API marketplace

Read Mastodon and the wider fediverse in real time — across any instance, no login or app token required. Look up any account by handle (user, @user or user@instance) and pull its posts, followers, following and featured tags. Fetch any post with its full reply thread, see who boosted or favourited it, and read a post's edit history. Run unified search over accounts, posts and hashtags; browse a hashtag timeline; and surface what's hot via trending posts, hashtags and links. Inspect any instance: its metadata (users, version, rules), federated peers, weekly activity and the public profile directory, plus poll results by id. Pass ?instance=<host> to target any Mastodon server (default mastodon.social); every call is live (no cache) and returns the upstream Mastodon REST shape unchanged. 21 endpoints — broader than the typical Mastodon wrapper. Built for fediverse social listening, account and follower analysis, content aggregation and bot back-ends. No upstream key, no cache.

Uptime

100.0%

Latency

410ms

Subs

4,280

Read Bluesky (the AT Protocol social network) in real time — no login, no app password needed. Look up any profile by handle or DID (followers, follows, post and list counts, bio, avatar), batch-fetch up to 25 profiles at once, and pull a user's feed in three flavours: posts only, posts with replies, or media-only. Get a post's full thread, fetch posts by AT-URI in bulk, and see exactly who liked, reposted or quote-posted any post. Full-text search posts, find and autocomplete users, and pull posts for any hashtag. Explore the network's discovery surface: a user's created lists, custom feeds and starter packs, any custom feed or list by URI with its members, the most popular feed generators, suggested accounts and the current trending topics. Resolve a handle to its DID. Every call is live (no cache), paginated with a cursor, and returns the upstream AT Protocol shape unchanged. 27 endpoints — broader coverage than the typical Bluesky wrapper. Built for social listening, audience and follower analysis, content and feed aggregation, and bot/automation back-ends. No upstream key, no cache.

Uptime

100.0%

Latency

758ms

Subs

4,018

Validate and decode Indian GSTINs (the 15-character Goods & Services Tax Identification Number) instantly and entirely offline. The validate endpoint checks the structure and recomputes the official GSTIN check digit — the base-36 weighted algorithm the GSTN itself uses — and confirms the embedded state code is real, returning a clear valid/invalid verdict with the specific reasons a number fails. The decode endpoint breaks a GSTIN into its parts: the GST state/UT code and its name, the embedded 10-character PAN, the PAN holder type (company, individual/proprietor, firm/LLP, HUF, trust, government and more, read from the PAN's 4th letter), the entity registration number, the default 'Z' slot and the check digit. A states endpoint returns the full GST state-code reference for building dropdowns and lookups. Everything is pure computation — no network call, no key, no cache — so it is fast and private, ideal for checkout and onboarding forms, invoicing and e-invoice/e-way-bill pipelines, vendor master data cleansing and bulk validation. A structural GSTIN validator and decoder — distinct from EU VAT-number validation (vat), IBAN bank-account validation (iban) and card-number checks (creditcard). Note: this verifies the number's structure and check digit, not whether it is actively registered in the GSTN portal. No upstream key, no cache.

Uptime

100.0%

Latency

171ms

Subs

3,943

Fetch and evaluate any publisher's ads.txt / app-ads.txt — the IAB authorized-digital-sellers standard. Pass a domain and the check endpoint fetches its ads.txt server-side, then returns every seller record parsed into its fields — advertising system, the publisher's seller/account id, the DIRECT or RESELLER relationship and the optional certification-authority id (TAG-ID) — alongside counts (direct, reseller, distinct ad systems) and the declared variables OWNERDOMAIN, MANAGERDOMAIN, CONTACT and SUBDOMAINS. The verify endpoint answers the one question programmatic-advertising integrations actually ask: is this advertising system, with this publisher id, authorized to sell this domain's inventory? — returning an authorized boolean and the matching records. A missing file is reported as found:false (not an error), and soft-404 HTML pages are detected and rejected so you never parse a "page not found" as records. The request is made server-side and private or internal targets are refused (SSRF-guarded). Built for ad-tech supply-chain verification, SSP/DSP onboarding checks, anti-fraud and inventory audits. An ads.txt seller-authorization checker — distinct from the security-contact file reader (securitytxt), the robots.txt crawlability evaluator (robots) and the sitemap parser (sitemap). No upstream key, no cache.

