How API Score Works
API Score is a 0–100 quality rating. For 271 APIs with a public, no-auth endpoint we could reach, the score is measured from real HTTP requests to the live endpoint. The remaining 1,155 require authentication or expose no testable endpoint, so their score is estimated from metadata (HTTPS, auth model, CORS, documentation reachability). Every API page states which tier it is — no guessing.
Why this is different from other directories
Most API directories list whatever a provider submits and, at best, sort by popularity. The descriptions are editorial — or increasingly, AI-generated — and nobody checks whether the endpoint even responds.
API Score takes the opposite approach where it can. For the 271 APIs with a public, no-auth endpoint we can reach, an automated suite sends real requests to the live endpoint and records what actually happens: whether it resolves, how fast it answers, whether the connection is encrypted, whether the response is valid JSON, and whether it behaves consistently — a reproducible snapshot grounded in HTTP, not adjectives. We are deliberate about the limit: APIs that need credentials or expose no callable endpoint cannot be honestly "tested", so we mark those scores as metadata estimates rather than pretend otherwise.
The measurement is not just an input to the score — it is published. Each measured API page carries a Measurement Record showing the exact request we sent, the status and payload size that came back, the median and fastest of three round trips, the TLS version and certificate issuer negotiated, the CORS header, and any rate-limit headers the server returned. The response body itself is stored and shown, and the field names and types we list are read out of that body. Every run is summarised in the measurement log.
The 100-point model for measured APIs
Five components add up to 100 points. Every one of them is something we can only learn by calling the endpoint — there is deliberately no component for “the endpoint responded”, because that is the entry condition for being measured at all, and a component every API scores full marks on tells you nothing.
Metadata-scored APIs use a separate, clearly-labelled scale built from HTTPS support, authentication model, declared CORS and documentation reachability. The two are not directly comparable: a measured B and a metadata B are different statements, which is why every score on this site carries its tier next to it.
Speed
30 ptsHow fast does this endpoint answer compared with every other endpoint we measured?
We send three consecutive requests and take the median round trip. Rather than scoring against a fixed threshold, we rank the result against the whole measured population — the fastest endpoint scores 30, the slowest scores 0, and everything else falls where it actually lands. That keeps the top of the scale from collapsing into a tie.
Consistency
20 ptsDoes it answer at the same speed every time, or does latency jump around?
We compare the fastest of the three requests with the median. A tight spread means the endpoint behaves predictably under repeat calls; a wide spread means the first number you see may not be the number you get in production. A slow but steady API is easier to build on than a fast but erratic one.
Security
20 ptsWhat did the connection actually negotiate?
We record the TLS version and cipher the endpoint agreed to, and how much life is left on its certificate. HTTPS earns most of the weight, TLS 1.3 earns more than 1.2, and a certificate close to expiry loses points because it is a real operational risk. These are observed handshake values, not claims from a documentation page.
Browser access
15 ptsCan you call it straight from a browser, or do you need a server in between?
We send a cross-origin request and read the Access-Control-Allow-Origin header that comes back. A wildcard means you can fetch it directly from front-end code; a restricted or missing header means you will need a proxy or backend. This single fact decides whether a weekend project takes ten minutes or an afternoon.
Transparency
15 ptsDoes the API tell you how much quota you have left and serve its payload sensibly?
We check whether the server publishes rate-limit headers, whether it compresses its response, and whether it declares a correct JSON content type. APIs that surface their own limits let you handle throttling properly instead of discovering it in production.
Grade bands
The 0–100 score maps to a letter grade for quick scanning. Higher is better.
| Grade | Score | What it means |
|---|---|---|
| A+ | 90 – 100 | Exceptional — fast, secure, reliable, well-documented. |
| A | 80 – 89 | Excellent — production-ready with minor rough edges. |
| B | 70 – 79 | Good — solid, dependable choice for most projects. |
| C | 55 – 69 | Fair — usable, but expect trade-offs on speed or DX. |
| D | 40 – 54 | Weak — noticeable reliability or security gaps. |
| F | 0 – 39 | Poor — significant problems; verify before relying on it. |
Score distribution
Across all 1,426 scored APIs (measured and metadata combined), the average is 61.7; the 271 live-tested APIs average 69.8. The measured tier is deliberately spread across the whole range — because Speed is ranked against the population rather than a fixed threshold, only a genuinely fast, stable, browser-callable endpoint reaches A+. A score that hands out top marks to most of the field would not help anyone choose.
