Health — entry 021 of 23
Open Disease
disease.sh aggregates COVID-19, influenza, and general public-health case/vaccination data from Johns Hopkins CSSE, WHO, and other public feeds into a single keyless JSON API, with endpoints scoped by country, US state, or continent plus historical time-series. A live GET against disease.sh/v3/covid-19/all and a live Origin-header probe both return Access-Control-Allow-Origin: *, reconfirming the already-stored 'yes'.
disease.sh ("Open Disease") is a free, keyless JSON API aggregating COVID-19, influenza, and general public-health case data from Johns Hopkins CSSE, WHO, and other public feeds, with endpoints scoped by country, US state, or continent plus historical time-series. A live GET against disease.sh/v3/covid-19/all this run returned an unconditional access-control-allow-origin: * header, and the response passes through a Cloudflare edge (server: cloudflare) without any interstitial challenge.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/open-disease/"><img src="https://greatapis.com/badge/open-disease.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key, header, or signup required for any documented endpoint. The docs.disease.sh page is a client-rendered Swagger UI shell -- its static HTML carries no rate-limit or quota text -- and five rapid sequential GETs to /v3/covid-19/all this run all returned 200 with no rate-limit header of any kind, so any limit (if enforced) sits above that burst size.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Get the current global COVID-19 summary
GEThttps://disease.sh/v3/covid-19/all
{"updated":1785269249845,"cases":704753890,"todayCases":0,"deaths":7010681,"todayDeaths":0,"recovered":675619811,"todayRecovered":790,"active":22123398,"critical":34794,"casesPerOneMillion":90413,"deathsPerOneMillion":899.4,"tests":7026505313,"testsPerOneMillion":884400.59,"population":7944935131,"oneCasePerPeople":0,"oneDeathPerPeople":0,"oneTestPerPeople":0,"activePerOneMillion":2784.59,"recoveredPerOneMillion":85037.8,"criticalPerOneMillion":4.38,"affectedCountries":231}Developer reference
https://disease.sh/v3/Gotchas & limits
- `updated` is a Unix timestamp in **milliseconds**, not seconds -- the live value above (1785269249845) is 13 digits; feeding it straight into a seconds-based `Date` constructor lands in the year 58000-something.
- A country-scoped lookup that doesn't match returns HTTP 404 with a plain message body, not an empty result: a live `GET /v3/covid-19/countries/Wakanda` this run returned `{"message":"Country not found or doesn't have any cases"}` at 404, while a matching country like `/v3/covid-19/countries/USA` returns the full 200 record -- branch on status code, not on an empty array, since there is no array here at all.
- access-control-allow-origin: * is sent on every response this run with no Origin request header needed -- confirmed on both the /all summary above and the country lookup -- so no proxy is required for browser-side calls.
- The response is served through a Cloudflare edge (`server: cloudflare`, `cf-cache-status: DYNAMIC` observed live) but this run saw no interstitial challenge or blocked request on any /v3/covid-19/* path -- unlike this catalogue's covid-tracking-project entry, which does hit a Cloudflare "Just a moment..." challenge from this sandbox.