Are these APIs free to call?

Each source publishes its data under its own licence, and that licence is the one to read. Calling them through fastCRW costs credits for server-run sources, which you can see per capability before you call. Client-run sources cost no credits.

Do I need an API key for each source?

Through fastCRW you use one key for the server-run sources. A client-run source such as FRED or Discogs needs its own key, which you save with the local connector command. MusicBrainz needs no key of its own.

How do I know which APIs an agent can use safely?

Look at the licence line and the attribution text on each response. A source whose terms limit commercial use is marked that way in the catalogue, and client-run sources keep their own terms.

Free Public APIs for AI Agents, With the Licence Attached

By the fastCRW team · Catalogue figures checked 2026-11-05 against GET /v1/data · Verify independently before relying on any figure.

Most public APIs were built for a web page or a spreadsheet, not for a model that has to pick a tool, read the reply and move on. An agent needs JSON it can parse, stable IDs it can pass to the next call, and a licence it can read. This list gives 30 public sources that meet that bar, grouped by the job they do for an agent, each with its licence line and a call you can run.

What makes an API good for an agent

Structured output. JSON or GeoJSON the model does not have to scrape out of HTML.
Stable identifiers. A CIK, a DOI, a CVE ID or an RXCUI that a second call can use.
A licence line you can quote. The source states how its data may be reused, and the response carries that statement with it.
A primary source. The publisher or registry of the record, not a copy of it.

An API that meets these four points can be called in a loop without a human checking each reply. The sections below use that test.

The 30 sources, grouped by job

Each source appears once. The licence class comes from its catalogue row. "Server" means the call runs on fastCRW's side; "client" means it runs on your machine under the source's own terms. Only MusicBrainz is client-run in this list.

Finance and companies

SEC EDGAR (sec): US company filings and XBRL facts by CIK. US government work, not subject to domestic copyright under 17 U.S.C. 105. Server.
GLEIF Global LEI Index (gleif): the public register of legal entity identifiers, including who owns whom. The access service data is under CC0 1.0; the GLEIF name and logo are not. Server.
Companies House (companieshouse): the UK company register, with company profiles, officers and filing history. Open Government Licence v3.0, and the source must be acknowledged. Server.
World Bank Open Data (worldbank): indicators for any country and year. The World Bank licenses its datasets under CC BY 4.0, with attribution. Server.
European Central Bank (ecb): euro-area statistics from the ECB's SDMX service, including exchange rates. Its website terms say that when information is distributed or reproduced, "it must appear accurately and the ECB must be cited as the source." Server.
US Bureau of Labor Statistics (bls): labour statistics such as consumer prices and unemployment as dated series. BLS "publishes its data for free public use and asks that it be cited as the source." Server.

Research

OpenAlex (openalex): scholarly works, authors, institutions and topics. CC0 1.0; attribution is appreciated but not required. Server.
Crossref (crossref): DOIs, titles, authors, funders and journals. Crossref's statement is that almost none of its metadata is subject to copyright, and you may use it for any purpose. Server.
PubMed (NCBI E-utilities) (pubmed): bibliographic records across PubMed and other NCBI databases. The NLM line reads: "Public domain information on the National Library of Medicine (NLM) Web pages may be freely distributed and copied." Server.
Europe PMC (europepmc): life-science literature with citations and full-text links. EMBL-EBI adds no restrictions beyond those of the original data owners. Server.
Zenodo (zenodo): datasets, software and papers with DOIs. Metadata is CC0; each deposited file carries the licence its depositor chose. Server.

