Public API

Read-only public data of the Open Source Endowment over REST: fund stats, donors, grants, and portfolio. JSON, no account, no API key.

Base URL

https://api.endowment.dev

CORS is open to every origin. The full contract is the OpenAPI 3.1 spec: every operation has an operationId, a description, and typed response schemas, so you can load it straight into an LLM as function-calling tools.

curl -s https://api.endowment.dev/public/stats \
  -H 'API-Version: 1'

Endpoints

All endpoints are GET. Money is in US dollars.

/public/stats

Live totals: donations, donors, members, and fund size in US dollars by money source.

/public/donors

Donors who agreed to be shown, with giving band, photo, and links.

/public/grants

Every grant paid to open source projects: project, maintainer, amount, payment proof, and model score.

/public/portfolio

How the endowment is invested: holdings by asset with their share of the portfolio.

/public/photo/{slug}

A donor photo (WebP). Use picture_url from /public/donors. Not rate limited.

/public/funding.json

funding.json manifest for FLOSS.fund and other funding directories.

/public/openapi.json

The OpenAPI 3.1 description of this API.

/public

Index of the public endpoints.

/health

Liveness check. Not rate limited.

Versioning

Send the API-Version request header. The current version is 1. Omit it to get the current version.
Every response tells you the version that served it in API-Version.
An unsupported version returns 400 with the supported versions.
Within a version we only add fields and endpoints. We never remove or rename them.

Deprecation Policy

A breaking change ships as a new version. Nothing is deprecated today.
When a version or endpoint is deprecated, its responses send Deprecation (RFC 9745), Sunset (RFC 8594), and Link: <https://endowment.dev/docs/api/#deprecation>; rel="deprecation".
It keeps working for at least 180 days after the announcement.
We announce deprecations on this page.

Rate Limits

300 requests per 60 seconds per IP address.
Donor photos and /health are not limited.
Limited responses send RateLimit-Policy: "public";q=300;w=60.
Over the limit you get 429 with RateLimit: "public";r=0;t=60 and Retry-After: 60. Wait that many seconds, then retry.
Data is cached, so polling more than once a minute gains nothing.

Errors

Every error is JSON with a machine-readable error code, a detail message, and a link to the docs. Codes: bad_request, unauthorized, forbidden, not_found, unprocessable, unsupported_version, rate_limited, internal_error.

{
  "error": "rate_limited",
  "detail": "Limit is 300 requests per 60 seconds per IP. Retry after 60 seconds.",
  "docs": "https://endowment.dev/docs/api/"
}