This holiday API answers a yes/no question with an empty body

The yes/no endpoint answers with a status code, not a body

GET /IsTodayPublicHoliday/US, queried live this session, returned 204 with a zero-byte body. GET /IsTodayPublicHoliday/CL, queried in the same session, returned 200, also with a zero-byte body.

Neither response holds a true or false field. There is no JSON to parse. The only signal is 204 for no, 200 for yes.

A caller that runs response.json() on this endpoint fails on both outcomes, because there is nothing to parse. The correct check is the status code alone.

Three failure shapes, and every one keeps the CORS header

GET /PublicHolidays/1700/AT, queried live this session, returned 400 with a JSON body: {"title":"One or more validation errors occurred.","status":400,"errors":{"year":["The specified year '1700' is not supported."]}}. GET /PublicHolidays/2200/AT returned the same 400 shape.

GET /PublicHolidays/2026/ZZ, an unknown country code, returned a different 404 body: {"title":"Unknown country code","status":404,"detail":"The country code provided is invalid or not recognized."}. GET /NoSuchPath, an unknown route, returned a third shape: 404 with a zero-byte body and no content type.

Every one of those three responses, plus every successful call, carried access-control-allow-origin: *, confirmed live with an Origin header. That is the opposite of issue thirty-five's federal-register finding, where the 404s dropped the CORS header. Here, a browser script on another domain can read every error body, not just the successful ones.

The retired v2 path, GET /api/v2/PublicHolidays/2026/AT, returned an empty 404 too. It still carries the wildcard header, but there is no body to read.

A public holiday can be one state's holiday, not the whole country's

GET /NextPublicHolidays/DE, queried live this session, listed Weltkindertag with "global": false and "counties": ["DE-TH"]. It is a public holiday in Thuringia only, not across Germany.

Pulling Germany's full 2026 list from GET /PublicHolidays/2026/DE, ten of the nineteen rows carry global: false with a specific counties list. Reformationstag, for example, covers nine of Germany's sixteen states, not all of them.

A caller that treats every row from this endpoint as a nationwide day off is wrong for more than half of Germany's 2026 list. The global field, not just the presence of a date, decides whether a row applies everywhere.