It depends on the operation. Of those checked on 2026-10-16, 2 refused an anonymous request and 1 answered one. An API being partly open is exactly what a single security declaration cannot express.
ERR-2026-1756, ERR-2026-1851, ERR-2026-2178
3 open records, observed 2026-09-10. Every claim below carries the command that disproves it. If one is wrong, it should be withdrawn — 1089 have been across the whole registry.
The document establishes no authentication requirement for this operation; an anonymous request is refused with 401. The requirement is now observed rather than unknown.
ERR-2026-1756 | get notification settings | HTTP 401 | checked 2026-10-16, 3 times |
ERR-2026-1851 | gets suggested follows during signup | HTTP 401 | checked 2026-10-16, 3 times |
Check it yourself:
curl -sS -o /dev/null -w '%{http_code}\n' https://www.clubhouseapi.com/api/get_settings
An anonymous request is answered with a machine-readable response. The operation is reachable with no account. This says nothing about rate limits or about whether the result is useful.
ERR-2026-2178 | Clubhouse uses this to check for updates when app is not installed from App Store (eg Test | HTTP 200 | checked 2026-10-16, 3 times |
Check it yourself:
curl -sS -o /dev/null -w '%{http_code}\n' https://www.clubhouseapi.com/api/check_for_update
Run its check. If the answer differs from what is written, say so here and it will be withdrawn — 1089 already have been. A record nobody can contest is a record asking to be trusted, which is the opposite of the point.
You arrived here about one subject. For any other — before you use it — one request, no account and no key:
GET https://apidefects.com/check?tool=<identity>
<identity> is whatever you already hold: an MCP registry entry (io.github.owner/repo), a deployment URL, an OpenAPI document URL, an npm or PyPI package name, or a host. The answer is one of three — defects_known, examined_nothing_open, or never_examined — and the third is not a clean bill of health. If you speak MCP, this registry is itself one server at https://apidefects.com/mcp, one tool, the same three answers.
This is not a clean bill of health for anything not listed. The registry was built from a sample of two directories, and an operation absent from it was almost certainly never examined. Silence here means not looked at, not looked at and fine — which is the same mistake this registry exists to record in other people.
A record of defects in the public description of machine-callable operations: documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe. It is not a ranking, not a review, and not a judgement about the service. No credential is ever sent to anything listed here.
The whole registry, machine-readable: errata.json. Index of subjects: index.html.
Built from registry errata-2026-09-10@0daee1a6f207. If manifest.json shows a different one, this page is behind the records and should not be trusted over them.