Every agent-payable API.

GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses GTEx v8 data; unknown gene symbols return 404.

Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by words in the title. With details=true the first 5 matches also get summary, author, last-reviewed date and paywall flag from the article page. Metadata only, no article text (Medscape articles need a free login).

For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with their IPv4 and IPv6 peer counts, and the top downstreams. Built from RIS route collector paths, so it is an observed view, not the contract.

Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether credentials are allowed with it. Echoing an arbitrary origin together with credentials is the risky case. One GET of the home page; it does not test API routes or the null origin.

IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPEstat. Location is an estimate (a block-level database), not a street address; the city is often empty.

AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and country. Needs a free AbuseIPDB key configured by the operator; reports are crowd-sourced.

DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextDNS) return its A answer with the AD (authenticated) flag. It reads the resolvers' verdict; it does not validate the signature chain itself.

WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 per page. Links are Sogou redirect links that open the mp.weixin.qq.com article in a browser. Sogou may show a captcha under heavy use; that returns 503.

Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a flag. Cookies set later, after login or on other pages, are not seen.

For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), route objects, visibility, and how many more-specific and less-specific prefixes are seen. An 'invalid' RPKI status is a hijack warning sign; it is not proof of a hijack.

PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were seen open on each address. Passive and possibly old; no SMTP conversation, banner, STARTTLS or certificate test is made.

Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not listed means not in SURBL's current lists, not that the domain is safe.

US Department of Justice press releases from the justice.gov public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free full-text link, journal and publisher. Returns metadata and links only, not the PDF.

CRAN R package metadata (crandb JSON mirror of CRAN, public, no key): name, version, title, description, license, maintainer, publication date, dependencies and CRAN page link. Unknown packages return 404.

Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). The record can be days old, and an address with no record returns known=false, which does not prove the ports are closed.

Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts, DROP hijacked ranges, PBL end-user ranges) or a domain against the Domain Block List (spam, phishing, malware, botnet C&C, abused legitimate domains). Returns listed yes/no, every return code with the list it means, and Spamhaus's lookup link. Point-in-time answer.

The Intercept articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key.

Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomous system, location, network owner and reverse DNS, from the Censys Platform API.

TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key.

New York Times home page headlines from the public NYT RSS feed (latest items; keyword filter on title/summary/categories). Headlines and abstracts only. Public feed, no key.

Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, status flags, nameservers and DNSSEC delegation flag. Registrant contact data is usually redacted by registries and is not returned.

FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one ranking date. Default date is the latest one listed on FIFA's site when built (2026-10-20); pass dateId to read another listed date. Men's ranking only.

Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's position for the top players. Current ranking only; no tour or event history.

DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and other research outputs. Metadata only.

Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tickers (e.g. AAPL,TSLA) and/or words in the headline/teaser. Newest first, up to 100 stories; no paging into older news, no full article text. Public, no key.

One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0, 3.1, 3.0 or 2.0, whichever NVD marks primary first), CWE weakness IDs and up to 5 reference URLs. It does not say whether the CVE is being exploited (use cisa-known-exploits or epss-exploit-score for that).

GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), its classification (benign, malicious, unknown), name and last-seen date. An address GreyNoise has not seen returns noise=false with a message; it is not a clean verdict.

For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name servers in DNS right now. Registered-looking names are listed with their name servers. A lookalike with no name servers may still be registered without DNS, and this is not a trademark or phishing verdict.

Public product metadata of a Shopify store from its storefront products.json feed (no key): title, handle, vendor, product type, tags, publish and update times, price range, variant and image counts and product link. Only stores that expose products.json; stores that block it return 404.

Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Returns stories only, most relevant first.

Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active wallets (UAW) and TVL, for 24h/7d/30d, optionally for one chain (eth, solana, bnb, base, polygon, arbitrum, tron...). Values in USD as shown by DappRadar; missing values are null. Public page, no key.

Wikimedia Commons image search (MediaWiki API, public, no key): file title, direct image URL, size, MIME type, license, author and description for free-licensed files. Returns file metadata only, not image bytes.

Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or for 8 common selectors (revoked keys and CNAME-delegated keys are reported). Reads the published DNS records only; it does not check alignment against a real message.

Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long window can take NVD 30+ seconds) naming the vendor (or mapped to its CPE with match=cpe), counts by severity, average and maximum CVSS score, CVEs per week, top CWE weaknesses and the highest-scored CVEs with score, severity, vector, date and description.

Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key.

Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a sensor network (about 15,000 entries). Listed means it is on the current list; the list is a snapshot.

DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as they resolve now, with TTLs; it does not walk the delegation chain or query the authoritative servers directly.

Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is listed at all. A higher level means more feeds agree. Not listed means none of the aggregated feeds list it.

Recent news articles (last ~72 hours) that match a query, from GDELT's public Context 2.0 API (DOC 2.0 API as fallback), no key: title, URL, domain, language, time seen and the matching sentence. Supports GDELT query syntax ("exact phrase", sourcelang:english, domain:bbc.co.uk). Covers the sources GDELT monitors, not every outlet. Rate-limited or slow GDELT answers return 503.

CWTS Leiden Ranking Open Edition 2025 (publication-based, about 2,800 universities, OpenAlex data): for a country or continent, field and period (2006-2009 to 2020-2023), each university's rank, name, country and the indicators of the chosen dimension: scientific impact (P, top 1%), collaboration (international, industry) or open access (P(OA), PP(OA)).

DEV Community (dev.to) latest articles for one tag (public DEV API, no key): title, author, publish time, reactions, comments, reading time and link. Search by tag only; the public API has no free-text search.

CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, required action and ransomware-use flag. Without it: catalog size, release date and the newest additions (up to 50). Listing means exploitation was reported, not a risk score.

Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the domain is checked, never the mailbox, and a domain missing from the list is not proven to be permanent.

WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles are paywalled and not returned. Public feed, no key.

BingX perpetual swap market ticker (public open API, no key): last price, 24h change, high, low, open, base and quote volume and the time of the last candle close for one symbol such as BTC-USDT. Read-only market data; no trading.

From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) list. This is passive and may be days old; it is not a live SSH banner grab or algorithm audit.

Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL or any URL on the same host is listed, the feed size and up to 5 example URLs. Not listed does not mean safe; the feed is short and changes fast.

Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name: no crawling of other pages, no JavaScript rendering, so pages that build their text in the browser may come back short.