Issue Nº 52 — Nov 1, 2026
The Nobel Prize API returns 200 for a laureate that does not exist
Issue fifty-two covers the Nobel Prize API in the Open Data category. It needs no key and sends a wildcard CORS header. This session queried version 2.1 live. An unknown laureate id returns HTTP 200 with no laureate. A bad category filter is ignored. The pagination links point to a different host.
An unknown laureate id is a 200 with only a meta object
This session sent GET https://api.nobelprize.org/2.1/laureate/999999. The API returned HTTP 200. The body was an array with one object, and that object held only a meta key. The meta key had three links: terms, license and disclaimer.
A client that checks only the status code will think the laureate exists. Check that the array holds a record, not only a meta object.
A bad category filter is ignored
GET /2.1/nobelPrizes?nobelPrizeCategory=xyz&limit=2 returned HTTP 200. Its meta.count was 688. That is the count for the whole prize list, so the API did not apply the filter.
A valid code works. GET /2.1/nobelPrizes?nobelPrizeCategory=phy&limit=1 returned a meta.count of 126. Check the category code on your side before you send it.
A page past the end is also not an error. GET /2.1/nobelPrizes?offset=688&limit=2 returned HTTP 200 with 0 prizes and a count of 688.
The pagination links use another host
In a /nobelPrizes response, the links object holds first, self, next and last. In this session each one began with http://nobel-external-api-app.azurewebsites.net/2.1/nobelPrizes. That is a plain http address on an Azure host, not api.nobelprize.org.
The links inside each prize are different. For the 1901 physics prize, the link was https://api.nobelprize.org/2/nobelPrize/phy/1901. It uses version 2, not 2.1. The laureate link inside it was https://api.nobelprize.org/2/laureate/1.
Build the next page yourself from offset and limit. Do not follow the next link without a check. From this sandbox, a GET to the Azure host returned HTTP 403, and we did not find out why.
Prize amounts come in two forms
The 1901 physics prize, GET /2.1/nobelPrizes?nobelPrizeYear=1901&nobelPrizeCategory=phy, returned a prizeAmount of 150782 and a prizeAmountAdjusted of 10892857. The first is the nominal amount. The second is the amount adjusted to a recent value.
A query for nobelPrizeYear=2026 returned 6 prizes with award dates from 2026-10-05 to 2026-10-12. Each of the three that we sorted to the top had a prizeAmount of 12000000.
Every response we probed carried access-control-allow-origin: * and access-control-allow-methods: GET. No key was sent.