API 参考文档 | Wambesha

API 参考文档仅提供英文版本。

API 参考文档 — v1

https://api.wambesha.com · Bearer 认证 · JSON

v1 的每个端点，包括其参数、请求与响应示例，以及可能返回的错误。端点说明为英文。

认证

Your API key, presented as a Bearer token. Keys are per-account and carry a plan; the plan decides which endpoints answer and what your quota is. Never embed a key in a browser client — it is a credential, and a browser cannot keep one.

HTTP

Authorization: Bearer $WAMBESHA_API_KEY

若某个端点接受公开演示密钥，其「立即试用」代码片段会带有该密钥，因此可以直接运行；其他代码片段都需要使用您自己的密钥。演示密钥仅用于试用 API：它每天轮换，可能随时被停用，且绝不能用于生产环境。您构建的任何内容都请使用您自己的密钥。

响应标头

X-Request-ID每个经过身份验证的响应
The id of this request, on every response - success or error. Quote it to support: it is how we find your request in our logs. An X-Request-ID you send is honoured and echoed back, so you can use your own; otherwise we generate one. /v1 error bodies carry no trace id of their own.
X-Quota-Reset每个经过身份验证的响应
RFC 3339 instant at which the billing period rolls. Present on every response to a request whose key was metered - every 2xx, every error a handler returned, and the quota 429. Absent on a refusal that happens before metering: a missing or unknown key (401), a restricted key or a plan that does not carry the endpoint (403), a public demo-key gate refusal, and the pre-authentication flood throttle.
X-Calls-Remaining每个经过身份验证的响应
Requests left in the period after this one, never below 0. Present whenever X-Quota-Reset is (see there for when a response carries no quota headers).
X-Verifications-Remaining每个经过身份验证的响应
How many verifications you can still make before a limit stops you. The daily limit and the monthly allowance are counted separately; this is whichever of the two runs out first. Sent whenever X-Quota-Reset is.
X-Quota-Grace每个经过身份验证的响应
true when THIS request fell inside the 10% grace band above a monthly ceiling. A grace request is served and is not billed; treat true as "back off now", not as headroom. Always true or false, never absent when the other quota headers are present.
Retry-After仅在返回 429 时
Seconds to wait before retrying. On every 429 - the quota hard stop, the public demo key's limits, and the pre-authentication flood throttle (which carries this header alone, because no key has been read yet).
X-Demo-Challenge-Mode仅限演示密钥
Sent only on responses to the public demo key. The value interactive asks the documentation page to show the visible verification widget - it is sent once a browser has made more than five runs in ten minutes or has received a 429. The page then repeats the header, X-Demo-Challenge-Mode: interactive, on its next request, with the widget's token in X-Demo-Challenge. Requests made with your own key never receive it.

错误

每个错误的响应体结构都相同：HTTP 状态、可用于分支判断的稳定代码、供人阅读的消息，以及值有误时的字段错误。联系我们时如需指明某个请求，请提供该请求的 X-Request-ID 响应标头。

已记录的响应

Content-Type: application/json
X-Request-ID: 5f3c9a1e7b2d4c60

GET/v1/search

{
  "timestamp": "2026-09-27T12:00:00Z",
  "status": 400,
  "error": "Bad Request",
  "message": "Enter at least 2 characters to search.",
  "path": "/v1/search",
  "errors": [
    {
      "field": "q",
      "rejectedValue": "a",
      "message": "Enter at least 2 characters to search."
    }
  ],
  "metadata": {
    "errorCode": "CATALOG_SEARCH_QUERY_TOO_SHORT"
  },
  "code": "validation-failed"
}

400

validation-failed400405
The request is not one this operation accepts - a parameter outside its rule, a missing required parameter, an unsupported language, or a method the route does not take.
处理方法Fix the request; errors names the parameter. Retrying it unchanged fails the same way.
cursor-invalid400
The cursor is malformed, stale, from a different filter set or sort, or past what your key may page.
处理方法Drop the cursor and request the first page again.
unauthenticated401
No key, or a key that is unknown, malformed, expired or revoked - one answer for all of them. Also what a switched-off public demo key answers.
处理方法Send a valid key as Authorization: Bearer <key>; if it was rotated, use its replacement.
forbidden403
The key is valid but a restriction its owner set - a scope, an IP allowlist, a referrer allowlist - excludes this request. Also a key rotating a key other than itself.
处理方法Call from an allowed place or change the key's restrictions in the console.
plan-required403
Your plan does not include this operation or this freshness, or the public demo key was used for something it cannot reach.
处理方法Upgrade the plan, or use your own key rather than the demo key.
challenge-required403
A browser call with the public demo key carried no valid bot-check token.
处理方法Complete the check on the page and run the request again. Not sent to paying keys.
not-found404
Nothing matches the reference, or the reference is not a valid id.
处理方法Check the id; a merged record answers 200 with its survivor, so 404 means it never existed here.
conflict409
The request contradicts current state - a key already rotated, revoked or expired, or an identifier that matches several records.
处理方法Read metadata.errorCode; rotate the replacement key, or disambiguate the identifier.
gone410
The record existed and has been removed. No reason is given, by design.
处理方法Drop it from your mirror; /v1/changes reports it as removed.
quota-exhausted429
A plan ceiling is reached - requests (daily or monthly) or verifications. The message names which.
处理方法Wait for Retry-After (the daily window resets at midnight UTC, the monthly one at X-Quota-Reset), or upgrade. The refused call is not charged.
rate-limited429
Too many requests too fast - the per-address flood throttle, or the public demo key's own limits, temporary blocks and in-flight cap.
处理方法Wait Retry-After seconds, then slow down.
upstream-unavailable503
We could not meter or serve the request right now. Never served unmetered, never charged.
处理方法Retry with exponential backoff.

版本管理

v1 永远不会出现破坏性变更：在 v1 内，路径、必填参数和响应字段都不会改变。可能会新增字段和端点，且会先在变更日志中公布。版本控制说明

端点

Discovery

Titles

People

Changes

Account