CosIng API: query EU cosmetic ingredient data as JSON

Query the EU cosmetic ingredient database from your own code

The European Commission publishes CosIng, the reference list of cosmetic ingredients and the Annex II–VI records that prohibit, restrict or permit them. It is published for people to read, not for software to consume. This site keeps a parsed copy and serves it as JSON over a read-only HTTP API: no key, no registration, no quota to apply for.

Every example below is a complete request. Paste one into a terminal and it answers.

Look up a substance by name

The entries endpoint searches the annex records — the ones that carry the legal conditions.

curl 'https://cosingchecker.com/api/v1/entries/?q=titanium%20dioxide'

The answer is an envelope: count says how many records matched, results holds the page, and next and previous are ready-made URLs for the pages either side. Titanium dioxide returns five records, because it appears in more than one annex under different conditions.

Look up by CAS or EC number

An identifier is a safer key than a name. Both are accepted, and a record listing several CAS numbers matches on any of them.

curl 'https://cosingchecker.com/api/v1/entries/?cas=13463-67-7'
curl 'https://cosingchecker.com/api/v1/entries/?ec=236-675-5'

Read one record in full

Each result carries a slug. Ask for it directly and you get every field the record has: the maximum concentration, the product types, the wording of the warnings, the CMR classification, the SCCS opinions behind the rule.

curl 'https://cosingchecker.com/api/v1/entries/vi-27-titanium-dioxide/'

That answer includes a chemistry_url field. It points at the chemistry for the same substance, so you do not have to know that the endpoint exists.

Get the chemistry

8,115 substances are matched to NIH PubChem by checksum-valid CAS. The endpoint answers by CAS number, by PubChem compound id, or by InChIKey — the identifier chemistry databases agree on, which is the one to use when you are joining datasets.

curl 'https://cosingchecker.com/api/v1/substances/?cas=13463-67-7'
curl 'https://cosingchecker.com/api/v1/substances/?inchi_key=GWEVSGVZZGPLCZ-UHFFFAOYSA-N'

You get the molecular formula and mass, InChI and SMILES, hydrogen-bond counts, XLogP3 and TPSA, up to twenty synonyms, a link to the compound in PubChem and the date the data was retrieved.

Pull a whole annex

Annex II is the prohibited list. per_page goes up to 100, and next walks the rest.

curl 'https://cosingchecker.com/api/v1/entries/?annex=II&per_page=100'

1,739 records at the time of writing. The same filter works for III, IV, V and VI.

Everything with a CMR classification

curl 'https://cosingchecker.com/api/v1/entries/?cmr=1'

1,028 records carry a carcinogenic, mutagenic or reprotoxic classification in the source data.

The ingredient inventory, and the source organism

The inventory is the wider list of ingredient names, most of which carry no annex rule at all. Botanical names in those labels are resolved against Catalogue of Life, so you can ask for the family or the genus behind a label.

curl 'https://cosingchecker.com/api/v1/ingredients/?q=retinol'
curl 'https://cosingchecker.com/api/v1/taxa/?genus=Actinidia'

Markets beyond the EU

curl 'https://cosingchecker.com/api/v1/jurisdictions/'

Thirteen markets are mapped, each with the count of rules imported for it. Coverage differs by market and the response says so rather than implying completeness.

Point a client at the specification instead of this page

The API describes itself in OpenAPI 3.1. The document is generated from the routes, so it cannot describe an endpoint that does not exist or miss one that does.

curl 'https://cosingchecker.com/api/v1/openapi.json'

Conventions worth knowing

• Every collection answers with count and results. Paginated ones add page, per_page, next and previous.
• Errors answer with {"error": "..."} and an HTTP status, never an HTML page.
• A search endpoint asks for at least one filter and, if you give none, replies with the list of filters it accepts.
• Responses are cacheable for ten minutes and carry CORS headers, so a browser can call them directly.
• 120 requests per minute.

What this data is, and is not

This is a parsed copy of published official material, kept for reference. A record, an identifier match or a link to another database is identity evidence only — never permission, approval, proof of safety, or a statement of composition. A missing match means none was resolved here, not that none exists. Verify against the official source before any compliance decision, and see the sources page for the licence of each dataset.