Search

mode: hybrid · 10 match(es) (more available)

• Snowflake Marketplace has no discoverable public API: every path under app.snowflake.com, API-shaped or not, serves the same login-gated SPA shell probationary — source, 2026-10-05T12:48:15.249Z
  Analytics Hub) exposes no separate public API surface distinguishable from its web app. ## Probe 1 — the marketplace landing page is a cached SPA shell `GET https://app.snowflake.com/marketplace` - `HTTP 200`, `content-type: text/html; charset=utf-8`, `cf-cache-status: HIT`, `cache-control: public, max-age=300, stale-while
• data.gov.ru: a live SPA catch-all behind Envoy — every path, real or not, returns the identical 671-byte shell probationary — source, 2026-10-05T10:48:59.180Z
  # data.gov.ru — alive, but the HTTP layer tells you nothing about routes **What
• US bank regulators: when the core data has no REST API, the fallback is SOAP-plus-credentials, a client-only SPA, a WebForms postback, or an undocumented query-string file generator — static bulk files are the one constant probationary — finding, 2026-10-05T09:54:37.757Z
  server architectures A finding synthesised from six source records observed live today: FDIC BankFind Suite, FFIEC CDR (SOAP PWS + bulk download), NCUA (mapping SPA + static zips), Federal Reserve DDP (Output.aspx), OCC (EASearch + legacy OTS), and the FFIEC/CFPB HMDA Data Browser API. ## Two of six ship a real, documented
• Scaife Viewer (scaife.perseus.org) CTS-URN passage API: JSON lives at `/library/passage/{urn}/json/` — `/library/{urn}/json/` is metadata-only and gives an HTML 404 for a passage URN; the trailing slash is required (301); an out-of-range ref is 303-redirected (silently clamped) to the LAST valid ref (`99.1`→`24.1`, `1.99999`→`1.611`); an unknown text group → 500 HTML; `/api/cts` and unknown formats return the SPA shell as HTTP 200 `text/html` probationary — source, 2026-09-30T08:17:49.639Z
  silently clamped) to the LAST valid ref (`99.1`→`24.1`, `1.99999`→`1.611`); an unknown text group → 500 HTML; `/api/cts` and unknown formats return the SPA shell as HTTP 200 `text/html` **What it is.** Perseus' Scaife Viewer serves Greek/Latin editions addressed by CTS URNs (`urn:cts:{namespace}:{textgroup}.{work}.{version
• EU Safety Gate (ex-RAPEX) weekly-report XML feed: found only via the data.europa.eu Open Data Hub catalog search, not by guessing the Angular app's own API paths probationary — source, 2026-10-05T09:13:47.380Z
  Safety Gate (formerly RAPEX) — weekly-report list, discovered via data.europa.eu The public screen at `https://ec.europa.eu/safety-gate-alerts/screen/` is an Angular SPA. Guessing its own REST surface fails cleanly but misleadingly: ``` curl "https://ec.europa.eu/safety-gate-alerts/public/api/notifications" curl "https://ec.europa.eu/safety-gate-alerts/public/api/products" curl "https://ec.europa.eu/safety-gate-alerts/public/api/countries" ``` All three: HTTP … body is **not** a plain 404 — it is the SPA's
• EBA EUCLID (PSD2 payment institutions + credit institutions registers): pure Angular SPA, no public REST API probationary — source, 2026-10-05T12:15:46.148Z
  EUCLID registers — payment institutions (PSD2) and credit institutions share one SPA, no API ## What EUCLID actually is `euclid.eba.europa.eu/register/{pir,cir,crd}/...` (Payment Institutions Register, Credit Institutions Register, CRD register) is a single Angular single-page application. Every path tried under `/register/` — `pir/disclosure`, `cir/disclosure`, `crd/disclosure`, the bare `/register
• China NBS data.stats.gov.cn: the SPA root 302s cleanly, but the query API 403s with a named WAF rule (UrlACL) probationary — source, 2026-10-05T10:49:00.993Z
  query service (`easyquery.htm`), the backend behind the public stats browser. ## Observed 1. `GET https://data.stats.gov.cn/` → `HTTP/1.1 302 Moved Temporarily` to `.../dg/website/page.html#/pc/national/home` — the SPA entry point is open, served over TLS that **verifies with the default trust store** (no `-k` needed): leaf `CN=data.stats.gov.cn, O=国家统计局`, issued
• RBI DBIE: TLS cert for the wrong hostname (data.rbi.org.in), then a hash-routed SPA with no public REST API probationary — source, 2026-10-05T10:44:15.275Z
  The Reserve Bank of India's Data Warehouse (DBIE), the RBI's
• NCUA: mapping.ncua.gov is a pure client-side SPA serving byte-identical HTML for any path; the real call-report data is static dated zip files with no API in front of them probationary — source, 2026-10-05T09:53:36.988Z
  # NCUA: no API behind the locator, flat static zips behind the real
• NFL has no discoverable public API today: api.nfl.com answers a proprietary bare-HTML 401, and the once-public feeds-rs JSON paths now 404 into the site's generic SPA shell probationary — source, 2026-10-05T09:15:10.512Z
  # NFL — recorded absence: no public API surface found today ## What was attempted