One entry, read closely
API of the Week.
Each issue takes one entry from the atlas and reads it properly: what it actually does, what it costs, and what breaks. Every fact in the piece is either checked live against the API the same week or linked to its source — the auth, CORS, and pricing panel on the article renders straight from the same record as the API's own page, so it can't drift out of sync.
Subscribe via RSS ↗TVMaze
One 404 carries a CORS header. The other 404, right next to it, does not
Issue thirty-four covers TVmaze, the keyless JSON API for TV show and episode data. This session queried it live. A request for a show ID that does not exist returns a 404 that any browser script can read. A request for a route that does not exist returns a different 404, with no such header, so the same script cannot read it. The documented rate limit did not trigger once across thirty rapid calls.
NHTSA
A wrong VIN still gets a 200, and a wrong path names NHTSA's own backend
Issue thirty-three covers NHTSA's vPIC, the US government's keyless vehicle-data API. This session queried it live. Leaving out the format parameter switches the whole response to XML. Feeding it a broken VIN returns success at the top level, with the real complaint buried inside the result row. A path that does not exist returns a 404 that names the internal host running behind the public one.
Dicebear Avatars
DiceBear ignores a bad option name and rejects a bad option value
Issue thirty-two covers DiceBear, a keyless avatar API. This session queried it live. A wrong query key gets silently dropped. A wrong query value gets a 400. Leaving the seed out does not add randomness, and the generated PNG carries its own credit line inside the file.
Archive.org
The Internet Archive's metadata API gives a missing item the same 200 as a real one
Issue thirty-one covers the Internet Archive's Metadata, Wayback, and Advanced Search APIs. All three need no key. This session queried each live. A missing item, a missing domain, and a missing parameter each answer differently, and none of them use a 4xx status to say so.
Open Food Facts
Open Food Facts answers a missing barcode with 200, not 404
Issue thirty covers Open Food Facts, the crowdsourced food database. It needs no key. This session queried it live. A barcode that matches no product still returns 200. The server also rewrites the barcode you send before it looks anything up, and the full product record runs to tens of kilobytes unless you ask for less.
Mempool
The mempool.space API splits across two backends, and each one fails differently
Issue twenty-nine covers mempool.space, the free Bitcoin block explorer and fee API. It needs no key. This session queried it live. Two separate backends sit behind one /api prefix, a bad address returns a different error shape than a bad transaction ID, and an address with zero history still returns 200, not an error.
US Weather
The US National Weather Service API redirects your coordinates and blocks a blank User-Agent
Issue twenty-eight covers the US National Weather Service API, the free forecast and alerts service behind api.weather.gov. It needs no key. This session queried it live. A precise coordinate gets rounded and redirected, a 404 for a bad path looks the same as a 404 for missing data, and a blank User-Agent header gets blocked before the API ever sees the request.
Chronicling America
Chronicling America's pagination has two counters, and they count different things
Issue twenty-seven covers Chronicling America, the Library of Congress's archive of historic US newspaper pages. Its search API needs no key. This session queried it live. One field counts items and a second counts pages, one documented endpoint hides its rows a level deeper than the response's top, and the retired old host now forwards through two HTML redirects instead of answering in JSON.
Blockscout
Blockscout's rate limit is set per route, not per API
Issue twenty-six covers Blockscout, the open-source block explorer behind dozens of public chain explorers. Its REST API needs no key. This session queried it live. The rate limit budget changes from one endpoint to the next, and each hosted instance can fail on its own.
National Vulnerability Database
NIST's vulnerability database puts its errors in a header, not the body
Issue twenty-five covers the National Vulnerability Database API from NIST. It serves the government's canonical feed of CVE records, no key required. This session queried it live. A bad request returns an empty body. The error text sits in a response header instead.
Metropolitan Museum of Art
The Met's collection API tells you when a search finds nothing, but not with an empty list
Issue twenty-four covers the Metropolitan Museum of Art's Collection API. It serves over 502,000 objects from the Met's Open Access collection, no key required. This session queried it live. A search with zero matches does not return an empty array. It returns null.
