One D&D API serves two rulebooks, but its own spec only documents one

What it covers

The API serves the D&D 5th edition System Reference Document: the free rules subset Wizards of the Coast publishes under an open licence. A live GET to /api/2014/ this session returned 24 resource collections. Spells came back at 319, monsters at 334, equipment at 237, and playable races at 9.

Every collection also answers through a GraphQL endpoint at /graphql. A live POST asking for the spell Fireball returned level 3 and school Evocation, the same facts the REST route /api/2014/spells/fireball would return, through one query instead of one request per field.

The bundled OpenAPI document lists 47 path templates, matching the entry's own specFile. Every one of them is scoped to /api/2014/. That scoping matters, because the live API serves a second version the spec never mentions.

Two rulebooks, one undocumented

A live GET to /api/2024/ this session returned its own index of 23 collections, covering the 2024 SRD revision. But the two versions are not equal. The 2024 monsters collection held only 3 entries this session, aboleth and two adult dragons (black and blue), against 334 in the 2014 version. 2024 equipment held 182 items, against 237 in 2014.

The 2024 index carries no spells key at all, unlike 2014's. A live GET to /api/2024/spells anyway, guessing the same pattern as the 2014 route, returned 404, with a nine-byte plain-text body reading Not Found. The 2024 rules exist in this API only as monsters, equipment, and the other 21 collections its index actually lists.

The one 2024 monster shared with 2014, the aboleth, shows a real rules change: challenge rating 10 in both, but hit points rose from 135 in the 2014 entry to 150 in 2024. The entry's heroEndpoints and bundled spec stay pinned to the 2014 paths, so the site's own detail page reads only the older, fully documented ruleset.

No key needed, and the preflight actually answers

Every GET probed this session, across both rulebook versions and the GraphQL endpoint, carried access-control-allow-origin: * with no key required, matching the auth: None on file. An OPTIONS preflight against /api/2014/spells, sent with an Origin header of https://greatapis.com, returned 204 with an access-control-allow-methods header listing GET, HEAD, PUT, PATCH, POST, and DELETE.

The old documentation path, /docs/, returned a 302 redirect to https://5e-bits.github.io/docs. That path redirects once more, with a 301, to https://5e-bits.github.io/docs/, which returned 200. That two-hop chain matches the migration already noted in the entry's own summary.

A rate-limit counter that resets almost every call

Eight rapid GETs to /api/2014/monsters/goblin this session each carried x-ratelimit-limit: 100. The remaining count read 99 on seven of the eight calls and 98 on one, rather than counting down in sequence. That matches the entry's own rateLimit note: the API runs behind multiple instances, each keeping its own counter, so a burst of requests rarely lands on the same instance twice in a row.

The x-ratelimit-reset timestamp advanced by roughly the same one-to-two seconds between calls that the entry's 2-second window describes. None of the eight calls returned a 429, and the count never fell far enough this session to test one.