Security and packages

NIST National Vulnerability Database (nvd): CVE records with CVSS scores and references. US government work, not subject to domestic copyright. Server.
EPSS (FIRST) (epss): the modelled probability that a CVE will be exploited in the next 30 days, with its percentile. FIRST "publishes EPSS scores freely via API"; attribution is requested in publications and products. Server.
OSV.dev (osv): open-source vulnerability records across npm, PyPI, Go, Maven and more. Published under CC BY 4.0 by the Open Source Vulnerabilities project. Server.
npm Registry (npm): package metadata, versions, maintainers and download counts. The catalogue row points to the registry's own agreement for replicating its data. Server.
PyPI (pypi): project and release metadata, requirements and file hashes. Read the PyPI terms before you redistribute package content, because they grant the Python Software Foundation a licence over uploaded content. Server.
endoflife.date (endoflife): support and end-of-life dates for more than 300 products. Its product descriptions are adapted from English Wikipedia under CC BY-SA 3.0, so derived work carries share-alike. Server.

Health and food

openFDA (openfda): drug and device adverse events, recalls, labels and registrations. US government work. openFDA adds its own terms: the data is not for clinical decisions, and you may not imply FDA endorsement. Server.
ClinicalTrials.gov (clinicaltrials): registered clinical studies with conditions, interventions, sponsors and locations. US government work. Server.
RxNorm (RxNav) (rxnorm): normalised drug names and RXCUI codes from the US National Library of Medicine. NLM asks that its data be acknowledged as publicly available data courtesy of the U.S. National Library of Medicine. Server.
USDA FoodData Central (usda-food): nutrient composition for hundreds of thousands of foods. Work of the US federal government, with the agency named as the source. Server.
Open Food Facts (openfoodfacts): product data by barcode, including ingredients, allergens and nutrition facts. Open Database License (ODbL): a derived database must be shared under the same licence, and Open Food Facts must be credited. Server.

Weather and earth

National Weather Service (weathergov): US forecasts, observations and active alerts. US government work. Server.
USGS Earthquake Catalog (usgs): every earthquake in the USGS catalogue, queryable by time, place and magnitude. US government work. Server.
NOAA National Hurricane Center (nhc): active tropical cyclones with position, intensity and forecast tracks. The NWS disclaimer says its pages "may be used without charge for any lawful purpose" if you do not claim the content as your own, imply endorsement, or modify it and present it as official. Server.
NASA (nasa): near-Earth object data and imagery. NASA content is generally not protected by US copyright and may be reused, but NASA logos and insignia are excluded. Server.
NASA POWER (nasapower): solar and meteorological data for any point on Earth, daily or monthly, from satellite analysis. US government work. Server.

Reference and media

Wikidata (wikidata): structured facts about anything with a Wikidata item, with identifiers and relationships. Statement data is released under CC0 1.0. Server.
Wikipedia (wikipedia): article summaries and metadata from the English Wikipedia REST API. Article text is CC BY-SA 4.0 and GFDL, so reuse needs attribution and share-alike on derivatives of the text. Server.
MusicBrainz (musicbrainz): artists, releases, recordings and labels with stable MBIDs. The service states: "Non-commercial use of this web service is free; please see our commercial plans." Client-run, so the call happens on your machine.

Route each job to a source

When an agent gets a question, it needs to know which source to try first. This table maps common jobs to the sources above. Each row is a starting point, and the agent can search the catalogue when none of them fits:

Agent job	Start with
Company filings and financial facts	`sec`
Legal entities and company registers	`gleif`, `companieshouse`
Macroeconomic indicators	`worldbank`, `ecb`, `bls`
Scholarly papers and citations	`openalex`, `crossref`, `europepmc`
Vulnerabilities and exploit likelihood	`nvd`, `epss`, `osv`
Package metadata and product support dates	`npm`, `pypi`, `endoflife`
Drugs, trials and adverse events	`rxnorm`, `clinicaltrials`, `openfda`
Food composition and product barcodes	`usda-food`, `openfoodfacts`
Forecasts, alerts, quakes and storms	`weathergov`, `nhc`, `usgs`
Entity IDs and reference facts	`wikidata`, `wikipedia`
Music artists and releases	`musicbrainz`