Uptime

100.0%

Latency

253ms

Subs

4,867

Fetch and parse an XML sitemap (the sitemaps.org protocol). Pass a sitemap URL and the parse endpoint fetches it — following redirects and transparently gunzipping .gz sitemaps — and returns its type: a urlset with every URL and its lastmod, changefreq and priority, or a sitemapindex listing the child sitemaps, with offset/limit paging for large files. The urls endpoint goes further: when the sitemap is an index it fetches the child sitemaps too and flattens every page URL into a single list, with a configurable cap on URLs and child sitemaps and a truncated flag so you stay in control. The request is made server-side and private or internal targets are refused (SSRF-guarded). Built for SEO audits, building crawl queues and content inventories, change monitoring and migration checks. A sitemap fetcher and parser — distinct from generic XML-to-JSON conversion (xml), the robots.txt evaluator (robots) and the on-page SEO audit (seo). No upstream key, no cache.

Uptime

100.0%

Latency

1753ms

Subs

3,297

Fetch and evaluate any website's robots.txt. Pass a URL and a user-agent and the check endpoint tells you whether that URL is crawlable — selecting the most-specific user-agent group and applying the RFC 9309 longest-match Allow/Disallow rules (with * and $ wildcards, where Allow wins ties), and returning the matched rule, the group's crawl-delay and the sitemaps the site declares. The parse endpoint returns the whole file structured into per-user-agent groups (their allow and disallow lists and crawl-delay) plus the list of sitemaps. A missing robots.txt (404/403) means everything is allowed, exactly as the spec requires. The request is made server-side and private or internal targets are refused (SSRF-guarded). Built for SEO audits, crawler and scraper compliance, sitemap discovery and pre-flight "am I allowed to fetch this?" checks. A robots.txt evaluator — distinct from the on-page SEO audit (seo), the XML toolkit (xml) and link unfurling/preview (url). No upstream key, no cache.

Uptime

100.0%

Latency

217ms

Subs

4,091

Count and split text the way people actually read it, using Unicode-correct segmentation. The count endpoint returns the number of grapheme clusters — the real, user-perceived characters, so a family emoji counts as 1 (not 7) and an accented letter as 1 — alongside words, sentences, code points, UTF-16 code units (the naive string length that over-counts) and UTF-8 byte length. This is exactly what character-limit fields, tweet/SMS counters and validation need so the count agrees with what the user sees. The segment endpoint splits text into grapheme, word or sentence segments (word segments are flagged word-like versus punctuation and spaces) and is locale-aware, so Japanese, Chinese and Thai word boundaries come out right. Everything is computed locally with no network calls. A Unicode text segmenter — distinct from the Unicode codepoint database (unicode), the case/text-utilities toolkit (text) and string similarity (similarity). No upstream key, no cache.

Uptime

100.0%

Latency

178ms

Subs

3,876

Get the localized display name of a code in any language — countries and regions, languages, currencies, scripts and calendars. Pass a code, a type and a locale and the name endpoint returns the right name: US as region in fr gives "États-Unis", de as language in fr gives "allemand", EUR as currency gives "Euro", and the same code reads correctly in German, Japanese, Arabic or any other locale. The list endpoint returns every code of a type localized and sorted in that locale's collation — ideal for building a country, language or currency dropdown in any language. Powered by the platform's full ICU data (Intl.DisplayNames) and computed locally with no network calls. Built for internationalised forms and pickers, multilingual UIs, localized reports and onboarding. A localized-names resolver — distinct from country reference data in English (countries), number and currency formatting (numberformat) and locale date formatting (datelocale). No upstream key, no cache.

