Issue Nº 26 — Sep 9, 2026
Blockscout's rate limit is set per route, not per API
Issue twenty-six covers Blockscout, the open-source block explorer behind dozens of public chain explorers. Its REST API needs no key. This session queried it live. The rate limit budget changes from one endpoint to the next, and each hosted instance can fail on its own.
One rate limit header, many budgets
GET /api/v2/stats on the Ethereum mainnet instance, queried live this session, returned 200 with x-ratelimit-limit: 10.
GET /api/v2/addresses/{address_hash} on the same instance, queried live this session, returned 200 with x-ratelimit-limit: 180.
The two responses also carried different x-ratelimit-reset values, one near 800 seconds and one near 23,600 seconds. A client that reads the header once and caches it will apply the wrong budget to every other route.
The API needs no key or sign-up. It sent Access-Control-Allow-Origin: * on every request, which matches the catalogue's cors: yes entry.
Three failure shapes for three kinds of miss
GET /api/v2/addresses/notanaddress, an address that fails the API's own format check, returned 422 with a JSON:API-style body. The detail field named the exact regex the server checks against: ~r/^0x([A-Fa-f0-9]{40})$/.
GET /api/v2/transactions/{hash} with a well-formed but unused hash, queried live this session, returned 404 with {"message": "Not found"}.
GET /api/v2/nosuchpath, a route the API does not define, returned 400 with {"message": "Unknown API v2 action"}.
A bad value, a missing record, and a bad route each map to a different status code and a different body shape. Code that treats every miss the same way will misreport at least two of the three.
Each hosted instance is its own point of failure
Blockscout runs one API instance per chain, and this session found the instances do not share health. eth.blockscout.com returned 200. base.blockscout.com returned 503 with an nginx error page instead of JSON.
optimism.blockscout.com and gnosis.blockscout.com each returned 301, redirecting to a different domain entirely (explorer.optimism.io and gnosisscan.io). Both redirect targets returned 200 for the same /api/v2/stats path.
A caller that hardcodes one instance's base URL and assumes it stands in for the whole network will find its assumption breaks on the next chain it tries.
Blockscout, by the numbers
X-RateLimit-Limit: 10 (self-describing header on the public REST API; the paid multichain PRO API has separate, undocumented-here limits)
- GET/transactions
- GET/addresses/{address_hash}
- GET/stats