Open data
Public API
Read-only JSON over HTTPS under /api/v1: the current reference release and the data platform, free on the open tier. Every resource is available without a key; a key raises the rate limit and never unlocks data.
Reviewed
Resources
All paths are relative to the site. Lists accept limit (1 to 200, default 50) and cursor.
| Path | What it returns |
|---|---|
GET /api/v1/releases | Accepted reference releases with tag, method version, generation date, checksum and the signed downloads. |
GET /api/v1/releases/{tag} | One release by tag. |
GET /api/v1/categories | The categories of the current release with their criterion ids. |
GET /api/v1/categories/{id} | One category. |
GET /api/v1/criteria | Criteria with name, description, default weight and frontier. Filter with category; method_version reads the criteria of that method version. |
GET /api/v1/products | Products of the current release with the reference availability list and the supervisory register statements. Filter with category. |
GET /api/v1/products/{category}/{product} | One product with its availability. |
GET /api/v1/products/{category}/{product}/history | The rating snapshots of a product in every accepted release, oldest first, with the recorded score changes and their reasons. |
GET /api/v1/ratings | Ratings under the published methodology: overall under the default weighting, confidence, and every criterion score with rationale and evidence ids. Use release for a past release and category to filter. |
GET /api/v1/ratings/{category}/{product} | The rating of one product, in the current or a named release. |
GET /api/v1/glossary | Glossary terms: the English master text plus the translations that are published. |
GET /api/v1/glossary/{id} | One glossary term. |
GET /api/v1/incidents | Sovereignty incidents with dates, jurisdictions, kinds, affected forms of money and sources. Filter with kind and jurisdiction. |
GET /api/v1/incidents/{id} | One incident. |
GET /api/v1/series | The data series whose source licence allows redistribution, with source, licence and attribution. |
GET /api/v1/series/{id} | One series with its observations: the latest values, or with vintage the values as they were known at that time; from and to limit the periods. |
GET /api/v1/countries | The data of the country hubs: register availability counts, CBDC status, cash index and incident ids. |
GET /api/v1/countries/{code} | One country by ISO code. |
Series whose licence does not allow passing them on are shown on the site but never served by the API.
Quick start
Send a GET request. No sign-up and no key are needed for the open tier.
Example requests
curl -s https://whatthechain.org/api/v1/openapi.json
curl -s "https://whatthechain.org/api/v1/ratings?category=hardware-wallets&limit=20"
curl -s https://whatthechain.org/api/v1/products/hardware-wallets/<product>/history
curl -s "https://whatthechain.org/api/v1/series/<series-id>?vintage=2026-01-31T00:00:00Z"
curl -s -H 'If-None-Match: "<etag>"' https://whatthechain.org/api/v1/categoriesLists return a page of items ordered by id. To read the next page, pass the value of pagination.next_cursor as the cursor parameter until it is null.
Licence fields in every payload
Every response carries four fields next to its data: licence (name and link), attribution (the text to show with the data), release (tag and generation date of the reference release it was read from) and wording_notice.
Reference data (ratings, methodology, glossary, incidents) is published under the open data licence of the reference releases, Creative Commons Attribution 4.0 International (CC BY 4.0). The licence field names it and links its text.
A data series carries the licence and the attribution of its source as the source register states them. Series whose source does not allow redistribution never appear in the API: they are shown as charts on the site only. Country data follows the same rule: a value whose source does not allow redistribution is marked withheld.
Missing values are null, never 0. A criterion that is not rated has a null score.
How to present ratings
Ratings are measurements under a published methodology, not advice. If you show them, write "rated by WhatTheChain under the published methodology", name the method version and the release, and link the methodology.
Do not present a rating as advice, as a selection for a particular reader or as a statement about future prices. The wording_notice field in every payload repeats this obligation.
These terms are under legal review and may change; the version on this page applies.
Caching, ETags and CORS
Every successful response has an ETag. Send it back as If-None-Match and you get 304 Not Modified without a body while the data is unchanged.
Current data is cacheable for five minutes; a named past release or a past vintage never changes and is cacheable for a day. The API answers any origin (CORS *), so browsers can call it directly.
Paging through a list while a new release is activated answers 409 with the code stale_cursor: start again from the first page.
Rate limits
Every response reports the caller's window in the headers RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset (seconds). When the limit is reached the API answers 429 with Retry-After.
No key
Open (no key)
- 60 requests per 60 seconds
- Counted per: client address
- Every resource, the same data as every tier
With a key
Developer
- 600 requests per 60 seconds
- Counted per: API key (a key may have its own limit)
- Every resource, the same data as every tier
- Webhooks for releases, rating changes and incidents
With a key
Business
- 3000 requests per 60 seconds
- Counted per: API key (a key may have its own limit)
- Every resource, the same data as every tier
- Webhooks for releases, rating changes and incidents
With a key
Enterprise
- 12000 requests per 60 seconds
- Counted per: API key (a key may have its own limit)
- Every resource, the same data as every tier
- Webhooks for releases, rating changes and incidents
One rule for every tier
A key is sent as Authorization: Bearer followed by the key. Every tier reads the same data.
API keys
Every resource is free on the open tier, without a key. A key raises the rate limit; it never unlocks data, and nothing is priced.
Tiers: open (no key, counted per client address), developer, business and enterprise (counted per key).
Send the key as a Bearer token in the Authorization header. It is shown once when it is issued: keep it secret, and ask us to rotate or revoke it if it leaks.
Key holders can also receive webhooks for published releases, changed ratings and added incidents, signed per the Standard Webhooks specification.
To request a key, write to us with your name, a contact address and what you are building. Keys are issued by our team. Request a key
Errors
Errors are RFC 9457 problem details (application/problem+json) with type, title, status, detail and a stable code.
| Code | Meaning |
|---|---|
not_found | The resource or the id does not exist. An unknown series and a series that may not be redistributed answer alike. |
invalid_parameter | A query parameter has an invalid value. |
invalid_cursor | The cursor was not issued by the API. |
stale_cursor | A new release was activated while paging; start again from the first page. |
rate_limited | The limit of the tier is reached; wait the seconds in Retry-After. |
unauthorized | The request could not be authenticated. |
forbidden | The key may not read this resource. |
unavailable | The service is temporarily unavailable. |
internal_error | The request could not be answered; try again later. |
invalid_authorization | The Authorization header is not of the form Bearer followed by a key. |
invalid_api_key | The key is unknown, revoked or expired. Requests without a key use the open tier. |
insufficient_scope | The key does not have the read scope. |