Open Data — entry 043 of 44
Wikipedia
The MediaWiki action API that powers Wikipedia gives keyless access to full-text search, page content/extracts, revision history, and category membership across every language edition. A live probe of en.wikipedia.org/w/api.php confirms open, keyless reads and resolves the CORS story: browsers must append the documented `origin=*` query parameter (a plain Origin header alone is rejected as a "mismatch"), after which the response carries a wildcard Access-Control-Allow-Origin.
The MediaWiki action API that powers Wikipedia gives keyless, public access to full-text search, page content and extracts, revision history, and category membership across every language edition. It is the same API that backs the Wikipedia apps and countless third-party tools, so its two real quirks — a required User-Agent and a CORS opt-in via query parameter rather than a header — are worth knowing before the first real request.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/wikipedia/"><img src="https://greatapis.com/badge/wikipedia.svg" alt="Scored 94 on greatapis.com"></a>Auth quickstart
- No API key or account is required — reads are fully public and keyless.
- Set a descriptive User-Agent identifying your app plus a contact method. Omitting it is enforced live: a probe run in this session with a blank User-Agent got back a plain-text 403, "Please set a user-agent and respect our robot policy https://w.wiki/4wJS. See also https://phabricator.wikimedia.org/T400119."
- For browser (CORS) calls, append `origin=*` as a query string parameter — not an `Origin` header. Probed live in this run: a bare request and a request carrying only an `Origin: https://example.com` header both returned 200 with no `Access-Control-Allow-Origin` header at all (so a browser blocks them), while adding `&origin=*` to the query string returned `access-control-allow-origin: *` regardless of whether an `Origin` header was also present.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Search article titles and snippets
GEThttps://en.wikipedia.org/w/api.php?action=query&list=search&srsearch=Astro%20framework&format=json&srlimit=1&origin=*
{"batchcomplete":"","continue":{"sroffset":1,"continue":"-||"},"query":{"searchinfo":{"totalhits":567},"search":[{"ns":0,"title":"Web framework","pageid":2342095,"size":23827,"wordcount":2538,"snippet":"A web <span class=\"searchmatch\">framework</span> (WF), web application <span class=\"searchmatch\">framework</span> (WAF), or web development <span class=\"searchmatch\">framework</span> is a software <span class=\"searchmatch\">framework</span> that is designed to support the development","timestamp":"2026-07-08T06:04:23Z"}]}}srlimit=1 was requested directly in this run's probe, not truncated after capture — the single search hit is the complete, unmodified object. A real search can request up to srlimit=500 per call and paginate further pages using the returned continue.sroffset value.
Developer reference
https://en.wikipedia.org/w/api.phpGotchas & limits
- A missing or blank User-Agent gets a 403 rather than being served anonymously — confirmed live in this run (see authSteps). Identify your app and give a contact method.
- Browser CORS support needs the `origin=*` query parameter, not an `Origin` request header — confirmed live both ways in this run (see authSteps). Server-side calls without CORS concerns can skip it.
- Search results paginate via a `continue` object in the response body (e.g. `{"sroffset":1,"continue":"-||"}`), not an offset/limit pair you construct yourself — pass the returned `continue` fields back verbatim as query parameters to fetch the next page.