On July 6, 2026 I asked REST Countries for the United States. It answered HTTP 200. Green light, ship it. Then I read the body: "success":false, "data":null, and a note that the whole API version is deprecated. A 200 that means no. Ten seconds earlier I would have written that straight into a pipeline as country reference data.

Same afternoon, the US Census API handed me an HTTP 302 redirect to a “missing key” page for a shape of query that used to be keyless. Neither of those is an error your if resp.status_code == 200 check will catch.

A free government API is a public-sector or intergovernmental endpoint that returns JSON without a key, a signup, or a card. Not a CSV export, not a FOIA form, not a portal from 2009. A real REST endpoint. The ten below need none of those, and I re-verified each with a live curl on July 6, 2026 (HTTP 200, real body). If you build data pipelines, dashboards, or AI agents that need authoritative ground truth (federal spending, drug safety, the national debt, clinical trials, biodiversity) these are the lookups I reach for. The kind of facts a language model will happily hallucinate if you let it.

Here is the counterintuitive part. People expect government data to be the flaky link. In this batch it was the opposite: the ten government and intergovernmental endpoints returned clean, correct JSON, and the two that failed loudest were the community-run alternative (REST Countries, above) and a Census query that now wants a key. These APIs are primary sources. They do not sunset an endpoint to push a new pricing tier. But keyless does not mean careless, and 200 does not mean success.

Let me be straight about scope, because this is where writers usually lie. I did not run a government-data resolver across all 2,190 of my production runs. That would be false. I called each endpoint once on July 6, 2026, with a single request. The only thing I am carrying over from those 2,190 runs is one narrow, hard-won pattern: enrichment data fails as a confident 200 with a wrong body far more often than as an honest 500, which is exactly why the field-level notes below matter more than the endpoint list. This is a different axis from my recent keyless roundups (company data, holidays, CVEs); zero overlap in providers.

Here is the full set at a glance, grouped by the job each one does.

#	API	What it answers	Example call	No key?
1	USAspending	Federal agencies and their budgets	GET api.usaspending.gov/api/v2/references/toptier_agencies/	Yes
2	Treasury FiscalData	US national debt to the penny	GET api.fiscaldata.treasury.gov/.../debt_to_penny	Yes
3	Federal Register	Daily US government rules and notices	GET federalregister.gov/api/v1/documents.json	Yes
4	openFDA	Drug, device, and food adverse events	GET api.fda.gov/drug/event.json?limit=1	Yes
5	PubMed E-utilities	Search 37M+ biomedical papers	GET eutils.ncbi.nlm.nih.gov/.../esearch.fcgi?...	Yes
6	ClinicalTrials.gov v2	480k+ clinical study records	GET clinicaltrials.gov/api/v2/studies?...	Yes
7	CDC (Socrata)	Public-health datasets via SoQL	GET data.cdc.gov/resource/pwn4-m3yp.json?$limit=1	Yes
8	GBIF	Global species and biodiversity	GET api.gbif.org/v1/species/match?name=...	Yes
9	USGS Earthquakes	Real-time seismic catalog (GeoJSON)	GET earthquake.usgs.gov/fdsnws/event/1/query?...	Yes
10	World Bank	16k+ global development indicators	GET api.worldbank.org/v2/country/us?format=json	Yes

What makes this a list and not one API: there is no single “ask the government” endpoint. Money lives at Treasury and USAspending, drug safety at the FDA, seismic risk at USGS, global indicators at the World Bank. Which door you knock on depends entirely on the question. Reading the response correctly is the rest of the job.

Group A: money, debt, and the federal record

Three keyless endpoints that answer “what is the government doing with money and rules,” straight from the source.

1. USAspending: every federal agency and what it can spend

Hand USAspending nothing at all and it hands back every top-tier federal agency with its budget authority for the current fiscal year. It is a huge API (award search, recipients, geography), but the agencies reference endpoint is the friendliest first pull.

# runnable, read-only
curl "https://api.usaspending.gov/api/v2/references/toptier_agencies/"

{"results":[
  {"agency_id":1525,"toptier_code":"247","abbreviation":"AAHC",
   "agency_name":"400 Years of African-American History Commission",
   "active_fy":"2026","active_fq":"3",
   "budget_authority_amount":0.0,
   "current_total_budget_authority_amount":15823226897068.67}]}

Two fields matter and they are not the same. budget_authority_amount is that one tiny commission’s slice (0.0 here). current_total_budget_authority_amount is the government-wide total, repeated on every row: 15,823,226,897,068.67 dollars, roughly $15.8 trillion of budget authority. Grab the wrong one and your dashboard is off by twelve orders of magnitude. Note active_fy is 2026 and active_fq is 3, so you are reading the current fiscal quarter, not a stale snapshot. No published hard rate limit; it answered on a bare curl user agent, but be polite and cache. Terms at api.usaspending.gov.

