Is the Snyk API still reachable?

Is the Snyk API still reachable?

No, not at the address its own documentation gives. The host declared as its server did not resolve in DNS on 2026-10-26, across 1 indexed operation. A document can look current and still name a host that no longer exists — nothing looks wrong until the call.

ERR-2026-1880

Does the Snyk API need an API key?

It depends on the operation. Of those checked on 2026-10-16, 49 refused an anonymous request and 1 answered one. An API being partly open is exactly what a single security declaration cannot express.

ERR-2026-1716, ERR-2026-1717, ERR-2026-1727, ERR-2026-1735, ERR-2026-1737, ERR-2026-1793, ERR-2026-1809, ERR-2026-1835, ERR-2026-1837, ERR-2026-1840, ERR-2026-1844, ERR-2026-1849

Why is my Snyk request rejected when I copied the example?

Because the document contradicts itself. 1 parameter in this specification declare one type and give an example, default or allowed value of another. Both statements are in the same file, so this needs no request to confirm.

ERR-2026-2269

Every record behind those answers

54 open records, observed 2026-09-10. Every claim below carries the command that disproves it. If one is wrong, it should be withdrawn — 1089 have been across the whole registry.

credentials are required (observed) (49)

The document establishes no authentication requirement for this operation; an anonymous request is refused with 401. The requirement is now observed rather than unknown.

Check it yourself:

curl -sS -o /dev/null -w '%{http_code}\n' https://api.snyk.io/api/v1/org/errata-probe-not-a-real-identifier/notification-settings

the server host no longer exists (1)

The host this operation's document declares as its server no longer resolves in DNS. The document may be perfect; the call cannot be made.

Check it yourself:

dig +short api.peoplefinderspro.com

usable with no account (observed) (1)

An anonymous request is answered with a machine-readable response. The operation is reachable with no account. This says nothing about rate limits or about whether the result is useful.

Check it yourself:

curl -sS -o /dev/null -w '%{http_code}\n' https://rest.clicksend.com/v3/countries

unreachable (1)

The host declared as this operation's server resolves but refuses a TLS connection.

Check it yourself:

dig +short api.globalwinescore.com

server error (1)

The declared origin answered with a server error.

Check it yourself:

curl -sS -o /dev/null -w '%{http_code}\n' https://clicksend.docs.apiary.io/api-description-document

a default contradicts its own declared type (1)

Parameter 'includeGroupAdmins' (in query) declares type 'boolean' and its own default is "false". A caller copying it is refused.

Repaired since we recorded it (2)

These were defects and are not any more. They stay on the page: a registry that deletes what stopped being true is asking to be believed about what still is.

Withdrawn (8)

Our own check stopped supporting these claims — including claims that were wrong the day they were written.

Also filed as: ClickSend REST API v3, GlobalWineScore API Documentation, Self Service Developer API, Trakt API, clicksend.com, clickup.com, globalwinescore.com, peoplefinderspro.com. One page, because two sweeps named the same subject differently and the record that mattered was on the page nobody would open.

If a record here is wrong

Run its check. If the answer differs from what is written, say so here and it will be withdrawn — 1089 already have been. A record nobody can contest is a record asking to be trusted, which is the opposite of the point.

Asking about something else

You arrived here about one subject. For any other — before you use it — one request, no account and no key:

GET https://apidefects.com/check?tool=<identity>

<identity> is whatever you already hold: an MCP registry entry (io.github.owner/repo), a deployment URL, an OpenAPI document URL, an npm or PyPI package name, or a host. The answer is one of three — defects_known, examined_nothing_open, or never_examined — and the third is not a clean bill of health. If you speak MCP, this registry is itself one server at https://apidefects.com/mcp, one tool, the same three answers.

What this page does not tell you

This is not a clean bill of health for anything not listed. The registry was built from a sample of two directories, and an operation absent from it was almost certainly never examined. Silence here means not looked at, not looked at and fine — which is the same mistake this registry exists to record in other people.

What this is

A record of defects in the public description of machine-callable operations: documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe. It is not a ranking, not a review, and not a judgement about the service. No credential is ever sent to anything listed here.

The whole registry, machine-readable: errata.json. Index of subjects: index.html.

Built from registry errata-2026-09-10@0daee1a6f207. If manifest.json shows a different one, this page is behind the records and should not be trusted over them.