Health — entry 021 of 23
Open Disease
disease.sh aggregates COVID-19, influenza, and general public-health case/vaccination data from Johns Hopkins CSSE, WHO, and other public feeds into a single keyless JSON API, with endpoints scoped by country, US state, or continent plus historical time-series. A live GET against disease.sh/v3/covid-19/all and a live Origin-header probe both return Access-Control-Allow-Origin: *, reconfirming the already-stored 'yes'.
disease.sh ("Open Disease") is a free, keyless JSON API aggregating COVID-19, influenza, and general public-health case data from Johns Hopkins CSSE, WHO, and other public feeds, with endpoints scoped by country, US state, or continent plus historical time-series. A live GET against disease.sh/v3/covid-19/all this run returned an unconditional access-control-allow-origin: * header, and the response passes through a Cloudflare edge (server: cloudflare) without any interstitial challenge.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/open-disease/"><img src="https://greatapis.com/badge/open-disease.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key, header, or signup required for any documented endpoint. The docs.disease.sh page is a client-rendered Swagger UI shell — its static HTML carries no rate-limit or quota text — and five rapid sequential GETs to /v3/covid-19/all this run all returned 200 with no rate-limit header of any kind, so any limit (if enforced) sits above that burst size.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Get the current global COVID-19 summary
GEThttps://disease.sh/v3/covid-19/all
{"updated":1785269249845,"cases":704753890,"todayCases":0,"deaths":7010681,"todayDeaths":0,"recovered":675619811,"todayRecovered":790,"active":22123398,"critical":34794,"casesPerOneMillion":90413,"deathsPerOneMillion":899.4,"tests":7026505313,"testsPerOneMillion":884400.59,"population":7944935131,"oneCasePerPeople":0,"oneDeathPerPeople":0,"oneTestPerPeople":0,"activePerOneMillion":2784.59,"recoveredPerOneMillion":85037.8,"criticalPerOneMillion":4.38,"affectedCountries":231}Developer reference
https://disease.sh/v3/Gotchas & limits
updatedis a Unix timestamp in milliseconds, not seconds — the live value above (1785269249845) is 13 digits; feeding it straight into a seconds-basedDateconstructor lands in the year 58000-something.- A country-scoped lookup that doesn't match returns HTTP 404 with a plain message body, not an empty result: a live
GET /v3/covid-19/countries/Wakandathis run returned{"message":"Country not found or doesn't have any cases"}at 404, while a matching country like/v3/covid-19/countries/USAreturns the full 200 record — branch on status code, not on an empty array, since there is no array here at all. - access-control-allow-origin: * is sent on every response this run with no Origin request header needed — confirmed on both the /all summary above and the country lookup — so no proxy is required for browser-side calls.
- The response is served through a Cloudflare edge (
server: cloudflare,cf-cache-status: DYNAMICobserved live) but this run saw no interstitial challenge or blocked request on any /v3/covid-19/* path — unlike this catalogue's covid-tracking-project entry, which does hit a Cloudflare "Just a moment..." challenge from this sandbox.