Skip to main content

​
No key, any origin

The Map API has no authentication. Every answer allows any origin (Access-Control-Allow-Origin: *) and exposes its ETag, so you can call it straight from a browser. Your page may send its own headers, such as tracing headers.

​
Caching

Every answer is computed when you ask and carries Cache-Control: no-cache and an ETag. Keep the answer, and send its ETag in If-None-Match when you ask again. If it hasn’t changed, you get an empty 304 Not Modified. Browsers do this by themselves. Answers are compressed with gzip or Brotli when your client accepts it.

​
Rate limit

Each IP address may make 600 requests at once and 60 a second after that. A full screen of tiles is about 12 requests. Past the limit the answer is a 429 Too Many Requests with no body and Retry-After: 1. Call the Map API from your users’ browsers or apps, so each of them has their own limit. Requests through one server of yours share that server’s limit.

​
Errors

An error has a JSON body with a message:

​
Versions

v1 only grows. A new field, filter or endpoint can be added to it, so ignore fields you don’t know. A field that changes or goes comes in a new version, at a new path.