It depends on the operation. Of those checked on 2026-09-15, 8 refused an anonymous request and 2 answered one. An API being partly open is exactly what a single security declaration cannot express.
ERR-2026-1675, ERR-2026-1676, ERR-2026-1688, ERR-2026-1694, ERR-2026-1698, ERR-2026-1700, ERR-2026-1704, ERR-2026-1710, ERR-2026-1679, ERR-2026-1709
Because the document is wrong about it. Its OpenAPI description declares no security requirement for 8 operations, and an anonymous request to each was refused with 401 on 2026-09-15. An agent trusting the document plans a call that cannot work.
ERR-2026-1675, ERR-2026-1676, ERR-2026-1688, ERR-2026-1694, ERR-2026-1698, ERR-2026-1700, ERR-2026-1704, ERR-2026-1710
10 open records, observed 2026-09-10. Every claim below carries the command that disproves it. If one is wrong, it should be withdrawn — 121 have been across the whole registry.
The OpenAPI document declares no security requirement for this operation. An anonymous request is refused with 401. An agent trusting the document plans a call that cannot work.
ERR-2026-1675 | get_records | HTTP 401 | checked 2026-09-15, 2 times |
ERR-2026-1676 | get_collection | HTTP 401 | checked 2026-09-15, 2 times |
ERR-2026-1688 | get_group | HTTP 401 | checked 2026-09-15, 2 times |
ERR-2026-1694 | get_groups | HTTP 401 | checked 2026-09-15, 2 times |
ERR-2026-1698 | get_bucket | HTTP 401 | checked 2026-09-15, 2 times |
ERR-2026-1700 | get_collections | HTTP 401 | checked 2026-09-15, 2 times |
ERR-2026-1704 | get_record | HTTP 401 | checked 2026-09-15, 2 times |
ERR-2026-1710 | get_collection-changeset | HTTP 401 | checked 2026-09-15, 2 times |
Check it yourself:
curl -sS -o /dev/null -w '%{http_code}\n' https://firefox.settings.services.mozilla.com/v1/buckets/errata-probe-not-a-real-identifier/collections/errata-probe-not-a-real-identifier/records
An anonymous request is answered with a machine-readable response. The operation is reachable with no account. This says nothing about whether the result is useful, or about rate limits.
ERR-2026-1679 | server_info | HTTP 200 | checked 2026-09-15, 2 times |
ERR-2026-1709 | get_buckets | HTTP 200 | checked 2026-09-15, 2 times |
Check it yourself:
curl -sS -o /dev/null -w '%{http_code}\n' https://firefox.settings.services.mozilla.com/v1/
Also filed as: mozilla.com, mozilla.com:kinto. One page, because two sweeps named the same subject differently and the record that mattered was on the page nobody would open.
Run its check. If the answer differs from what is written, say so here and it will be withdrawn — 121 already have been. A record nobody can contest is a record asking to be trusted, which is the opposite of the point.
This is not a clean bill of health for anything not listed. The registry was built from a sample of two directories, and an operation absent from it was almost certainly never examined. Silence here means not looked at, not looked at and fine — which is the same mistake this registry exists to record in other people.
A record of defects in the public description of machine-callable operations: documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe. It is not a ranking, not a review, and not a judgement about the service. No credential is ever sent to anything listed here.
The whole registry, machine-readable: errata.json. Index of subjects: index.html.
Built from registry errata-2026-09-10@b7cb54d3a847. If manifest.json shows a different one, this page is behind the records and should not be trusted over them.