/ For developers & music-tech

Music distribution
infrastructure, built
as an API

Build label platforms, sub-distribution services, or native music-tech products on top of direct DSP contracts, DDEX-compliant delivery, and 20 years of distribution infrastructure. No intermediaries. No lock-in.

SpecREST + JSON:API
AuthOAuth 2.0
TransportDDEX 4.3 / 3.8.2
Sandbox5-minute setup
AI-nativeMCP server
Who builds on this

Built for teams that need
real infrastructure

The API is the same surface our own platform runs on. You're not using a thinner wrapper of a thinner reseller of a major distributor's API. Direct rails, all the way down.

/ AUDIENCE 01

Label platforms & sub-distros

Run your own multi-tenant distribution service. Approve releases. Manage splits. Issue payouts. Your customers never know the rails are ours.

Multi-tenant ingestion Per-release approvals 3-tier sub-accounts
/ AUDIENCE 02

Music-tech products

Distribution as a feature inside your app. A creator tool that ships to DSPs from a "publish" button. An A&R platform that signs and delivers in the same week.

Programmatic ingest Embedded delivery JSON:API spec
/ AUDIENCE 03

Merlin members & DSP-contract holders

Already have your own DSP / Merlin licensing? Use our SupplyChain + Analytics + Royalties as the delivery + reporting layer underneath your existing contracts.

Delivery-only mode DDEX feeds No licensing touch
Endpoints

One API for the entire
distribution lifecycle

Six resource groups cover catalog management, delivery, approvals, analytics, identity resolution and rights. Same auth, same envelope, same versioning across all of them.

GET
/v2/catalog RESOURCE · CATALOG

List, search and paginate the full catalog. Filter by UPC, ISRC, artist, release-date range, DSP delivery status. Cursor-based pagination. Sub-account scoping via Bearer token.

POST
/v2/distributions RESOURCE · DELIVERY

Trigger DDEX-compliant delivery of a release across one or more DSPs. Per-territory controls. Scheduled / timed releases. DDEX ERN 4.3 or 3.8.2 selectable per partner.

PATCH
/v2/approvals RESOURCE · APPROVALS

Pre-approve or reject submissions from sub-accounts before they ship. Reason codes. Bulk actions. Webhook-emit on state change so your moderation UI stays in sync.

GET
/v2/trends RESOURCE · ANALYTICS

Daily streaming trends per release, per DSP, per territory. Fraud-stream flags. In-house AI engine, not a reseller of someone else's analytics product. CSV/JSON export.

GET
/v2/dsp-ids RESOURCE · IDENTITY

Resolve a track or release to its DSP identifiers — Spotify URI, Apple Music ID, YouTube video set, ISRC, UPC. Bidirectional. Spotify URI detection for catalog reconciliation.

POST
/v2/ai/rights RESOURCE · RIGHTS

Declare AI-disclosure metadata, opt-in / opt-out for AI-DSPs, UGC whitelist / blocklist. Per-track publishing splits. Survives metadata updates post-delivery — no resubmission required.

AI-native

Your catalog responds
in natural language

The same data the API exposes is also available via limbo/Chat — the first MCP server in B2B music distribution. Connect Claude, ChatGPT or any MCP-compatible client and query your catalog, deliveries, royalties and analytics with words. Your data stays in your infrastructure.

  • Built on Anthropic's Model Context Protocol — no vendor lock-in
  • Bring your own LLM credentials — zero markup on AI calls
  • White-labelable: your clients see your brand, not ours
  • Data is never used to train the model
Standards

Speaking the standards
your auditor knows

Every transport spec, every wire format, every auth flow is something your engineering team has used before. No proprietary lock-in formats. Bring your stack as-is.

DDEX
4.3
DDEX ERN

Full support for ERN 4.3 and 3.8.2. Per-partner protocol selection. Backwards-compatible with downstream DSPs that haven't moved up yet.

JSON
:API
JSON:API

All REST responses follow the JSON:API spec. Sparse fieldsets, includes, cursor pagination. Predictable shape for codegen.

OAuth
2.0
OAuth 2.0

Bearer tokens with 1h TTL, multi-session, individual + global revocation, 2FA at the platform layer. Per-account rate-limiting.