Uptime

100.0%

Latency

167ms

Subs

4,616

Humanise timestamps and format dates for any locale and timezone using full ICU. The relative endpoint turns an instant into a localised relative phrase against now (or a given reference time) — "3 hours ago", "vor 3 Stunden", "in 2 days", "il y a 5 minutes" — automatically choosing the best unit from seconds to years. The format endpoint renders a localised date/time string (e.g. "mardi 2 juin 2026 à 15:30" or "2026年6月2日 22:30:00"), honouring the locale (BCP 47), a named IANA timezone, the chosen date and time styles (full/long/medium/short) and 12/24-hour preference, and returns a parts breakdown for custom displays. Pass dates as ISO 8601 or unix timestamps. Everything is computed locally with no network calls. Ideal for internationalised UIs, activity feeds, notifications, comments and dashboards. A relative-time and locale date formatter — distinct from current-time-in-a-timezone (time), the UTC parse/token toolkit (datetime) and number/currency formatting (numberformat). No upstream key, no cache.

Uptime

100.0%

Latency

142ms

Subs

3,530

Format numbers for any locale using full ICU data — the correct way to display money, percentages and measurements per region. Pass a value and a style and the format endpoint returns the locale-correct string: decimal, currency (any ISO 4217 code, with the right symbol and grouping — e.g. 1.234.567,89 € in de-DE, $1,234,567.89 in en-US, ￥1,234,567 in ja-JP, and the Indian lakh grouping 12,34,567.89 in hi-IN), percent, or unit (e.g. 80 km/h). Control the locale (BCP 47), minimum/maximum fraction digits, grouping, sign display and notation (standard, scientific, engineering or compact like 1.2M). A parts endpoint returns the formatToParts breakdown (integer, group, decimal, fraction, currency symbol…) for building custom-styled displays. Everything is computed locally with no network calls. Ideal for internationalised UIs, invoices and receipts, dashboards and reports. A locale number/currency formatter — distinct from foreign-exchange rates (currency), number-to-words (numberwords) and the numeral-base converter (baseconvert). No upstream key, no cache.

Uptime

100.0%

Latency

166ms

Subs

4,304

Convert integers between any numeral systems with exact big-integer math. Pass a number and a from/to base (radix 2 to 36, arbitrarily large, signed) and the convert endpoint returns the result and the decimal value; common 0x, 0b and 0o prefixes are accepted when they match the base, and whitespace or underscores in the input are ignored. The bases endpoint shows a single number across binary, octal, decimal, hexadecimal, base32 and base36 at once, together with its bit length, byte length and sign. Everything is computed locally with BigInt, so values of any size are exact and deterministic. Ideal for low-level and embedded debugging, networking and bit-twiddling work, teaching number systems, and anywhere you juggle hex, binary and decimal. A numeral-base converter — distinct from the text-encoding toolkit (encoding: base64/base32/hex of bytes), the Elixir/Erlang Hex package registry (hex) and number-to-words (numberwords). No upstream key, no cache.

Uptime

100.0%

Latency

168ms

Subs

4,231

Turn an email address into its Gravatar avatar and public profile. Pass an email and the service normalises it, computes the MD5 and SHA-256 hashes Gravatar uses, builds a ready-to-use avatar URL, checks whether a custom Gravatar actually exists, and fetches the public profile when present — display name, username, profile URL, location, about text, linked accounts and photos. A dedicated avatar endpoint builds just the image URL with full options: size (1-2048), a default image (identicon, monsterid, robohash, retro, mp, blank, 404, or your own URL), rating and force-default. Ideal for user-profile enrichment, comment systems, contact cards, team pages and onboarding — showing a real avatar from nothing but an email. A Gravatar lookup — distinct from deterministic avatar/identicon generation (avatar), which renders a brand-new image from a seed rather than fetching the avatar a person actually chose. No upstream key, no cache.

