Market read API
Read your own Market data from a script on your server: catalog search and lists, extension cards, your watchlist, your saved searches and the portfolio radar, and a CSV export. The API answers the same questions as the Market screens, with the same limits, for the account that owns the key.
1. Create a key
Open Settings, then Account, then API keys in the web app and create a key. The full key is shown once, right after it is created: copy it into your secret store. We keep only its SHA-256 hash, so a lost key cannot be recovered, only rotated.
A key looks like this:
eop_k3j5x7q2m4n6p_7t2w4y6a3c5e7g2j4l6n3q5s7u2w4y6a3c5e7g2j4l6n3q5s7u2w4y6aThe part before the second underscore is the key's public prefix. Settings show it next to the key's name, creation date and last use, so you can tell keys apart without the secret.
2. Call the API
Send the key as a bearer token. Every route is a GET under one prefix:
curl -s https://extops.dev/api/v1/market/read/watchlist \
-H "Authorization: Bearer $EXTOPS_API_KEY"| Route | What it returns |
|---|---|
/search | Catalog search with the Explorer's parameters: text, mode, filters, sort, paging. |
/lists/{kind} | One of the mass lists: new, removed, releases, movers and the rest. |
/categories | Store categories with their sizes. |
/extensions/{id} | One extension card with its history and store activity. |
/extensions/{id}/timeline | Further pages of the card's store activity timeline. |
/watchlist | The extensions you watch. |
/segments | Your saved searches. |
/segments/{id}/members | The extensions of one saved search, as of the last closed catalog pass. |
/portfolio/radar | Everything that moved across your saved searches, watched and own extensions, each extension once. |
/export | A search or a list as CSV, up to 5,000 rows. |
The answers are the same JSON the web app reads, described field by field in the OpenAPI file. The API only reads: there are no write routes, and any method other than GET is refused.
3. Whose data a key sees
A key belongs to your account and acts as that account. Your saved searches, watchlist and radar are yours alone: a saved search of another account answers 404, the same as one that does not exist. Catalog lists are cut by your plan exactly as on screen.
4. Limits
- 120 requests per minute per account, summed over all of its keys: a second key is not a second allowance. Every answer carries
X-RateLimit-Limit,X-RateLimit-RemainingandX-RateLimit-Reset. - The same daily Market budget as the app counts your calls too: a key is you, not a second allowance.
- CSV export: up to 5,000 rows per file and 50 files a day per account.
- Up to 5 active keys per account, enough to rotate without downtime.
Over a limit the API answers 429 with Retry-After and the reset time in details.reset_at.
5. Rotation, revocation and plan changes
Rotate replaces a key with a new one and stops the old one at once. For a rotation without downtime, create a second key, deploy it, then revoke the first. Revoking is allowed on every plan.
The API is part of the Fleet plan. If the plan changes, your keys are not deleted: calls answer 403 with plan_required, Settings show the keys as paused, and the same keys work again after you return to Fleet.
6. Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | api_key_invalid | No key, or an unknown or malformed one. |
| 401 | api_key_revoked | The key was revoked or rotated. |
| 403 | api_key_scope | The key's scope does not cover this route. |
| 403 | plan_required | Your plan does not include the API right now. |
| 429 | rate_limited | A limit is spent until the time in details.reset_at. |