GDPR
KYC
GDPR + KYC

Built under EU data-protection standards. KYC verification on every entity. Manual admin approval before access. Fiscal data + withholding handled.

Security & performance

Built to be the
system of record

Distribution data is rights-bearing financial data. The API is built like one — not like a content-management proxy.

/ AUTH

Bearer tokens · 1h TTL

OAuth 2.0. Multi-session per account. Individual token revocation. Global logout invalidates every session at once. 2FA enforced at the platform layer.

/ RATE

Per-user rate limits

Linear ramp by account tier. Burst-tolerant. Soft-fail with explicit retry headers so your worker pool doesn't queue death-spirals.

/ DELIVERY

24/48-hour SLA

Releases ship in 24–48h depending on metadata quality. Validation runs before queueing — broken submissions fail fast with line-level reasons.

/ ROLES

5 granular permissions

Admin · Manager · Label · User · Analyst. Admin impersonation logged for every assist. Sub-account release validation before propagation.

Modular

Take only the blocks
you need

The API is the transversal layer. Every Music Block ships its own resources under the same auth and envelope. limbo/Humans is always included; activate the rest as you grow.

CORE / MODULE 01

limbo/Humans

The foundational block. Real senior humans behind every integration, not a ticket queue. Included in every stack — you are not just another number.

Always includedSenior team
CORE / MODULE 02

limbo/Distribution

POST releases, manage UPCs / ISRCs, schedule per-DSP and per-territory drops. The thing the API was born for.

POST /distributionsDDEX 4.3
CORE / MODULE 03

limbo/Analytics

Daily streaming trends, fraud flags, AI engine in-house. Programmatic from day one — no human-readable dashboard required.

GET /trendsJSON / CSV
CORE / MODULE 04

limbo/Royalties

Independent · in-house · private by design. Line-by-line statements. Splits, recoupment, advances. Your data never leaves limbo/.

GET /royaltiesAudit-on-demand
SPECIALIZED / MODULE 05

limbo/API

The transversal layer itself. REST + JSON:API. OAuth 2.0. Sandbox in five minutes. MCP server bundled.

REST + JSON:APIOAuth 2.0
SPECIALIZED / MODULE 06

limbo/WhiteLabel

Run a fully-branded distribution platform under your own domain. 3-tier sub-accounts. Custom SMTP, logo, signup. "Provided to YouTube by your brand."

Custom domainMulti-tenant
SPECIALIZED / MODULE 07

limbo/SupplyChain

Delivery-only. For teams with their own DSP / Merlin contracts. We get your music + metadata where they need to go — under your contracts, not ours.

Delivery-onlyBYO contracts
SPECIALIZED / MODULE 08

limbo/YouTube CMS

Official YouTube Services Directory approved partner. OAC + Label Channels. Content ID + Claims.

Services DirectoryOAC · CMS
AI-NATIVE / MODULE 09

limbo/Agent Quality Control

Every release validated against Merlin + every major DSP's content-integrity policy before it ships. Acoustic fingerprinting. Human QC layer on top.

Pre-ship validationACR · Human QC
AI-NATIVE / MODULE 10

limbo/ChatPrivate beta · Q1 2026

The first MCP server in B2B music distribution. Natural-language catalog queries from Claude, ChatGPT, or any MCP-compatible client.

Anthropic MCP serverBYO LLM
In practice

See it in practice

Four operations you can run in five minutes against the sandbox. Same auth as production. No support ticket required.

/ 01 · LIST CATALOG
$ curl GET /v2/catalog?filter[artist]=Akua
    -H "Authorization: Bearer $LIMBO_TOKEN"

← 200 OK
  data: [
    { id: "rel_8x2yQpA9",
      attrs: { title: "The Blackest Joy",
                tracks: 12 } },
    ... 4 more
  ]
  meta.next_cursor: "c2..."
/ 02 · APPROVE A SUB-RELEASE
$ curl PATCH /v2/approvals/sub_3kdmZ
    -d '{"data":{"attributes":{
         "state": "approved",
         "note":  "passes Agent QC"
       }}}'