When to use it: any US federal spending, award, or recipient question. This is the front door.

2. Treasury FiscalData: the national debt, to the penny

FiscalData is the US Treasury’s open data service. The debt_to_penny endpoint returns the total public debt outstanding for a given day, exact to the cent, with rich labels attached.

# runnable, read-only
curl -g "https://api.fiscaldata.treasury.gov/services/api/fiscal_service/v2/accounting/od/debt_to_penny?sort=-record_date&page[size]=1"

{"data":[
  {"record_date":"2026-07-02",
   "tot_pub_debt_out_amt":"39375254020492.22",
   "debt_held_public_amt":"31678903447798.93",
   "intragov_hold_amt":"7696350572693.29",
   "record_fiscal_year":"2026","record_fiscal_quarter":"4"}],
 "meta":{"count":1}}

As of July 2, 2026, total public debt outstanding was $39,375,254,020,492.22. The numbers arrive as strings, so cast before you do math. And there is a curl trap worth flagging: the page[size] parameter has literal square brackets, so plain curl treats them as a glob range and errors with “bad range.” Pass -g (or --globoff), or URL-encode the brackets. I have watched people blame the API for that one. Keyless, generous, and it exposes daily operations, exchange rates, and interest rates through sibling endpoints. Docs at fiscaldata.treasury.gov.

When to use it: debt, Treasury operations, official exchange rates, anything fiscal with an audit trail.

3. Federal Register: the government’s daily journal

The Federal Register is where US rules, proposed rules, presidential documents, and public notices are published every business day. The API is keyless and filterable by agency, date, and type.

# runnable, read-only
curl "https://www.federalregister.gov/api/v1/documents.json?per_page=1"

{"count":10000,"total_pages":50,
 "next_page_url":"https://www.federalregister.gov/api/v1/documents?...&page=2",
 "results":[
  {"title":"Improvements to Rules on Recoupment of Benefit Overpayments",
   "type":"Proposed Rule",
   "abstract":"The Pension Benefit Guaranty Corporation (PBGC) is proposing..."}]}

One honest caveat: this is a live daily feed, so results[0] moves. On July 6 the top item was a PBGC proposed rule on benefit-overpayment recoupment; run the curl and you will get whatever is newest. The shape is the point, not my one document. Note the pagination is cursor-based via next_page_url, not a simple offset, so follow the link rather than incrementing a page number past the wall. Use fields[] to slim the payload. Keyless. Docs at federalregister.gov/developers.

When to use it: regulatory monitoring, compliance calendars, tracking an agency’s rulemaking.

Group B: health, drugs, and clinical data

Four keyless endpoints covering drug safety, the biomedical literature, active trials, and public-health datasets. This is the densest cluster of authoritative data on the list.

4. openFDA: adverse events, recalls, and drug labels

openFDA exposes FDA data on drugs, devices, and food: adverse events, recalls, and labels, with Elasticsearch-style search= and count= queries. It works with no key, and a free key only raises your limit.

# runnable, read-only
curl "https://api.fda.gov/drug/event.json?limit=1"

{"meta":{
  "disclaimer":"Do not rely on openFDA to make decisions regarding medical care...",
  "terms":"https://open.fda.gov/terms/",
  "results":{"total":20328575}},
 "results":[{"safetyreportid":"5801206-7"}]}

That meta.results.total is 20,328,575 adverse-event reports in the drug endpoint alone. The meta block also ships the disclaimer, terms, and license on every response, which tells you exactly how the data may be used. Read the free-tier limit honestly, because this one is real: without a key you get 240 requests per minute and 1,000 per day per IP address. A free key lifts the daily ceiling to 120,000. If you are batching, you will hit the 1,000/day wall fast, so plan for the key before you ship. Terms at open.fda.gov.

When to use it: drug and device safety signals, recall monitoring, label lookups.

5. PubMed E-utilities: search 37 million biomedical papers

NCBI’s E-utilities are the programmatic door to PubMed. esearch returns matching article IDs; efetch and esummary pull the records. It is the backbone for any retrieval-augmented system over published science.

# runnable, read-only
curl "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esearch.fcgi?db=pubmed&term=crispr&retmax=2&retmode=json"

{"esearchresult":{
  "count":"68891","retmax":"2","retstart":"0",
  "idlist":["42402242","42402225"]}}

A search for crispr returned 68,891 matching papers, with the two newest IDs at the top. Feed those IDs to efetch for abstracts. The keyless limit is the one to respect: 3 requests per second per IP, and NCBI does enforce it. A free API key raises that to 10 per second. Pass retmode=json explicitly or you get XML, which is the same “read the response format” trap that bites people on the seismic endpoint below. Docs at ncbi.nlm.nih.gov/books/NBK25501.

