Common Rules
The JSON API is protected by a secret key and is intended for external projects, mobile apps and internal integrations.
Format
JSON, UTF-8
Auth
Secret key required
Methods
GET, OPTIONS
CORS
Enabled: Access-Control-Allow-Origin: *
Send the key either via `X-API-Key` or `Authorization: Bearer <key>`.
Every successful response includes `ok`.
`lang` supports `ru`, `en`, `zh`. Unsupported values fall back to `ru`.
`limit` is clamped between `1` and `100`.
`offset` is used for list pagination.
`OPTIONS` returns `204`, unsupported methods return `405`.
Authentication
API `GET` requests without a valid key return `401 Unauthorized`. `OPTIONS` stays public for CORS preflight requests.
Option 1: X-API-Key
X-API-Key: <your-secret-key>
Option 2: Authorization Bearer
Authorization: Bearer <your-secret-key>