LAPIS
LAPIS answers a genomics query with a request ID and a GitHub link
Issue twenty-three covers LAPIS, the keyless read API behind covSPECTRUM's SARS-CoV-2 genomic data. This session queried it live. Every response, success or not, carries a data-version stamp, a request ID, and an invitation to file a GitHub issue. An unknown country name does not return an error. It returns a real count of zero.
Bluesky
Bluesky's public API fails four different ways. None of them is a 404
Issue twenty-two covers Bluesky, the AT Protocol social network's public, keyless read API. This session queried it live and deliberately tried to break it. An unimplemented method returns a real 501. A well-formed but unregistered handle returns 400. A request missing a required parameter returns a different 400. And a request for a post that does not exist returns a 400 whose own error field is named NotFound. Four requests, four failure shapes, zero 404s.
Transport for Paris, France
RATP's Paris open-data catalog has 26 datasets. Accessibility is not one of them
Issue twenty-one covers Transport for Paris, France: RATP's own open-data catalog for the Paris metro, RER, tram, and bus network, built on the Opendatasoft Explore API with no key needed. This session queried it live. The catalog holds 26 datasets: 11 on per-station air quality, 9 on annual station entry traffic, 5 on network points of interest, and 1 peak-hour attendance pilot at La Défense. The catalogue's own listing claimed a theme the live data does not back up, station accessibility. That claim is now fixed.
UK Carbon Intensity
UK Carbon Intensity answers an unknown path with HTTP 200 and a body that calls itself a 400
Issue twenty covers the UK Carbon Intensity API, a carbon-intensity forecast and generation-mix feed for Great Britain's electricity grid, published by National Grid ESO with no key or sign-up. This session queried it live. It found a status line that disagrees with its own response body, a documented example postcode that fails against the live endpoint, and a national figure that ran less than half a same-instant regional one.
OpenF1
OpenF1 returns the same 404 for an empty query, a bad session key, and a typo in the URL
Issue nineteen covers OpenF1, an open-source Formula 1 data API with car telemetry, lap times, and session data, all free with no key or sign-up. This session queried it live. It found a single 404 shape that covers three unrelated failures, comparison-operator filters and CSV output that both work anonymously, and a documented rate limit with no headers to show it in action.
Creative Commons Catalog
Openverse's anonymous search stops at 240 results, and paging past it returns a 401
Issue eighteen covers Openverse, a search engine for openly licensed and public domain images and audio. It grew out of the old Creative Commons catalog. This session queried it live, with no key and no sign-up. It found a hard 240-result cap on anonymous search, rate-limit headers that barely move, and per-source counts putting the image catalogue past 915 million works.
Cataas
Cataas has more tags than most APIs have endpoints, and the catalogue undercounted its image formats
Issue seventeen covers Cataas, Cat as a Service: a keyless API that returns cat images and metadata, with a text-overlay route and a huge, uncurated tag list. This session queried it live, with no key and no sign-up. It found a tag vocabulary bigger than the image collection, three image formats missing from the catalogue's own record, and a 404 on any tag that does not exist.
Dungeons and Dragons
One D&D API serves two rulebooks, but its own spec only documents one
Issue sixteen covers the D&D 5e SRD API, a keyless reference for Dungeons & Dragons rules built by the 5e-bits project. It is not an official Wizards of the Coast product. This session queried its REST and GraphQL endpoints live, with no key and no sign-up. It found a second, newer ruleset served from the same host but missing most of its content, and a rate-limit counter that resets almost every call.
Universalis
A Universalis price carries two timestamps, and they can be 13 hours apart
Issue fifteen covers Universalis, the market board API that Final Fantasy XIV players built for the game's own economy. Square Enix has no official part in it. Every price in it comes from a player's game client, uploaded through a community plugin. This session queried its item, world, data center, and tax-rate endpoints live, with no key and no sign-up. It found a real gap between two timestamps on the same response, and a set of endpoints that don't all cache the same way.
QuickChart
QuickChart turns a broken chart config into a blank image, not an error
Issue fourteen covers QuickChart, an API that renders a Chart.js config into an image instead of returning JSON. This session generated charts, a QR code, and an SVG, all with no key and wide-open CORS. It also found a gap: a config that fails to parse gets a plain-text error in a response header. A config that parses fine but names an unsupported chart type returns 200 and a blank picture instead, with no error signal anywhere in the response.