When to use it: literature search, science RAG, citation tooling.

6. ClinicalTrials.gov v2: the registry of clinical studies

ClinicalTrials.gov holds more than 480,000 study records: protocols, statuses, sponsors, and results. The v2 API is a clean modern REST interface, a real upgrade over the legacy one.

# runnable, read-only
curl "https://clinicaltrials.gov/api/v2/studies?query.term=diabetes&pageSize=1"

{"studies":[
  {"protocolSection":{
    "identificationModule":{
      "nctId":"NCT03470961",
      "organization":{"fullName":"Tianjin First Central Hospital"},
      "briefTitle":"Observational Study to Evaluate the Safety and Efficacy of Polyclonal Antibodies in Simultaneous Pancreas Kidney Transplant Recipients"}}}]}

Search diabetes and the first record is NCT03470961 from Tianjin First Central Hospital. The data is deeply nested under protocolSection, so the field you want is usually three or four keys down; keep the module names (identificationModule, statusModule, sponsorCollaboratorsModule) handy. Pagination is by pageToken, not a numeric page. Keyless. Docs at clinicaltrials.gov/data-api/api.

When to use it: trial monitoring, sponsor and condition research, medical dashboards.

7. CDC via Socrata: public-health datasets you can query with SoQL

data.cdc.gov runs on Socrata, which means thousands of public-health datasets answer SoQL queries ($where, $select, $limit) at a JSON endpoint. Anonymous access needs no key; an app token only lifts the throttle.

# runnable, read-only
curl "https://data.cdc.gov/resource/pwn4-m3yp.json?$limit=1"

[{"state":"AZ","tot_cases":"2434631.0","new_cases":"3716.0",
  "tot_deaths":"33042.0","new_deaths":"39.0",
  "date_updated":"2023-02-23T00:00:00.000"}]

Here is the honesty check, and it is the same trap as the deprecated REST Countries body from the intro. This dataset (pwn4-m3yp) returns a clean HTTP 200, but look at date_updated: 2023-02-23. It is an archived COVID-19 dataset, frozen in 2023. The Socrata platform is very much alive and keyless; this particular resource is history. So the lesson generalizes: on an open-data portal, a 200 tells you the query ran, not that the data is current. Read the date field before you trust the row. Swap the resource ID for any current dataset from the data.cdc.gov catalog. Keyless requests share a throttled pool; a free Socrata app token removes the throttle.

When to use it: any CDC or municipal open dataset; SoQL makes server-side filtering trivial.

Group C: science, the earth, and the wider world

Three keyless endpoints that reach past US borders: species, seismic activity, and global development indicators.

8. GBIF: the world’s species, matched and keyed

GBIF (the Global Biodiversity Information Facility) is an intergovernmental initiative sitting on more than two billion occurrence records. The species/match endpoint resolves a name to a stable taxonomic key.

# runnable, read-only
curl "https://api.gbif.org/v1/species/match?name=Puma%20concolor"

{"usageKey":2435099,"scientificName":"Puma concolor (Linnaeus, 1771)",
 "canonicalName":"Puma concolor","rank":"SPECIES","status":"ACCEPTED",
 "confidence":99,"matchType":"EXACT","kingdom":"Animalia",
 "family":"Felidae","genus":"Puma"}

Match the mountain lion and you get usageKey 2435099 with matchType":"EXACT" and confidence":99. Watch matchType: it also returns FUZZY and HIGHERRANK, so a low confidence or a fuzzy match means “I guessed,” and you should not treat it as ground truth. Use the usageKey to pull occurrences from the sibling endpoints. Keyless and generous; for bulk exports use the download API instead of hammering this one. Docs at techdocs.gbif.org.

When to use it: species normalization, biodiversity features, ecology and conservation data.

9. USGS Earthquakes: the real-time seismic catalog

The USGS earthquake feed is a FDSN-standard endpoint returning the seismic catalog as GeoJSON, real-time and historical. It is one of the cleanest public geospatial APIs going.

# runnable, read-only
curl "https://earthquake.usgs.gov/fdsnws/event/1/query?format=geojson&limit=1&orderby=time"

{"metadata":{"api":"2.7.0","status":200},
 "features":[
  {"type":"Feature",
   "properties":{"mag":0.8,"place":"85 km NNW of Karluk, Alaska",
     "status":"automatic","tsunami":0},
   "geometry":{"type":"Point"}}]}

When I ran it, the newest event was a magnitude 0.8 near Karluk, Alaska. It is a live feed, so you will get whatever just happened, not my quake. The gotcha here is format=geojson: drop it and the default response is a different format entirely, so you must set it explicitly or your JSON parser chokes on something that is not JSON. Same lesson as PubMed’s retmode. Filter by starttime, minmagnitude, and a bounding box for anything real. Keyless. Docs at earthquake.usgs.gov/fdsnws/event/1.

