Guides
Frequently asked questions
Do I need an API key?
No. Every endpoint is public. Only the demo authentication routes expect a bearer token, which you get from the demo login.
I created a record but GET does not return it. Is that a bug?
No, writes are simulated on purpose. The API validates and responds as if the change happened, but the shared dataset never changes. Keep created records in your client state. See simulated writes.
Can I call it from the browser?
Yes. CORS allows every origin without credentials, and useful headers such as X-Request-Id and the rate-limit headers are exposed to JavaScript. Cookies are never used.
Is any of the data real?
No. All names, emails, addresses, products, and quotes are fictional and generated from a fixed seed. Emails use example.com.
Can I use it in production or to secure my app?
No. It has rate limits, no uptime guarantee, and the authentication is a teaching tool with public credentials. Use it for learning, demos, and tests only.
Why am I getting 429 Too Many Requests?
You exceeded the per-IP rate limit. Wait for the number of seconds in the Retry-After header. Shared networks (schools, offices) share one IP, so consider running your own instance for workshops.
Can I run my own copy?
Yes. The project includes Docker and Docker Compose files for the API, MongoDB, and this website. Your own instance can use higher limits and is the right choice for CI pipelines and load tests.
Can I generate a client or import into Postman?
Yes. Import the OpenAPI document into Postman, Insomnia, or an OpenAPI code generator.
Where do the images come from?
The API serves its own deterministic SVG placeholders, so there are no third-party image hosts or broken links.