Public API Lists: a README that renders itself into a site and a JSON feed

The site and the JSON API are a rendering of the README

Look at what the repository actually contains and the architecture becomes obvious. The top level holds `.gitattributes`, `.github/`, `.gitignore`, `CODE_OF_CONDUCT.md`, `LICENSE.md`, `README.md`, `SECURITY.md`, and `assets/`. There is no source directory, no package manifest, no build configuration, and the primary language is not recorded.

So the searchable website and the JSON endpoint are both derived from the Markdown tables in the README. The tables are the source of truth, and everything else is a projection of them: a browsable site at public-api-lists.github.io and a single `all.json` document.

That design has a practical consequence. The tables are hand-curated prose in a Markdown file, which means the schema is whatever columns a contributor typed into a row, not a validated model.

Unknown is a first class value in the Auth and CORS columns

Every category table carries the same five columns: API, Description, Auth, HTTPS, and CORS. The Auth column takes values such as No, `apiKey`, and `OAuth`, and CORS takes Yes or No, but the CORS column also carries Unknown, and it carries it often.

In the Animals category alone, Cataas, Dog API, HTTP Dogs, HTTPCat, Movebank, and RescueGroups are all marked Unknown for CORS. The same column marks Yes for Dogs, Petfinder, RandomDog, and Amazing Endemic Species, and No for Cat Facts and RandomFox. AniList is listed with `OAuth` for Auth and Unknown for CORS.

So the list cannot tell you whether a browser can call a given endpoint. It can tell you what the curator found, and Unknown means the curator did not find out. That is more honest than a guess, and it is also the practical limit: for every Unknown CORS row you still have to make the request yourself before you know whether it works from a page.

An entry can be an unofficial API, and the description says so

Presence in this list is not vendor endorsement, and some entries are explicit about it. Jikan is listed as an unofficial MyAnimeList API, so it is not covered by a commitment from the company whose data it exposes.

The consequence is a different kind of risk from the usual one. A vendor API that changes its terms or pricing can be replaced by an equivalent entry. An unofficial API can simply disappear, because its maintainer is not obliged to keep it running and no commercial relationship keeps it alive. The list does not carry a stability rating, an uptime record, or a last-checked date, so nothing in it separates a durable service from one that quietly stopped being maintained.

Read an unofficial entry as a lead worth verifying, not as a dependency to design around.

No releases means there is nothing to pin the JSON feed to

The repository has no GitHub releases at all. That single fact determines how you can consume the data.

The JSON API is published at a path under the Pages site. Without a tagged release, there is no version identifier, no changelog, and no way to request the feed as it looked on a given date. The last push to the repository is dated 2026-09-14, and the list changes whenever a contributor merges an addition or a correction.

So if you fetch `all.json` and build a catalog, or a search index, or a dependency list from it, the bytes can change between two runs with no signal that anything happened. That is workable for exploration and risky for a pipeline. Cache the response, diff it against your previous copy, and treat an unexpected change as a review item rather than an update to apply automatically.

The 48 categories reach past the demo APIs and into production tooling

The index runs to 48 categories, and the selection is broader than the animal picture APIs that usually make this kind of list. Alongside Animals, Anime, Books, Food & Drink, and Games & Comics sit Test Data, Data Validation, Fraud Prevention, Anti-Malware, Continuous Integration, Open Data, Patent, Personality, Disasters, and Weather.

That spread is the useful part of the list for anyone past a tutorial. Test Data and Data Validation are what you reach for when building a pipeline that should not call a third party on every run. Fraud Prevention, Anti-Malware, and Security are categories that exist because someone has a real integration to build. Government, Open Data, Patent, and Disasters are public sector sources that are otherwise tedious to locate.

The flip side is that category membership tells you nothing about fitness. Every entry is a link and a one-line description, so choosing between three candidates in the same category is still work you have to do, and the Auth and CORS columns are the only structured signal offered to narrow it.

Gold, Silver, and Bronze tiers put a sponsor logo above the Animals table

The repository states that it is maintained by volunteers and that sponsoring keeps the list alive, maintained, and ad-free. Three tiers are defined. A Gold sponsor gets a logo, a Silver sponsor gets a logo plus a one-line description, and a Bronze sponsor gets a text link. The slots are rendered as an HTML table at the top of the file with placeholder comments marking where each tier is filled.

The one filled slot is SerpApi, a Gold sponsor, described as scraping Google and other search engines with a simple API. It appears above the list rather than inside it.

Two things follow. First, the placement is not neutral: a sponsor logo sits in the position a reader's eye reaches first, above the index and the categories. Second, the ad-free claim is the mechanism tying the money to the curation, and it is a promise about presentation rather than about which APIs make the cut. The contributing guide is the place to look for selection criteria, since the front page does not state them.

PR validation is a workflow, and governance lives in four dotfiles

Contributions run through a pull request workflow called `validate-pr.yml`, referenced by a badge at the top of the file. The repository also carries `CODE_OF_CONDUCT.md`, `SECURITY.md`, and `LICENSE.md`, so the usual governance documents are present, and the contributing guide is the one entry point linked for people who want to add to the list.

The workflow therefore enforces something, and it is worth finding out what before spending time on a pull request. As an outside contributor, the realistic expectation is that a new row changes the list with no version boundary and no review of the data's accuracy beyond the human doing it.

Editorial conclusion

Use this list when you want a fast shortlist and can afford to test each candidate yourself, and treat the JSON feed as a discovery aid rather than a dependency to build on. Before committing, check whether the CORS column says Yes for anything you need from a browser, whether the Auth column says No, and whether the entry is unofficial, because none of those three are answerable from the list when they read Unknown.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Project website
4. public-api-lists/public-api-lists on GitHub
5. README