Uptime

100.0%

Latency

464ms

Subs

4,061

Infer a schema or types from a sample JSON document — the fastest way to get a contract out of an example API response. Pass a JSON sample and the schema endpoint returns a JSON Schema (Draft 2020-12) with detected types, required keys, array item schemas merged across elements, and recognised string formats (email, uri, uuid, date-time, date, ipv4); the typescript endpoint returns ready-to-paste TypeScript interfaces with named nested interfaces, typed arrays, unions for mixed-shape array elements and structural de-duplication. Supply the sample inline via ?json=, as a query parameter, or as a request body. Everything is computed locally with no network calls, so it is fast and deterministic. Built for scaffolding types from real API responses, generating validation schemas, documentation, contract testing and code generation. A JSON type/schema inferer — distinct from JSON-Schema validation (jsonschema), JSON pretty-printing and conversion (json), and JSON diff/patch (jsondiff). No upstream key, no cache.

Uptime

100.0%

Latency

223ms

Subs

3,988

Decode and build snowflake IDs — the 64-bit, time-sortable identifiers used by Twitter/X, Discord, Instagram and many distributed systems. Pass an ID and a platform and the service extracts the embedded creation timestamp (turn any Discord, Twitter/X or Instagram ID into the exact moment it was created) along with the machine and sequence components for that platform's epoch and bit layout. Supported platforms: twitter (X), discord, instagram, sony, and custom (supply your own epoch). The encode endpoint does the reverse: build the lower-bound snowflake for a given timestamp, so you can query "all IDs created at or after this moment" — the standard trick for time-based pagination on snowflake APIs. Everything is computed locally with exact 64-bit BigInt math and no network calls. Ideal for analytics, data forensics, API pagination and debugging distributed-ID systems. A snowflake-ID toolkit — distinct from UUID/ULID generation (uuid) and date/time math (datetime). No upstream key, no cache.

Uptime

100.0%

Latency

192ms

Subs

4,287

Inspect a domain's SMTP transport-security posture — whether mail servers are required to deliver inbound mail over authenticated TLS, protecting it from downgrade and man-in-the-middle attacks. Pass a domain and the service fetches the MTA-STS policy file from mta-sts.<domain>/.well-known/mta-sts.txt (its version, mode, the permitted MX hosts and max_age), the _mta-sts DNS TXT record (its policy id) and the _smtp._tls TLS-RPT record (the rua reporting address), then reports whether MTA-STS is actually enforced and a prioritised list of issues — no policy file, no DNS record, a mode of only "testing", or a missing TLS-RPT record. A second endpoint returns just the parsed policy file. The request is made server-side and private/internal targets are refused (SSRF-guarded). Built for email-deliverability and anti-downgrade-attack audits, vendor and third-party assessment, and compliance. An MTA-STS / TLS-RPT checker — the SMTP transport-security counterpart to the email-authentication analyzer (emailsec, which covers SPF, DKIM and DMARC), and distinct from raw DNS lookup (dns). No upstream key, no cache.

Uptime

100.0%

Latency

211ms

Subs

4,404

Check DNS propagation by querying a record across several major public resolvers at once — Google (8.8.8.8), Cloudflare (1.1.1.1), AdGuard and dns.sb — and seeing whether they all return the same answer. Pass a domain and a record type and the service queries every resolver in parallel and reports each resolver's answers, whether they are consistent (the change has fully propagated) or still differ (mid-propagation, stale caching or split-horizon DNS), the number of distinct answer sets and the union of all answers. Supported record types: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA and PTR. A single-resolver endpoint queries one named resolver on its own, and a failing resolver is reported per-resolver without failing the whole call. Live DoH (DNS-over-HTTPS) JSON queries, always current. Built for verifying DNS changes after a migration or launch, debugging split-horizon or stale-cache issues, and uptime/propagation monitoring. A DNS propagation checker — distinct from single-resolver record lookup (dns), the email-authentication analyzer (emailsec) and WHOIS (whois). No upstream key, no cache.

