Issue Nº 26 — Sep 9, 2026

Blockscout's rate limit is set per route, not per API

Issue twenty-six covers Blockscout, the open-source block explorer behind dozens of public chain explorers. Its REST API needs no key. This session queried it live. The rate limit budget changes from one endpoint to the next, and each hosted instance can fail on its own.

One rate limit header, many budgets

GET /api/v2/stats on the Ethereum mainnet instance, queried live this session, returned 200 with x-ratelimit-limit: 10.

GET /api/v2/addresses/{address_hash} on the same instance, queried live this session, returned 200 with x-ratelimit-limit: 180.

The two responses also carried different x-ratelimit-reset values, one near 800 seconds and one near 23,600 seconds. A client that reads the header once and caches it will apply the wrong budget to every other route.

The API needs no key or sign-up. It sent Access-Control-Allow-Origin: * on every request, which matches the catalogue's cors: yes entry.

Three failure shapes for three kinds of miss

GET /api/v2/addresses/notanaddress, an address that fails the API's own format check, returned 422 with a JSON:API-style body. The detail field named the exact regex the server checks against: ~r/^0x([A-Fa-f0-9]{40})$/.

GET /api/v2/transactions/{hash} with a well-formed but unused hash, queried live this session, returned 404 with {"message": "Not found"}.

GET /api/v2/nosuchpath, a route the API does not define, returned 400 with {"message": "Unknown API v2 action"}.

A bad value, a missing record, and a bad route each map to a different status code and a different body shape. Code that treats every miss the same way will misreport at least two of the three.

Each hosted instance is its own point of failure

Blockscout runs one API instance per chain, and this session found the instances do not share health. eth.blockscout.com returned 200. base.blockscout.com returned 503 with an nginx error page instead of JSON.

optimism.blockscout.com and gnosis.blockscout.com each returned 301, redirecting to a different domain entirely (explorer.optimism.io and gnosisscan.io). Both redirect targets returned 200 for the same /api/v2/stats path.

A caller that hardcodes one instance's base URL and assumes it stands in for the whole network will find its assumption breaks on the next chain it tries.

Blockscout, by the numbers

Rendered live from the atlas entry
AuthenticationNone required
HTTPSSupported
CORSEnabled
PricingFree
FormatsJSON
Rate limit

X-RateLimit-Limit: 10 (self-describing header on the public REST API; the paid multichain PRO API has separate, undocumented-here limits)

Key endpoints
  • GET/transactions
  • GET/addresses/{address_hash}
  • GET/stats
block-exploreropen-sourceevmmultichainrest-api

Sources

Facts checked Sep 2026