Four things that go wrong with free APIs

The licence is not the same for every row. Public domain, CC0, CC BY and share-alike sources sit side by side in one list. A share-alike source changes what your output must carry, so read the row before you publish a derived result.
Upstream limits still apply. NCBI asks direct clients to send no more than three requests per second, and it warns that a client that ignores this can be blocked. Plan batch jobs with that in mind, even when a catalogue call is the one you make.
"Served from cache" is not "out of date". The is_stale flag in a REST response means the body came from the response cache, and cache_age_seconds says how old it is. It does not mean the upstream data has changed. Check the publisher's own update dates for anything time-sensitive.
Large results break agent loops. MCP results over 256 KiB are refused with result_too_large, and that refusal is refunded for server sources. Use the source's filters, such as a date range or a select list where one exists, so each result fits.

Lists and callable catalogues

The public-apis list on GitHub is a good place to find out what exists. It names the APIs and links to their docs. This post adds what a list does not carry: for each source it gives the licence line from the publisher and an attribution text, and it runs a real call you can copy. Use the list to discover, and use a callable catalogue when you want the agent to make the call.

How to call any of them

Discovery is free. Search the catalogue by topic, and the response includes the provider, the capability and the options each one takes:

curl "https://api.fastcrw.com/v1/data/find?query=earthquakes&limit=3" \
  -H "Authorization: Bearer $CRW_API_KEY"

The first results are usgs/event, usgs/query and usgs/count. Call one of them with its options. This asks the USGS catalogue for earthquakes of magnitude 6 or more, and returns five of them as GeoJSON:

curl "https://api.fastcrw.com/v1/data/usgs/query?minmagnitude=6&limit=5" \
  -H "Authorization: Bearer $CRW_API_KEY"

Every server call returns the same envelope, with provenance.licence and provenance.attribution_text beside the data. Store those two fields with any result you reuse, so the licence travels with the number.

Check a source before you build on it

Before an agent depends on a source, make one call and read the response. Open the provider page, read the licence line and the attribution text, and run a single capability with the options you expect to use. If the response carries the licence and attribution fields and the data has the shape you need, the source is ready. The find call also accepts category and provider filters, so you can narrow a search to one agency or one topic.

What "free" means here

Find and the catalogue are free and never billed. A call to a server-run source costs 1 credit, and the capability's creditsCost field tells you the price before you call. A call that fails upstream is not billed. A call to a client-run source such as MusicBrainz costs 0 credits, because the data never passes through fastCRW.

"Free" in the title refers to the data's source terms, not to our pricing. Check each row's licence before you put the data in a product. The overview of public data APIs for agents explains how the catalogue is organised.

Two sources for one job

Several jobs have two sources that answer different parts of the question, and an agent is better off calling both. In security, NVD holds the CVE record with its CVSS scores and references, EPSS gives the modelled probability that the CVE will be exploited in the next 30 days, and OSV lists advisories per package ecosystem. A vulnerability answer that names the CVE, its severity and its exploit likelihood needs the first two, and a dependency check needs the third.

In research, OpenAlex and Crossref overlap on works and DOIs. OpenAlex covers topics, authors and institutions directly, and Crossref is the registry to ask about a DOI's metadata and agency. Pick the source whose entity matches the question, and use the other one to check it.

What this list does not do

It does not rank the APIs by quality. Each one is included because it returns structured data from its publisher for an agent job.
It does not promise uptime. Upstream services can refuse or time out, and the response says so.
It does not replace reading the terms. The licence lines here are short extracts, not legal advice.

Sources

public-apis, a community list of public APIs
fastCRW data sources documentation
Provider pages in the Pergamon catalogue: SEC EDGAR, GLEIF, Companies House, World Bank, ECB, BLS, OpenAlex, Crossref, PubMed, Europe PMC, Zenodo, NVD, EPSS, OSV.dev, npm, PyPI, endoflife.date, openFDA, ClinicalTrials.gov, RxNorm, USDA FoodData Central, Open Food Facts, National Weather Service, USGS, National Hurricane Center, NASA, NASA POWER, Wikidata, Wikipedia, and MusicBrainz.