← 200 OK
  state: "approved"
  delivers_at: "2026-06-15T00:00Z"
  webhook: approval.granted → fired
/ 03 · PULL DAILY TRENDS
$ curl GET /v2/trends?
    filter[release]=rel_8x2yQpA9&
    filter[date.from]=2026-05-16

← 200 OK
  by_dsp: {
    spotify:  { streams: 142,803 },
    apple:    { streams:  38,201 },
    youtube:  { streams:  91,772 }
  }
  fraud_flags: 0
/ 04 · DECLARE AI-DISCLOSURE
$ curl POST /v2/ai/rights
    -d '{
       "track_isrc": "USUM72500842",
       "ai_disclosure": "none",
       "ai_dsps_opt_in": false
     }'

← 201 Created
  rights_id: "rt_19sM..."
  applies_to: 1 track
  effective:  "immediate"
Receipts

Infrastructure with
two decades of receipts

This isn't a wrapper. It's the same surface our own platform has been running on since the API became a first-class layer. Every claim below is verifiable, public, and not a promise.

Self-funded since 2006

Twenty years bootstrapped. Zero outside capital. Founder-owned. The platform you sign onto today will still be here next decade.

DSP contracts Direct

We own the licensing relationships. Spotify, Apple Music, YouTube, Tidal, Amazon, Beatport, TikTok — direct, plus Merlin Network for the rest.

Compliance DDEX 4.3

Latest DDEX ERN spec end-to-end. JSON:API on the REST side. GDPR + KYC built-in. EU and US regulatory standards.

AI-native MCP server

First MCP server in B2B music distribution. Catalog responds in natural language to any MCP-compatible client. Private beta Q1 2026.

Technical FAQ

Questions your
engineering team will ask

How do I authenticate?

OAuth 2.0 with bearer tokens. Tokens have a 1-hour TTL, support multi-session, and can be revoked individually or globally. 2FA is enforced at the platform layer for every account. Sandbox tokens are issued instantly; production tokens require KYC.

Which DDEX versions do you support?

ERN 4.3 and 3.8.2. Each delivery picks the version compatible with the downstream DSP. You don't need to know which is which — the partner-protocol map is maintained on our side.

Is there a sandbox?

Yes. Sandbox keys are issued from the developer console within five minutes of signup. Same API surface as production, isolated data, mock DSP responses. No sales call required for sandbox access.

What's the rate limit?

Per-account, linear by tier, burst-tolerant. Default sandbox: 60 req/min. Production starts at 600 req/min and scales with usage. Soft-fail with Retry-After headers so workers don't compound.

How long do deliveries take?

24–48 hours from POST /v2/distributions to live on platform, depending on metadata completeness and the specific DSP ingest cadence. Validation happens before queue — broken submissions fail in seconds with line-level reasons.

How are royalties reported?

Independent, in-house, private by design. Royalty data never leaves limbo/. Not exposed to major labels. Not exposed to venture capital. Line-by-line per DSP, territory and track. Splits, recoupment, advances. Available via GET /v2/royalties and as monthly CSV / XML.

Do you support webhooks?

Yes, in development. release.live, release.failed, approval.granted, royalty.statement.ready, claim.received. HMAC-signed payloads. Retries with exponential backoff. Beta access available on request.

Can I use it as a white-label backend?

Yes. limbo/API is the transversal layer; limbo/WhiteLabel sits on top with branded UI, custom domain, and 3-tier sub-account architecture. You can also build your own UI directly against the API.

What about AI / MCP server integration?

limbo/Chat is the first MCP server in B2B music distribution. Connect Claude, ChatGPT, or any MCP-compatible client to query catalog, deliveries, trends and royalties in natural language. Your data stays in your infrastructure; we do not train on it. Private beta, Q1 2026.

What does pricing look like?

Custom commercial proposals built around your catalog, your stack, and your business model. There is no generic price page because there is no generic customer. Start the conversation and we will scope an actual setup against your real numbers.

Start

Stop renting
distribution.
Own the stack

Read the spec. Run the sandbox. Or get a custom proposal scoped against your real catalog and business model.

A short qualification form. Sandbox keys arrive in your inbox within minutes. Senior engineering joins the first call.