How we test
Real HTTP requests
For APIs with a reachable public endpoint, an automated suite sends live
GET requests to the
endpoint, recording status codes, timing, TLS, CORS headers, and response bodies — the basis of a Measured Score.
Batched with timeouts
Tests run in small batches with strict timeouts so a single hanging endpoint cannot skew the run. Slow or non-responsive endpoints are recorded as such rather than silently passed.
Re-tested periodically
Measured scores are refreshed by re-running the endpoint suite, and each live-tested API page shows a "tested on" date. Metadata-scored APIs are labelled "not endpoint-tested" and carry no test date.
Dead endpoints flagged
Endpoints that no longer resolve are marked Unavailable (214 at last check) and excluded from search indexing so they never waste your time.
Disclaimer
API Score reflects automated measurements of reachable endpoints (for the live-tested tier) or observable metadata (for the estimated tier) at the time each was checked. Real-world results can differ based on your region, network, authentication, and the provider's own changes, and scores may go up or down as we re-test. API Score is an independent metric — we are not affiliated with, endorsed by, or sponsored by any of the API providers listed. Always verify an API against your own requirements before depending on it in production.
Frequently Asked Questions
How is the API Score calculated?
Scores use two tiers. A "Measured Score" comes from real HTTP requests to an API's live public endpoint, out of 100 points across five components: Speed 30 (median of three round trips, ranked against every other measured endpoint), Consistency 20 (how much latency varies between those requests), Security 20 (TLS version negotiated and certificate expiry headroom), Browser access 15 (the Access-Control-Allow-Origin header we actually received) and Transparency 15 (published rate-limit headers, compression, correct JSON content type). A "Metadata Score" is used for APIs that require authentication or expose no testable endpoint; it is estimated from observable metadata (HTTPS, auth model, declared CORS, documentation reachability) and is clearly labelled as an estimate. The two scales are not directly comparable, so every API page shows which tier applies.
How often is the API Score updated?
The full measurement suite re-runs weekly. Every live endpoint is called again, response times and headers are re-recorded, and any endpoint that stopped responding is demoted out of the measured tier until it works again. Each measured API page shows the date it was last verified, and the measurement log lists the latest run in full. Metadata-scored APIs are labelled "not endpoint-tested" and carry no test date.
What exactly do you record when you call an API?
For each measured endpoint we record the HTTP status, the content type and payload size, the round-trip response time (median and fastest of three consecutive requests), the negotiated TLS version and cipher, the certificate issuer, the Access-Control-Allow-Origin header, any rate-limit headers the server publishes, and the response body itself. The body is stored and shown on the API page as a captured response, and the field names and types listed on that page are read from that real response rather than written by hand.
Why are only some APIs measured?
An endpoint can only be measured if it can be called without credentials. Roughly a third of the directory requires an API key or an OAuth flow, and some APIs publish no callable example at all. We do not guess at what those would return — they get a metadata score that is labelled as an estimate on every screen it appears.
What does a low API Score mean?
For a measured API, a low score means the endpoint answered but did so poorly relative to its peers — slow, erratic between repeat calls, on an older TLS version, not callable from a browser, or silent about its rate limits. It does not mean the API is broken; plenty of useful APIs are slow or server-side only. For a metadata-scored API, a low score reflects weak observable signals such as no HTTPS or unreachable documentation. Either way it is a prompt to check the API against your own requirements, not a verdict.
Is the API Score affiliated with the API providers?
No. API Score is an independent, automated measurement produced by this directory. We are not affiliated with, endorsed by, or sponsored by any of the API providers we test, and scores reflect endpoint behavior observed at test time only.