Uptime

100.0%

Latency

190ms

Subs

4,515

Validate a domain's mobile deep-link configuration — the well-known files that make iOS Universal Links and Android App Links open your native app instead of a browser tab. Pass a domain and the service fetches and validates both the Apple App Site Association (apple-app-site-association — the applinks app IDs, path components and webcredentials) and the Android Digital Asset Links (assetlinks.json — each statement's relation, package name and SHA-256 certificate fingerprints), checking the /.well-known/ path with a legacy root fallback, and reports per-platform validity with concrete issues: missing applinks, a non-JSON content type, missing certificate fingerprints, or malformed structure. Single-platform endpoints check iOS or Android on their own. The request is made server-side and private/internal targets are refused (SSRF-guarded). Built for mobile-app onboarding, universal/app-link debugging, pre-release checklists and continuous monitoring. A deep-link configuration validator — distinct from DNS lookup (dns), the security.txt parser (securitytxt) and the SSL/TLS certificate check (sslcheck). No upstream key, no cache.

Uptime

100.0%

Latency

490ms

Subs

4,882

Inspect any OpenID Connect / OAuth 2.0 provider. Pass an issuer (a domain, an issuer URL, or the full discovery URL) and the service fetches the provider's discovery document at /.well-known/openid-configuration, parses every endpoint — authorization, token, userinfo, jwks, registration, end-session, introspection, revocation and device-authorization — together with the supported scopes, response types, grant types, ID-token signing algorithms, PKCE methods and claims, then fetches the JWKS and summarises its signing keys (count, algorithms, key types and key IDs), and reports a validity check with any issues. A second endpoint fetches and summarises any JSON Web Key Set on its own. The request is made server-side and private/internal targets are refused (SSRF-guarded). Built for SSO and OAuth/OIDC integration, identity-provider configuration debugging (Auth0, Okta, Keycloak, Azure AD, Google), security review and monitoring of signing-key rotation. An OIDC discovery / JWKS inspector — distinct from the JWT toolkit (jwt), the security.txt parser (securitytxt) and the HTTP security-header grader (secheaders). No upstream key, no cache.

Uptime

100.0%

Latency

200ms

Subs

3,822

Compare and patch JSON documents to RFC standards. Pass two documents and the service returns whether they are equal, an RFC 6902 JSON Patch (the precise add/remove/replace operations that turn the first into the second, using RFC 6901 JSON-Pointer paths), a change summary, and an RFC 7386 JSON Merge Patch. The patch endpoint goes the other way: apply an RFC 6902 patch (add, remove, replace, move, copy and test operations) or an RFC 7386 merge patch to a document and get the result. Documents can be sent inline or as a JSON body. Everything is computed locally with no network calls, so it is fast and deterministic. Built for configuration and state management, API change detection, audit trails and change logs, optimistic-concurrency checks and data-sync pipelines. A JSON diff/patch engine — distinct from text diffing (textdiff), JSONPath querying (jsonpath), JSON validation and pretty-printing (json) and JSON-Schema validation (jsonschema). No upstream key, no cache.

Uptime

100.0%

Latency

173ms

Subs

4,983

Build a valid RFC 5545 iCalendar (.ics) event from simple parameters — and get ready-to-use "add to calendar" links for Google, Outlook, Office 365 and Yahoo. Pass a title, start and end (ISO 8601 or unix timestamps, in UTC) — or a duration in minutes, or an all-day flag — plus optional location, description, URL, organizer, an RRULE recurrence (e.g. FREQ=WEEKLY) and a reminder (a VALARM N minutes before). The service returns the fully-formed .ics text with correct escaping and 75-octet line folding, a base64 data: URI you can drop straight into a download link, and the four calendar deep-links. A second endpoint parses raw .ics text back into structured JSON events. Everything is computed locally with no network calls, so it is fast and deterministic. Built for booking and scheduling flows, event pages, email "add to calendar" buttons, reminders and no-code automations. A calendar-event builder — distinct from date/time math (datetime), public-holiday data (holidays) and the Jewish calendar (hebcal). No upstream key, no cache.

