Games & Comics — entry 046 of 75

Monster Hunter World

Verified Aug 2026

MHW-DB is a free, keyless reference API for Monster Hunter: World covering monsters, weapons, armor, decorations, skills, items, locations, and ailments, with responses localizable to English, French, German, and simplified/traditional Chinese. The project has entered maintenance mode now that its authors launched a companion API for Monster Hunter Wilds (docs.wilds.mhdb.io), but the existing World data and endpoints remain fully live and unchanged.

MHW-DB is a free, keyless reference API for Monster Hunter: World with a JSON-document query DSL passed straight in the query string — nothing else in the atlas's Games & Comics seeds looks like this. A live GET this run against /monsters/1 returned a genuine 908 B monster object at HTTP 200, content-type: application/json.

monster-hunter-worldgame-datastatic-datawiki-data
AuthenticationNone requiredCall it straight away — no key, no signup.
HTTPSSupportedTraffic is encrypted in transit.
CORSEnabledCallable directly from browser JavaScript.
PricingFreeNo paid tier — free for the documented use case.
FormatsJSONResponses can be requested as JSON.

GreatAPIs Score

Score74out of 100
Authentication25/25No authentication required
Pricing20/20Free to use
Docs0/20No docs or spec available
Formats9/15Single response format
Freshness20/20Verified within 6 months

Embed this badge

Scored 74 on greatapis.com
<a href="https://greatapis.com/api/monster-hunter-world/"><img src="https://greatapis.com/badge/monster-hunter-world.svg" alt="Scored 74 on greatapis.com"></a>

Auth quickstart

  1. No API key, signup, or credit card required — the live GET above returned real monster data with no auth header of any kind attached. CORS echoes the caller's Origin rather than a fixed wildcard, so a browser fetch still works: a request this run with Origin: https://greatapis.com got back access-control-allow-origin: https://greatapis.com.
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.

Look up a single monster by id

GEThttps://mhw-db.com/monsters/1

200 application/json

{
  "id": 1,
  "type": "small",
  "species": "herbivore",
  "elements": [],
  "name": "Aptonoth",
  "description": "Docile herbivores that graze in packs. Their meat is considered a delicacy and is rich in nutrients. If one member of the herd is attacked, the rest will flee immediately.",
  "ailments": [],
  "locations": [
    { "id": 1, "zoneCount": 17, "name": "Ancient Forest" }
  ],
  "resistances": [],
  "weaknesses": [
    { "element": "fire", "stars": 1, "condition": null },
    { "element": "water", "stars": 1, "condition": null }
  ]
}

The entry's url in apis.json points at the docs host, https://docs.mhw-db.com/ (confirmed live 200, 249,399 B) — the actual API is served from the bare https://mhw-db.com, a different host with no shared path prefix.

Try it

Developer reference

Base URLhttps://mhw-db.com
Key endpoints
  • GET/monsters/{id}
  • GET/monsters
  • GET/locations
  • GET/ailments

Gotchas & limits

  • The most useful endpoint is a Mongo-style JSON filter passed as a URL-encoded query string, not a REST path or a documented query-param DSL. A live GET this run against /monsters?q={"type":"large"}&p={"name":true} returned 200, 913 B, a bare array of {"name":...} objects only — q is a filter document and p is a field projection, both raw JSON that must be URL-encoded. curl needs -g to send this literally, or it treats the braces as a glob pattern and silently sends no query at all.
  • Bad ids return a generic RFC-2616 problem document, not a custom error shape. A live GET this run against /monsters/999999 returned HTTP 404, 123 B: {"type":"https:\/\/tools.ietf.org\/html\/rfc2616#section-10","title":"An error occurred","status":404,"detail":"Not Found"} — the escaped type URL points at an obsolete RFC section, not a project-specific error page.
  • The unfiltered /monsters collection is large — 128,150 B confirmed live this run — so an unscoped GET without the q/p filter pulls the entire dataset over the wire every time.
  • CORS echoes the caller's Origin header rather than serving a fixed * — confirmed live above with Origin: https://greatapis.com. Don't hardcode an expectation of one exact access-control-allow-origin value.