Look up the STR rules for any address

Authentication

Every request needs an API key. Send it in the X-API-Key header:

curl -H "X-API-Key: lf_live_YOUR_KEY" \
  "https://lawfulstay.com/api/v1/resolve?city=Denver&state=CO&country=US"

Authorization: Bearer lf_live_YOUR_KEY works too. Keys start with lf_live_.

• Getting a key. Buy an API plan on the API pricing page, or contact us for an enterprise account.
• Seeing your key. The full key is shown once, when it is created. After that your account page shows only its first few characters.
• Lost or leaked key. Use Revoke & Regenerate on your account page. The old key stops working at once.
• Keep keys on your server. Do not put them in a web page or mobile app, where anyone can read them.

Resolve an address

Returns the jurisdiction that governs a location, plus every layer of rules that applies to it.

Parameters

Send at least one of city, county, state, country, lat/lon or id. The more you send, the better the match.

Response

{
  "ok": true,
  "confidence": "medium",
  "match_method": "admin-city",
  "governing": {
    "jurisdiction_id": "us-colorado-denver",
    "level": "city",
    "jurisdiction_label": "Denver, Colorado",
    "status": "Restricted",
    "status_label": "Restricted — rules apply",
    "license_required": "Yes — requires both a general business license and a short-term rental license ...",
    "tax_rate": "Denver Lodger's Tax of 10.75% on taxable lodging ...",
    "rental_day_cap": "None for a primary residence ...",
    "primary_residence_required": "Yes — STRs are restricted to the host's primary residence ...",
    "last_checked": "2026-06-23",
    "source_url": "https://www.denvergov.org/...",
    "single_source_warning": false
  },
  "stack": [
    { "jurisdiction_id": "us-colorado-denver", "level": "city", ... },
    { "jurisdiction_id": "us-colorado-statewide", "level": "state", ... }
  ]
}

Fields

Other fields (fees, min_stay, occupancy_limit, penalties, zoning_restrictions and more) appear when the record has them. Values are plain text, written to be shown to people.

Short-term vs. mid-term viability

A plain-language verdict on whether nightly rentals (under 30 days) and 30+ day stays are workable in a city. It takes the same city, state, country and id parameters as /resolve, and answers only for cities we track (404 otherwise).

curl -H "X-API-Key: lf_live_YOUR_KEY" \
  "https://lawfulstay.com/api/v1/viability?city=Denver&state=CO"

{
  "ok": true,
  "jurisdiction_id": "us-colorado-denver",
  "viability": {
    "str": { "status": "Restricted", "label": "Viable w/ Restrictions (< 30 Days)", ... },
    "mtr": { "status": "Active", "label": "Viable for 30+ Day Stays (MTR)", ... }
  },
  "official_url": "https://www.denvergov.org/...",
  "last_verified": "2026-06-23"
}

Limits and quotas

Each account has a per-minute limit and a monthly quota, set by its plan. Every call made with your keys counts toward your account's quota, including calls that return 404. Quotas reset on the 1st of each month (UTC).

Each response tells you where you stand:

When the monthly quota runs out, your account does one of two things. New accounts start on Stop.

• Stop: calls return 429 until the next month starts.
• Continue: calls keep working, and the extra calls are added to your next invoice: $90 per 1,000 on Startup, $45 per 1,000 on Growth, and as agreed on Enterprise.

Your account page shows calls used this month. To change plans or the overage setting, contact us.

Errors

Errors return JSON with "ok": false and an error message.

Using the data

Records are researched from official government sources and re-checked twice daily. Each record carries its source and last-checked date. Regulations change, and this data is not legal advice. Before acting on a result, especially one with single_source_warning: true or parent-level confidence, confirm it with the official source.

When you show this data to your users, credit it as Source: LawfulStay (lawfulstay.com). See our methodology for how records are collected and verified.