How API Score Works
API Score is a 0–100 quality rating. For 158 APIs with a public, no-auth endpoint we could reach, the score is measured from real HTTP requests to the live endpoint. The remaining 1,268 require authentication or expose no testable endpoint, so their score is estimated from metadata (HTTPS, auth model, CORS, documentation reachability). Every API page states which tier it is — no guessing.
Why this is different from other directories
Most API directories list whatever a provider submits and, at best, sort by popularity. The descriptions are editorial — or increasingly, AI-generated — and nobody checks whether the endpoint even responds.
API Score takes the opposite approach where it can. For the 158 APIs with a public, no-auth endpoint we can reach, an automated suite sends real requests to the live endpoint and records what actually happens: whether it resolves, how fast it answers, whether the connection is encrypted, whether the response is valid JSON, and whether it behaves consistently — a reproducible snapshot grounded in HTTP, not adjectives. We are deliberate about the limit: APIs that need credentials or expose no callable endpoint cannot be honestly "tested", so we mark those scores as metadata estimates rather than pretend otherwise.
The 100-point model
Five components add up to a maximum of 100 points. Each measures a different dimension of what makes an API worth building on.
Reachability
30 ptsDoes the endpoint (and its documentation) actually resolve and respond?
We resolve the API's DNS, open a connection, and confirm the live endpoint returns an HTTP response. We also check that the documentation URL loads. An API that cannot be reached is worthless no matter how good its docs read, so reachability carries the most weight.
Speed
20 ptsHow fast does the endpoint respond when we call it?
We measure the actual round-trip response time of a request to the endpoint and score it on a curve: sub-500 ms responses score full marks, and the score tapers off as latency climbs into the multi-second range. The measured value in milliseconds is shown on each API's page.
Security
15 ptsIs the connection encrypted and the transport configured sanely?
We verify the endpoint is served over HTTPS with a valid TLS certificate, and inspect its CORS headers to see whether the API can be called safely from browser-based applications. APIs stuck on plain HTTP or with broken certificates lose these points.
Developer Experience
20 ptsHow easy is it to make a successful first call?
We inspect the CORS headers to see whether the API can be called directly from browser-based apps, and factor in how much setup a first call needs — no-auth and simple API-key endpoints score higher than OAuth flows. Low-friction access makes an API pleasant to build on. (Response validity is scored separately under Reliability.)
Reliability
15 ptsIs the endpoint consistently available across our checks?
We look at whether the endpoint responds consistently and returns healthy status codes rather than intermittent errors or timeouts. An API that only answers some of the time is risky to depend on in production.
Grade bands
The 0–100 score maps to a letter grade for quick scanning. Higher is better.
| Grade | Score | What it means |
|---|---|---|
| A+ | 90 – 100 | Exceptional — fast, secure, reliable, well-documented. |
| A | 80 – 89 | Excellent — production-ready with minor rough edges. |
| B | 70 – 79 | Good — solid, dependable choice for most projects. |
| C | 55 – 69 | Fair — usable, but expect trade-offs on speed or DX. |
| D | 40 – 54 | Weak — noticeable reliability or security gaps. |
| F | 0 – 39 | Poor — significant problems; verify before relying on it. |
Score distribution
Across all 1,426 scored APIs (measured and metadata combined), the average is 65.5; the 158 live-tested APIs average 86.0. Most land in the B–A range, but a meaningful tail scores poorly — which is exactly the signal a directory should surface.
How we test
Real HTTP requests
For APIs with a reachable public endpoint, an automated suite sends live
GET requests to the
endpoint, recording status codes, timing, TLS, CORS headers, and response bodies — the basis of a Measured Score.
Batched with timeouts
Tests run in small batches with strict timeouts so a single hanging endpoint cannot skew the run. Slow or non-responsive endpoints are recorded as such rather than silently passed.
Re-tested periodically
Measured scores are refreshed by re-running the endpoint suite, and each live-tested API page shows a "tested on" date. Metadata-scored APIs are labelled "not endpoint-tested" and carry no test date.
Dead endpoints flagged
Endpoints that no longer resolve are marked Unavailable (185 at last check) and excluded from search indexing so they never waste your time.
Disclaimer
API Score reflects automated measurements of reachable endpoints (for the live-tested tier) or observable metadata (for the estimated tier) at the time each was checked. Real-world results can differ based on your region, network, authentication, and the provider's own changes, and scores may go up or down as we re-test. API Score is an independent metric — we are not affiliated with, endorsed by, or sponsored by any of the API providers listed. Always verify an API against your own requirements before depending on it in production.
Frequently Asked Questions
How is the API Score calculated?
Scores use two tiers. A "Measured Score" comes from real HTTP requests to an API's live public endpoint — reachability, response time, HTTPS/TLS, CORS, and valid-JSON consistency, out of 100 points across five components (Reachability 30, Speed 20, Security 15, Developer Experience 20, Reliability 15). A "Metadata Score" is used for APIs that require authentication or expose no testable endpoint; it is estimated from observable metadata (HTTPS, auth model, CORS, documentation reachability) and is clearly labelled as an estimate. Every API page shows which tier applies.
How often is the API Score updated?
Measured scores are recomputed by re-running the automated endpoint tests, and each measured API page shows a "tested on" date so you can see when it was last verified. Metadata-scored APIs are labelled "not endpoint-tested" and carry no test date.
What does a low API Score mean?
A low score (grade D or F) means our automated checks found real problems at test time — such as a slow endpoint, missing HTTPS, invalid JSON, or intermittent availability. It is a signal to verify the API yourself before depending on it, not a claim that it can never be used.
Is the API Score affiliated with the API providers?
No. API Score is an independent, automated measurement produced by this directory. We are not affiliated with, endorsed by, or sponsored by any of the API providers we test, and scores reflect endpoint behavior observed at test time only.