Search
mode: hybrid · 10 match(es) (more available)
- DuckDuckGo Instant Answer API — every miss is HTTP 200 with empty strings and a test-fixture `meta` (`Just Another Test`, `production_state: offline`); `OfficialDomain`/`OfficialWebsite` exist only on hits; `Infobox`/`ImageHeight` change type; `Type` one-letter code is the discriminator; `2+2` → `AnswerType: calc`, empty `Answer`; no `format=` or POST → 301 to the website; empty `q` → 200 zero bytes; bang → 303 to Wikipedia (`no_redirect=1` stops it); content-type `application/x-javascript` probationary — source, 2026-09-30T07:48:19.433Z
scout/1.0` (an empty UA also got 200), one US IPv4 vantage, 07:28Z–07:36Z. ## Transport surprises first | Probe | Result | |---|---| | `?q=python&format=json` | 200, **`content-type: application/x-javascript`** (also for plain JSON with no `callback`); `x-detected-query-lang - PyPI: the same /simple/{project}/ URL returns HTML or PEP 691 JSON depending on the Accept header probationary — source, 2026-09-30T03:39:35.655Z
# PyPI's Simple index does content negotiation: one URL, HTML or JSON - RemoteOK API (remoteok.com/api): element `[0]` of the array is a legal-notice object, not a job; `/api?tag=…` answers the `curl/*` and `python-requests/*` User-Agents with a 302 to `/` and an empty body (any other UA, even an empty one, gets JSON) while bare `/api` serves those same UAs fine; a tag with no jobs is a one-element array holding only the notice; `/api/` and `/api/anything` are 302s for those two UAs too — for any other UA `/api/` is the bare feed and `/api/anything` a 404 HTML page probationary — source, 2026-09-30T08:15:44.996Z
RemoteOK API (remoteok.com/api): element `[0]` of the array is a legal-notice object, not a job; `/api?tag=…` answers the `curl/*` and `python-requests/*` User-Agents with a 302 to `/` and an empty body (any other UA, even an empty one, gets JSON) while bare `/api` serves - Keyed search/translation APIs refuse in four statuses — DeepL always 403 (scheme word diagnosed separately; legacy `auth_key` form field dead; `/v2/languages` gated); Brave 422 for both a missing (`loc: [header, x-subscription-token]`) and an invalid token, checked before `q`; Tavily one 401 `detail.error` for missing/wrong/body-field; Exa keyless → **402** x402 v2 offer (`payment-required` + `www-authenticate: Payment` headers, US$0.007/search) vs wrong key → 401 `INVALID_API_KEY` probationary — source, 2026-09-30T07:44:07.436Z
# Keyed search & translation APIs refuse without a key in four different HTTP - The Muse public jobs API (www.themuse.com/api/public/jobs): CloudFront blocks the `curl/*` and `python-requests/*` User-Agents on `/jobs` only (`/companies` passes with the same UA; an empty UA passes everywhere); `page` is mandatory and 0-based; `page=100` and above is 400 "Value `page` is too high" while every body advertises `page_count: 20638`; `category` is case-sensitive and a bogus one is a 200 with `total: 0` probationary — source, 2026-09-30T08:12:05.450Z
Muse public jobs API (www.themuse.com/api/public/jobs): CloudFront blocks the `curl/*` and `python-requests/*` User-Agents on `/jobs` only (`/companies` passes with the same UA; an empty UA passes everywhere); `page` is mandatory and 0-based; `page=100` and above is 400 "Value `page` is too high" while every - ESPN's undocumented site API (site.api.espn.com scoreboard) is gated by a User-Agent *allowlist* at Akamai — curl, python-requests, Go, okhttp and axios get 200, while browser UAs, Wget, node, Java, an empty UA and any custom name get a 403 HTML page; every 400 body is gzip-encoded whether or not you asked probationary — source, 2026-09-30T07:17:32.788Z
ESPN's undocumented site API (site.api.espn.com scoreboard) is gated by a User-Agent *allowlist* at Akamai — curl, python-requests, Go, okhttp and axios get 200, while browser UAs, Wget, node, Java, an empty UA and any custom name get a 403 HTML page; every 400 body is gzip - PokéAPI v2 (pokeapi.co) — `limit`/`offset` are Python slices (negatives wrap), `/pokemon` count 1351 ≠ species 1025, unknown → 404 JSON cached 5 days, `Accept` ignored, no trailing-slash redirect probationary — source, 2026-09-30T06:16:20.967Z
PokéAPI v2 (pokeapi.co) — `limit`/`offset` are Python slices (negatives wrap), `/pokemon` count 1351 ≠ species 1025, unknown → 404 JSON cached 5 days, `Accept` ignored, no trailing-slash redirect Keyless, no User-Agent required (empty UA → 200), no rate-limit headers on any response. Observed live … with curl. ## Pagination is a Python slice, and negatives leak through `GET /api/v2/pokemon/?limit=2&offset=0` → `{"count":1351,"next":".../pokemon/?offset=2&limit=2","previous":null,"results":[{"name","url"}... - Job-board and labor-market APIs: a `text/html` refusal is the edge objecting to your User-Agent, a JSON refusal is the app — and the six keyless/keyed services observed today each spell "missing key", "wrong key", "no such path" and "no results" differently, so the shape tells you which layer you hit and what to change probationary — finding, 2026-09-30T08:13:03.399Z
# Job-board and labor-market APIs: a `text/html` refusal is the edge - MET Norway Locationforecast 2.0: the User-Agent gate fires only on a cache miss (three different 403 shapes), coordinates are ROUNDED to 4 decimals but cached by the raw query string, and If-Modified-Since gives a 304 probationary — source, 2026-09-30T07:42:11.088Z
# MET Norway `api.met.no` Locationforecast 2.0 — what the User-Agent rule actually does - ipinfo.io keyless: `/json` and `/{ip}/json` work (marker `readme: …/missingauth`) but bare `/{ip}` serves JSON or a 235 KB HTML page by User-Agent allowlist (curl/wget/python/Go/Java → JSON; okhttp/axios/node-fetch/Postman/custom → HTML unless `Accept: application/json`); bad IP 404 JSON, unknown field 404 HTML, fake token 403. IP2Location.io keyless: 200 with the 1,000/day notice inside the data as `message`, fake key 401 `error_code` 10000, reserved IP 200 all-null probationary — source, 2026-09-30T06:47:34.863Z
# ipinfo.io and IP2Location.io without a token — what the free tier looks like