Drupal.org vs Metabase

Drupal.org exposes its community project and node data through a legacy Drupal 7 REST endpoint (`drupal.org/api-d7/node.json`); a live unauthenticated GET returned a 200 JSON body with `Access-Control-Allow-Origin: *`, resolving cors "unknown" to "yes". It's a free community resource run by the nonprofit Drupal Association, with no authentication or paid tier for reading published project data.

Metabase is a self-hosted (or Metabase Cloud) open-source BI tool whose REST API is documented via an interactive OpenAPI/Scalar reference at `/docs/latest/api`; current docs describe generating an `x-api-key` from Admin settings for programmatic access, correcting auth from "None" to "API Key" (the older session-cookie login flow still exists but keyed API access is now the documented path). Its own `MB_DISABLE_CORS_ON_LOCALHOST` config option (default `false`) confirms the server sends CORS headers by default, consistent with cors "yes". The core server is free and open-source to self-host, with paid Pro, Enterprise, and hosted Cloud tiers layered on top.