Cataas has more tags than most APIs have endpoints, and the catalogue undercounted its image formats

What it covers

Cataas serves random cat images and GIFs from a fixed pool. A live GET to /api/count this session returned a count of 1,987. The core route is GET /cat, which returns a random image with no key and no query string.

A tag narrows the pool: GET /cat/cute returned a 137KB JPEG this session, and GET /cat/says/hello returned a 105KB JPEG with the text "hello" drawn over the image. Adding ?json=true to any of these routes swaps the binary for metadata instead: a live call returned an id, a tags array, a created_at timestamp, a direct url, and a mimetype field, with no image bytes in the response.

The bundled OpenAPI document, fetched live from /doc.json this session, lists nine path templates: /api/cats, /api/count, /api/tags, /cat, /cat/{id}, /cat/{tag}, and three text-overlay variants of those routes. The entry's specFile matches this document.

1,163 tags over 1,987 images

A live GET to /api/tags this session returned a JSON array of 1,163 tags, for a pool of 1,987 images. That works out to roughly one tag for every 1.7 images, and most of that vocabulary is thin: many tags likely match only a single photo.

The tag list is user-submitted and shows it. This session's fetch included an empty string, a bare full stop, the bare numbers "4" and "62", and a username, "@Beardlyness". None of these describe a cat. A client that lists every tag as a filter option, without checking how many images each one actually returns, would show a long list padded with junk and single-image dead ends.

GET /cat/zzzznotatag, a tag this session confirmed does not exist, returned a 404 with a 15-byte JSON body reading "Cat not found". The API does not fall back to a random image when a tag misses, so a typo in a tag name fails loudly rather than silently returning the wrong cat.

The catalogue's format list was short by three

The entry's formats field listed JSON, JPEG, and GIF. A live GET to /api/cats?limit=2000 this session returned all 1,987 records with a mimetype field, and the actual breakdown is wider: 1,566 JPEG, 267 PNG, 149 GIF, 4 WebP, and 1 AVIF.

PNG alone accounts for roughly 13% of the collection. WebP and AVIF show up too, though rarely. A client written against the old formats list, expecting only JPEG or GIF, would mishandle roughly one image in seven. This session's census now sets the entry's own formats field and lastVerified date.

No key, and the preflight answers

Every route probed this session, including the metadata mode and the tag endpoint, carried access-control-allow-origin: * with no key required, matching the auth: None on file. An OPTIONS preflight against /api/tags, sent with an Origin header of https://greatapis.com, returned 200 with access-control-allow-methods listing GET, POST, PUT, DELETE, and OPTIONS.

No rate-limit header showed up on any call this session, and none of the probes returned a 429. The entry carries no documented rate limit, and nothing found this session contradicts that.