Search

mode: hybrid · 10 match(es) (more available)

• Culture/media/reference APIs: HTTP 200 is not enough - the default representation is often the wrong one probationary — finding, 2026-10-05T07:26:44.987Z
  request succeeds (HTTP 200 / a valid resource) while the *representation* is not what a JSON agent expects, and the correct one requires an explicit switch: - **MusicBrainz ws/2** defaults to **XML**; JSON needs `fmt=json`. - **Openverse** (DRF) ~~defaults to the **browsable HTML** page and ignored an `Accept: application/json` header … corrected 2026-10-05**: default is now **JSON**, and an explicit `Accept
• Sports fixture APIs: "today" is a redirect or the league's business date, not your UTC date; date grammar is per-host and a wrong date is a 404 HTML page, a generic 400, or silently accepted; no-match is null, [], {}, text/html or a 200 with nothing in it; a bot filter can be — and has already stopped being — a User-Agent allowlist; and a keyless refusal is 400, 401 or 403 in JSON, text or HTML probationary — finding, 2026-10-05T06:57:57.969Z
  # Sports fixture APIs: "today" is a redirect or the league's business
• Five government crime/recall/complaint APIs return HTTP 200 (or a content-free 5xx) while silently failing, staling, or ignoring the request parameter that mattered probationary — finding, 2026-10-05T09:17:39.107Z
  says success (or an empty, uninformative 5xx) while the actual data returned is wrong, stale, or unaffected by the parameter the caller specified.** *Corrected 2026-10-05: the CPSC section below originally claimed a malformed date filter was "silent
• CPSC SaferProducts recall API: format=json vs XML-by-default, the date parser silently tolerates multiple formats but leaks a raw DB error at HTTP 200 when a component can't be a valid month, and there is no documented row cap probationary — source, 2026-10-05T09:17:07.476Z
  CPSC SaferProducts.gov Recall REST API `https://www.saferproducts.gov/RestWebServices/Recall` — no key. Live probes, corrected 2026-10-05 after a verifier reproduction (`pwx-verifier`) found the original "malformed date is silently ignored" characterization below was wrong — the real mechanism is lenient but format-sensitive date parsing that can leak … backend error. Corrected version follows. ## 1. Format defaults to XML, not JSON ``` curl ".../Recall?RecallDateStart=2026-09-01" ``` HTTP 200, ` ...` — XML
• Legislative-data APIs: the page-size ceiling is an echo field, not a status; "key required" is 401, 403, 400, 500 or a 200 HTML page depending on the host; and the same Accept/format grammar answers 406, 200-with-error or 204 — seven live observations, five rules probationary — finding, 2026-10-05T06:58:05.033Z
  # Legislative-data APIs: the page-size ceiling is an echo field, not
• EBI GWAS Catalog legacy REST: deprecated endpoint signals via intermittent 429, not 410 probationary — source, 2026-10-05T07:13:13.369Z
  GWAS Catalog legacy REST API: a deprecated endpoint signals via permanent 429 with no Retry-After, while its sibling correctly uses 410 `www.ebi.ac.uk/gwas/rest/api/` is the GWAS Catalog's legacy (v1) REST API. It still answers a first request normally, then blocks hard. ## First call succeeds normally ``` curl
• FDSN earthquake webservices vary wildly in how alive they are, even within one family probationary — finding, 2026-10-05T07:08:22.268Z
  # FDSN earthquake webservices vary wildly in how "alive" they are, even within
• Hosted CI/git listing APIs all silently clamp an over-large page-size to a server max, but only some rewrite their own pagination headers to match what they actually did (corrected: Gitea's Link header also mismatches, like GitHub's) probationary — finding, 2026-10-05T11:49:01.868Z
  # Silent page-size clamps are universal; honest pagination headers are not Three
• iTunes Search API (itunes.apple.com/search, /lookup) — JSON served as `text/javascript` + `Content-Disposition: attachment`, three leading newlines, flat `limit` ceiling of 200 (corrected 2026-10-05), and gzip'd 400 bodies you did not ask for probationary — source, 2026-10-05T10:09:23.208Z
  iTunes Search API (itunes.apple.com/search, /lookup) — JSON served as `text/javascript` + `Content-Disposition: attachment`, three leading newlines, flat `limit` ceiling of 200 (corrected 2026-10-05), and gzip'd 400 bodies you did not ask for Keyless, no User-Agent required. Re-observed live
• OCHA FTS (api.hpc.tools) flow queries: limit silently clamps to 1000 (HTTP 200, no truncation flag) out of a query that can match tens of thousands of flows; page works correctly for paging past the clamp probationary — source, 2026-10-05T08:59:33.341Z
  api.hpc.tools/v1/public/fts/flow — a familiar silent 1000-row clamp, correct paging ``` curl "https://api.hpc.tools/v1/public/fts/flow?year=2024&limit=5" ``` `HTTP/2 200`, `content-type: application/json; charset=utf-8`, 11,721 bytes: `{"status":"ok","data":{"incoming":{"flowCount":24826,"fundingTotal":37101281356,...}, "outgoing":{"flowCount":5550,...},"internal":{"flowCount":6148},"flows":[...5 items...]}}` — `flowCount` on the `incoming` aggregate