Partner API — public catalog data
Registered services can query places and events from mostlyharmless.travel as JSON for use in their own apps — server-side, with an API key, not in the browser.
What is this?
A versioned read API at /api/v1/partner. It returns reviewed, public articles (places, events, objects) including geo, licenses, and a change feed for synchronization.
Access
The API is not available anonymously. We issue API keys to registered partners. Tell us briefly what you plan to build — we will set up partner access for you.
Quick start (technical)
- Obtain an API key (plaintext shown once; afterwards only the keyId is visible).
- Send every request over HTTPS from your own backend only.
- Set the Authorization header and call e.g. GET /api/v1/partner/articles.
Header format:
Authorization: Bearer mh_pk_<keyId>_<secret>
Do not embed the key in websites or mobile apps. There is intentionally no CORS support for browser clients.
Main endpoints
Base path on this server:
GET /api/v1/partner/articles
GET /api/v1/partner/articles/{id}
GET /api/v1/partner/geo/articles?bbox=west,south,east,north
GET /api/v1/partner/changes
Full specification (OpenAPI 3): openapi/partner-v1.yaml
Data format (DTO)
DTO means “Data Transfer Object”: a fixed JSON shape per article that only includes fields partners are allowed to see — no internal moderation, authors, or statistics. Example fields:
id,permalink,type(Place / Event / Object)title,description(Klartext, Sprache per?lang=)geo,location, Event-Felder bei Bedarflicense,source— Herkunft und Nutzungsrecht pro DatensatzupdatedAt— für Sync; Feed unter/changesmitupsertunddelete
Limits & fair use
Each partner has a request quota (configurable). Responses support ETag caching (304). Please process delete tombstones from /changes so removed content disappears on your side too.
Self-service (planned)
Register a normal account. After we enable you (partnerApi role + link) you manage API keys at /partner — create, revoke, and view usage for the last 30 days.