Fed Treasury
Fiscal Data answers with no key, no rate-limit header, and a 400 for a typo'd filter
Issue thirteen covers Fiscal Data, the U.S. Treasury's open API for federal financial records. This session queried debt, exchange rates, pagination limits, and an unknown filter field. Every call returned in about one second with no key and no sign-up. The API sends no rate-limit header at all, on any call.
Nominatim
Nominatim's reverse lookup, given the Eiffel Tower's own coordinates, returns a defibrillator instead
Issue twelve covers Nominatim, the free geocoder built on OpenStreetMap data. This session sent a forward search, an ID lookup, a GeoJSON search, and two reverse lookups at different zoom levels. Every call returned 200 with no key. Neither reverse call returned the landmark whose own coordinates it was given. A later run of probes showed that the place_id in an answer changes with whichever backend replies.
InfraNode
InfraNode puts a retry-after header on a 200, and names the exact licence behind every number it returns
Issue eleven covers InfraNode, a free proxy over German city open data. This session called four endpoints live. Every response carried real rate-limit headers, even the successful ones. Every payload named its source agency and licence. One city's air-quality reading came back empty this session, while another city's was two hours old.
Open Library
Open Library documents a 1-request-per-second limit, but no response tells you when you are close to it
Issue ten covers Open Library, a free and keyless book catalog from the Internet Archive. Its docs state a clear rate limit. This session sent eight rapid, back-to-back requests with no delay and got a 200 response every time, with no header on any call that names a limit or a remaining count.
Open Brewery DB
Open Brewery DB is free and keyless, but its own homepage is wrong about rate limits
Issue nine covers Open Brewery DB, a keyless directory of breweries, cideries, and bottle shops. Its homepage promises no rate limits. Every response this session carried a real, counting-down rate limit header that says otherwise.
Jikan
Jikan turns MyAnimeList into a keyless REST API, rate limit and all
Issue eight covers Jikan, an unofficial wrapper that scrapes MyAnimeList so anyone can query anime and manga data without a key or an account. Past issues quoted a documented rate limit; this session hit Jikan's for real, a genuine 429 mid-probe.
Art Institute of Chicago
The Art Institute of Chicago opens its whole collection, 132,681 objects and counting, with no key required
Issue seven covers the Art Institute of Chicago's public API, a keyless, versioned endpoint that serves the same artwork data behind its own website and mobile app. Every figure below came from a live call made this session, including a total that has already grown past the 130,000-plus the catalogue entry currently quotes.
StackExchange
StackExchange: 365 sites behind one endpoint, no key needed to read any of them
Issue six covers StackExchange's API, the single versioned endpoint that answers for Stack Overflow and every other site on the network. Every number below came from a live call made this week, including a full page-out of the site list that landed on a bigger count than the one line describing this entry currently claims.
CoinGecko
CoinGecko: 18,000+ coins, no key required to start reading
Issue five covers CoinGecko, one of the largest independent crypto data aggregators, whose free public endpoint answers price and market queries with no signup at all. Every number below came from calling the live API and reading the live docs this week, including a rate limit we hit ourselves.
GBIF
GBIF: 3.9 billion species records, no key required to read them
Issue four covers the Global Biodiversity Information Facility, a nonprofit-run index of species and occurrence data that stays open for reading and only asks for an account once you want a bulk download. Every number below came from calling the live API this week.
Frankfurter
Frankfurter: exchange rates from 84 central banks, no key required
Issue three covers a currency-conversion API that blends official rates instead of leaning on one source. Every number below came from calling the live host this week, including its move off the old frankfurter.app domain.
Pokéapi
PokéAPI: the Pokémon dataset with no key and (almost) no limit
Issue two covers a RESTful catalogue of species, moves, abilities, and evolution chains that's been keyless since launch. We re-checked every claim this week, including the fair-use policy that replaced its old rate limit.
Open-Meteo
Open-Meteo, the weather API that skips the sign-up form
Our first pick blends forecasts from more than a dozen national weather services into one endpoint, and you can call it right now without registering.