The Art Institute of Chicago opens its whole collection, 132,681 objects and counting, with no key required

What it covers

A plain GET https://api.artic.edu/api/v1/artworks?limit=1 this session returned pagination.total: 132681, ahead of the 130,000-plus figure written into the catalogue summary. The same response carries info.version: 1.14 and points to config.iiif_url: https://www.artic.edu/iiif/2, the IIIF image server that lets you request any artwork at whatever resolution you need instead of downloading one fixed-size thumbnail.

The license terms sit right in the response body: info.license_text marks the description field as Creative Commons Attribution 4.0, and everything else in the payload as CC0 1.0, meaning most of what comes back can be reused without attribution. Both terms link out to creativecommons.org and artic.edu/terms rather than being paraphrased.

Auth and pricing, as they actually work

No signup, no key, and no OAuth handshake. Every call behind this issue went out anonymous and came back with real data, matching the auth: None the catalogue already lists. There is no paid tier to compare it against; the museum's own docs simply ask that anyone needing more than the anonymous limit email engineering@artic.edu directly rather than sign up for a plan.

For anyone who wants the whole collection rather than a stream of API calls, the docs point at a GitHub repository, art-institute-of-chicago/api-data, that ships the same records as a downloadable dump. It is offered explicitly as the alternative to hammering the live API for bulk access.

Rate limits and CORS, confirmed live

The museum's own docs, fetched this session, state it plainly: anonymous users are throttled to 60 requests per minute, with each IP counted as a separate user, matching this entry's rateLimit field. Unlike some APIs in this catalogue, that ceiling never showed up as a response header in any of our calls; there is no x-ratelimit-remaining or similar to poll, only the documented number and whatever a 429 would eventually tell you.

CORS came back on every request. A GET to /artworks with an Origin: https://greatapis.com header returned access-control-allow-origin: *, and repeating the same call with no Origin header sent produced the identical value, so the access isn't conditional on the requesting origin at all.

Why it's worth a look

The OpenAPI spec already checked into this catalogue lists 103 paths, and all three of this entry's heroEndpoints resolve verbatim against it: GET /artworks, GET /artworks/{id}, and GET /artworks/search.

The search endpoint is worth trying directly. A query against /artworks/search?q=monet this session came back scored with Elasticsearch-style _score values on each hit, the kind of relevance ranking a simple field filter doesn't give you. Combined with the IIIF image server, that makes it possible to build a working image search over a real museum collection without ever touching a key.