Food & Drink — entry 019 of 20

WhiskyHunter

Verified Jul 2026

WhiskyHunter aggregates historical results from online whisky auctions — winning-bid averages, trading volume, and lot counts across dozens of auction houses over time — as a free, keyless, read-only statistics API. A live GET against the real gateway, whiskyhunter.net/api, returned genuine JSON with no Access-Control-Allow-Origin header, resolving cors unknown -> no; auth None was reconfirmed by the same keyless 200.

WhiskyHunter aggregates historical results from online whisky auctions -- winning-bid averages, trading volume, and lot counts across dozens of auction houses over time -- as a free, keyless, read-only statistics API. A live GET this run against `/distilleries_info/` returned **160 distilleries across 7 countries**, and `/auctions_data/` returned **2104 monthly rows from 31 auction houses spanning 2005-11-01 to 2024-07-01**. That series stops at mid-2024 -- roughly two years stale as of this run -- so treat it as a historical archive, not a live or current feed.

whiskyauctionsmarket-datastatistics
AuthenticationNone requiredCall it straight away — no key, no signup.
HTTPSSupportedTraffic is encrypted in transit.
CORSDisabledBrowser calls need a server-side proxy.
PricingFreeNo paid tier — free for the documented use case.
FormatsJSONResponses can be requested as JSON.

GreatAPIs Score

Score74out of 100
Authentication25/25No authentication required
Pricing20/20Free to use
Docs0/20No docs or spec available
Formats9/15Single response format
Freshness20/20Verified within 6 months

Embed this badge

Scored 74 on greatapis.com
<a href="https://greatapis.com/api/whiskyhunter/"><img src="https://greatapis.com/badge/whiskyhunter.svg" alt="Scored 74 on greatapis.com"></a>

Auth quickstart

  1. No API key, signup, or credit card required -- a live GET this run against `/distilleries_info/` returned a genuine 160-distillery array with zero credentials. There's no key to add for browser use either: see the CORS gotcha below, since a plain server-side GET and a browser `fetch()` behave differently here even though both are equally keyless.
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.

List every distillery WhiskyHunter tracks

GEThttps://whiskyhunter.net/api/distilleries_info/

200 application/json

[{"name":"Aberfeldy","slug":"aberfeldy","country":"Scotland"},{"name":"Aberlour","slug":"aberlour","country":"Scotland"}]

This is a trimmed 2-item excerpt of the real 160-entry array (fields shown unchanged); the full response carries every tracked distillery's `slug`, which is the id every other route keys off -- `/distillery_data/{slug}/` for a single distillery's monthly stats, or `/auction_data/{slug}/` for a single auction house's, using an auction slug from `/auctions_data/` instead.

Try it

Developer reference

Base URLhttps://whiskyhunter.net/api
Key endpoints
  • GET/distilleries_info/
  • GET/auctions_data/
  • GET/auction_data/{slug}/
  • GET/distillery_data/{slug}/

Gotchas & limits

  • **The auction time series ends 2024-07-01 -- it is not current or live.** A live GET this run against `/auctions_data/` confirmed the newest `dt` across all 2104 rows is `2024-07-01` and the oldest is `2005-11-01`; nothing has been added in roughly two years. Don't describe results from this API as "current auction prices."
  • Every route requires the **trailing slash** -- a live GET this run against `/distilleries_info` (no slash) returned `HTTP 301` redirecting to the slashed form, while `/distilleries_info/` returned `200` directly. A client that doesn't follow redirects gets nothing back on the un-slashed path.
  • A per-distillery or per-auction lookup for an unknown slug is a genuinely **empty HTTP 404** -- a live GET this run against `/distillery_data/not-a-real-distillery/` and `/auction_data/not-a-real-auction/` both returned `404` with `content-length: 0`, no JSON error body at all -- unlike the list routes (`/distilleries_info/`, `/auctions_data/`), which always return a real JSON array. Code that calls `.json()` unconditionally will throw on a bad slug.
  • There is no `Access-Control-Allow-Origin` header on any route, with or without an `Origin` header sent -- a live GET this run against `/distilleries_info/` confirmed it's absent even when the request carried `Origin: https://example.com`. Server-side requests are unaffected; a real browser `fetch()` from another origin gets blocked by the browser itself.