Issue Nº 35 — Sep 18, 2026
Ask this API a broad question and it answers exactly 10,000, every time
Issue thirty-five covers the Federal Register API. It is the keyless US government service for rules, presidential documents, and public notices since 1994. This session queried it live. A broad search always reports a count of 10,000, even when the real match count is higher. A search with zero matches drops the results list, instead of returning an empty one. Every successful reply carries a wildcard CORS header. Neither 404 carries that header.
A successful search carries a CORS header. Neither 404 does
GET /documents.json?per_page=1, queried live this session with an Origin header, returned 200 with an access-control-allow-origin: * header and a JSON body.
GET /nosuchpath.json and GET /documents/nope-does-not-exist.json, queried live with the same Origin header, both returned 404. Neither carried an access-control-allow-origin header, and both served the same generic HTML error page instead of JSON.
The practical effect: a browser script on another domain can read a successful search result. The same script cannot read either 404 body. The browser blocks it before the script sees a byte, even though the server sent one.
A zero-match search drops the results list, not an empty one
GET /documents.json?conditions[term]=zzzzqqqqxx, queried live this session, returned 200 with the body {"description":"Documents matching 'zzzzqqqqxx'","count":0}. That response has no results key at all.
GET /documents.json?conditions[term]=xenotransplantation, a rare but real term, returned count: 136 and a full results array in the same session. The results key only shows up once a document matches.
A caller that reads response.results.length without a guard throws on the zero-match case. The safe check is count, not results.length.
The count field caps at 10,000, even when the real match is bigger
GET /documents.json, with no filter at all, returned count: 10000 this session. GET /documents.json for only the year 2020 also returned count: 10000. A one-year slice and the full archive since 1994 do not hold the same number of documents.
GET /documents.json?conditions[term]=xenotransplantation, a narrow real search, returned count: 136 in the same session, not 10000. So the field is honest below the cap. Once a query is broad enough, it freezes at exactly 10,000.
per_page adds a second gap. A request for per_page=2000 was honored live, and total_pages dropped to 5 to match. A request for per_page=1 was not honored; the response still held 20 results. A request for per_page=5000 was not honored either; it silently fell back to 20 results with no error.