Public API.

How it works

• Data comes from the site snapshot and changes only when a new weekly snapshot ships. Responses are cached for up to an hour at the edge and carry an ETag.
• Every response states its source (GitHub Sponsors, Open Collective, Open Source Pledge or a company's own program), the snapshot date and the denylist version.
• Private GitHub Sponsors amounts are never published: amount_usd is null and private is true.
• Spam, excluded companies (see the method) and companies on a weekly hold are left out of every route.
• Basic rate limit: 60 requests per minute per client IP. The counter is kept per server instance, not globally, so it is a backstop rather than a hard quota, and responses served from the edge cache are not counted. Over the limit you get a 429 with a Retry-After header.
• An entry that is not public (spam, excluded, or on a weekly review hold until its review date) returns the same 404 as an unknown slug: "Not available in the public API." Unknown /api routes also return a JSON 404.
• Amounts are in USD. Open Collective figures are cumulative, Pledge figures are annual.

Response shape

{
  "meta": {
    "api_version": "v1",
    "snapshot_date": "2026-10-06",
    "snapshot_hash": "b3cff2ed...",
    "denylist_version": "2026-10-12.4",
    "sources": [{ "key": "oc", "name": "Open Collective" }]
  },
  "pagination": { "page": 1, "per_page": 50, "total": 120, "total_pages": 3 },
  "data": [ ... ]
}

A private amount looks like this:

{
  "source": "gh",
  "source_name": "GitHub Sponsors",
  "amount_usd": null,
  "private": true
}

Errors (400, 404, 405, 429) use { "meta": { ... }, "error": { "status", "message" } } with the matching HTTP status. On /api/movements, snapshot_date is the week you asked for.

Endpoints