straight out of the fetched pages with no judgement involved.
Only five fields go to a model: the name, a description, the industry, headcount phrasing and postal addresses. Each one has to come back with a verbatim quote, and that quote is then searched for in the pages we actually fetched. A quote we cannot find means the claim is deleted — not softened, not marked low-confidence, deleted. The count comes back to you as dropped_claims.
Because that is what was on the site. A five-page brochure site for a plumbing company will give you a name, a phone number, a stack and not much else, and we would rather hand you that than fill the gaps with a plausible industry and a made-up headcount. An empty field means "not published", and that is itself useful information.
No — it is null when we could not tell, and a number only when we counted live job links on the careers page. Zero and null are different statements and we only make the one we can support. The same discipline applies everywhere: a missing field means unknown, never none.
12 Ounie credits — $0.12 in plain money, from the same wallet as every other Ounie app. No subscription, no minimum. A domain that resolves nothing usable is refunded in full, and reading or exporting dossiers you have already built is free forever.
No, it makes it faster. The billable unit is the dossier, so a request for just the contact surface costs the same as the full record. Narrow it when latency matters, not to save credits.
Yes. The x402 endpoint takes USDC on Base with no account and no key. A malformed domain, or one that resolves to a private network, is refused before a price is even quoted — you should never be asked to sign a payment for work that cannot happen. And a domain that turns out to hold nothing is refused after your signature is verified but before it settles, because an on-chain payment has no refund path.
Response headers and the assets the homepage actually loads. We deliberately never read the Content-Security-Policy header, which is the most tempting source and the worst one: it lists every host a site is permitted to contact, not one it uses, so mining it produces a long and confident stack for tools the company has never touched.
That is the only honest way to judge an enrichment tool: run it on something you can check, and look at what it left blank.