Uptime

100.0%

Latency

204ms

Subs

3,836

Generate Subresource Integrity (SRI) hashes for any web asset, so browsers can verify that a CDN-hosted script or stylesheet has not been tampered with. Pass a URL and the service fetches the asset and returns its sha256, sha384 and sha512 SRI hashes, the chosen integrity value (sha384 by default, or pass your preferred algorithm), the asset's size and content type, and a ready-to-paste <script> or <link> tag complete with the integrity and crossorigin attributes. A verify endpoint re-fetches the asset and tells you whether it still matches a known integrity string — catching silent CDN changes or supply-chain tampering before your users hit them. The request is made server-side; private and internal targets are refused (SSRF-guarded). Built for securing third-party scripts, supply-chain hardening, build pipelines and CSP/SRI compliance. A Subresource Integrity generator and verifier — distinct from raw cryptographic hashing of input data (hash), the HTTP security-header grader (secheaders) and the SSL/TLS certificate check (sslcheck). No upstream key, no cache.

Uptime

100.0%

Latency

183ms

Subs

4,297

Prioritise CVEs by real-world exploitation risk — not just severity. Combines the FIRST.org EPSS score (the probability, 0 to 1, that a CVE will be exploited in the next 30 days, with its percentile rank) and the CISA KEV catalog (vulnerabilities confirmed to be actively exploited in the wild — with the vendor, product, date added, remediation due date and whether the flaw is used in ransomware campaigns), and derives a single priority level for each CVE. Look up to 25 CVEs in one call, browse the full CISA Known Exploited Vulnerabilities catalog filtered by vendor, product or ransomware use, or list the CVEs with the highest current EPSS scores. Built for vulnerability management, patch prioritisation, risk scoring and security dashboards — answering not "how bad could this be?" but "how likely is it to actually be exploited?". A vulnerability-prioritisation layer — distinct from raw CVE details and CVSS severity (cve), password-breach checks (pwned) and the HTTP security-header grader (secheaders). Data live from FIRST.org and CISA. No upstream key, no cache.

Uptime

100.0%

Latency

236ms

Subs

4,379

Score how easy a piece of text is to read using the standard, peer-reviewed readability formulas — Flesch Reading Ease, Flesch-Kincaid Grade, Gunning Fog, SMOG, Coleman-Liau and the Automated Readability Index. Pass text and get all six scores back together with the underlying counts (words, sentences, syllables, complex and polysyllabic words, letters and characters), an averaged grade level, an estimated reading time and a plain-English interpretation of the reading ease. A second endpoint counts syllables for a word or for every word in a phrase. Supply text inline via ?text=, as a query parameter or in a request body; everything is computed locally with no network calls, so it is fast and deterministic. Built for content and copywriting tools, SEO and editorial workflows, education and accessibility (plain-language) checks, and UX-writing review. A readability scorer — distinct from sentiment/NLP analysis (nlp), spelling and grammar checking (grammar), the case and text utilities (text) and string similarity (similarity). No upstream key, no cache.

Uptime

100.0%

Latency

199ms

Subs

3,085

Validate and summarise an OpenAPI / Swagger API definition. Supply the spec inline (?spec=), as a request body, or fetched from a URL (?url=, SSRF-guarded) — in JSON or YAML. The validator detects the version (Swagger 2.0, OpenAPI 3.0.x or 3.1.x), checks the required structure (info.title and info.version, the presence of paths/components, and every operation's responses), and lints for common problems — duplicate or missing operationIds, operations without a summary or description, tags used but not declared, and malformed paths — returning a valid flag, counts of paths, operations, schemas, tags and servers, and separate error and warning lists. A summary endpoint inventories the whole API: every endpoint with its method, path, operationId, summary and tags, plus the declared servers, tags and component schemas. Built for CI gates on API contracts, API-catalogue ingestion, documentation pipelines and design review. An OpenAPI definition validator and linter — distinct from the JSON-Schema validator (jsonschema), the JSON/YAML/XML converters and the on-page HTML/SEO tools. No upstream key, no cache.

Uptime

100.0%

Latency

190ms

Subs

3,562