Docs
Everything here applies to every API on the hub. Each API's own page lists its endpoints and lets you try them.
Start
Base URL: https://api.tasta.space/v1. Every API lives under it at its own prefix. Ask the hub what it has:
$ curl https://api.tasta.space/v1
Format
Only GET. Responses are JSON, application/json; charset=utf-8, pretty printed, with letters as real UTF-8 (you get ș, never ș). One thing comes back as {"data": {...}}, a list as {"data": [...], "meta": {...}, "links": {...}}.
Some endpoints also speak plain text with ?format=text, one line, handy in a terminal or a shell prompt.
Limits
Limits count per caller across the whole hub, not per API.
| Who | Per minute | Per day |
|---|---|---|
| No key (per IP) | 30 | 1,000 |
| With a key | 600 by default, more if you need it | no daily cap |
Every response carries the window you are closest to filling:
| Header | Means |
|---|---|
X-RateLimit-Limit | Requests allowed in that window |
X-RateLimit-Remaining | Requests left in it |
X-RateLimit-Reset | When it empties, as a Unix timestamp |
X-RateLimit-Tier | anonymous or key |
Retry-After | On a 429 only: seconds to wait |
Keys
A key lifts the limits on every API at once. Keys are not self-served: a human makes them. Write to hello@tasta.space, say what you are building and roughly how many calls you need, and you get one back by email.
Send it in a header, either one:
$ curl -H "Authorization: Bearer tsk_yourkey" https://api.tasta.space/v1 $ curl -H "X-Api-Key: tsk_yourkey" https://api.tasta.space/v1
Keep it on a server. Never put it in a query string (it ends up in logs) or in code that runs in a browser (anyone can read it). A key is shown once and we only keep its hash, so a lost key is replaced, not recovered. A wrong or revoked key gets a 401, not a quiet downgrade.
Errors
Every error has the same shape. The code is stable, write your if against it; the message is for humans and may be a joke, in the language of the API.
{
"error": {
"code": "rate_limited",
"message": "Easy, tiger. You hit the free limit. Try again in 42 s, or ask for a key at hello@tasta.space."
}
}
| Status | Code | When |
|---|---|---|
| 401 | invalid_key | The key is wrong or revoked |
| 404 | not_found | No such endpoint, or no such thing |
| 405 | method_not_allowed | Anything other than GET |
| 422 | invalid_parameter | A parameter the API cannot use |
| 429 | rate_limited | Window full, see Retry-After |
| 500 | server_error | Our fault |
An API may add codes of its own; its page lists them.
CORS
Open to every origin, so a page can call the APIs straight from the browser without a key. The rate-limit headers are exposed to scripts.
Versions
Everything is under /v1. Fields may be added there; nothing is renamed or removed. A breaking change would get /v2, and /v1 would keep answering.
Fair use: these are toys. Do not hammer them, do not resell them. Content can be corrected or removed on request: hello@tasta.space.