When to use it: seismic monitoring, geospatial risk features, disaster tooling.

10. World Bank: global development indicators, keyless

The World Bank Indicators API carries more than 16,000 series (GDP, population, poverty) for every country and year. It is the international counterweight to all the US-centric endpoints above.

# runnable, read-only
curl "https://api.worldbank.org/v2/country/us?format=json"

[{"page":1,"pages":1,"per_page":"50","total":1},
 [{"id":"USA","name":"United States",
   "region":{"value":"North America"},
   "incomeLevel":{"value":"High income"},
   "capitalCity":"Washington D.C.",
   "longitude":"-77.032","latitude":"38.8895"}]]

Read that response shape carefully, because it is the sneakiest parse trap on the list. The top-level value is an array of two things: element [0] is pagination metadata, and element [1] is your actual data. Index [0] expecting a country and you get page counts instead, a clean 200 that hands you the wrong object. Always reach into [1]. You must also pass format=json or the default is XML. Keyless. Docs at datahelpdesk.worldbank.org.

When to use it: cross-country economics, development indicators, anything global and comparative.

Why some “free” government APIs did not make the cut

The list stays honest by showing what it rejected. Every code below is from a live curl on July 6, 2026.

• REST Countries v3.1 (restcountries.com/v3.1/alpha/us, followed through its redirect) returned HTTP 200 with {"success":false,"data":null,"errors":[{"message":"This API version has been deprecated..."}]}. Not a government API, and now a broken one. It is the cleanest example on this page of a 200 that means no, so it earns its spot as a warning rather than an entry.
• US Census (api.census.gov/data/...) returned HTTP 302, redirecting to a missing_key.html page instead of the JSON I asked for. The keyless shape of that query no longer works; it wants a key now. Excluded.
• ReliefWeb returned HTTP 410 on v1 (decommissioned) and HTTP 403 on v2 with “not using an approved appname.” It is soft-gated behind an appname request, so it is not truly keyless. Excluded.
• data.gov CKAN (catalog.data.gov/api/3/action/package_search) returned HTTP 404 Not Found. The central catalog action API was not answering; go to the underlying agency’s Socrata or API directly, as with CDC above.
• NASA, FEC, Congress.gov, GovInfo all require a free DEMO_KEY or registration. Excellent APIs, but they fail the “no key, no signup” bar of this roundup by definition.
• Honorable mentions that are keyless and work: NWS (api.weather.gov) and USGS Water Services both returned clean keyless 200s. I left weather off because I covered it in a previous roundup, and kept USGS to one entry so a single provider does not dominate.

Keeping these right under real traffic

Finding the endpoint is the easy 10 percent. Here is the other 90, distilled from the failures above and from years of watching enrichment data lie quietly in production.

Parse the payload, not the status code. This is the whole post. REST Countries returned 200 with a deprecation notice. The CDC dataset returned 200 with data frozen in 2023. Census returned a 302 to a key page. A status check would have waved all three through. This is the single pattern I carry over from 2,190 production runs, honestly and narrowly: across those runs, enrichment sources fail as a confident 200 with a wrong body far more often than as an honest error. Assert on a field you expect (success, a recent date, a non-empty result), never on 200 alone.

The User-Agent is the real gate, not a key. Almost none of these want a key. What they quietly reward is a descriptive User-Agent and polite pacing. USAspending, GBIF, Treasury, and the World Bank all answered a bare curl, but government services increasingly ask you to identify yourself, and a well-behaved agent is what keeps you unblocked. No key does not mean no etiquette.

Respect the real limits, because some are enforced. openFDA gives you 240 requests per minute and 1,000 per day per IP with no key. PubMed enforces 3 per second. CDC’s Socrata pool is throttled without an app token. These are not decorative. Cache aggressively, and get the free key or token before you batch anything.

Learn the three parse traps by heart. World Bank wraps your data as element [1] behind a metadata [0]. Treasury’s page[size] needs curl’s -g flag. USGS and PubMed hand you XML unless you set format=geojson and retmode=json. Every one of these produces a clean 200 and a broken parse.

The licensing is a genuine gift. Data produced by the US federal government is public domain under 17 U.S.C. Section 105, so USAspending, Treasury, FDA, USGS, and Federal Register data can go straight into a commercial product. World Bank and GBIF use permissive licenses; check the specific dataset. This is rarer than it sounds in the API world.

For context, not a claim of scale: I build web-scraping and data-enrichment tool layers, currently 2,190 runs across 32 actors in production, and the output is always a table of rows that need trustworthy enrichment columns. Location was the geocoding column. Company identity was the registry column. Authoritative facts (spending, drug safety, debt) are this one. Same keyless, no-card layer, different question, and the same failure mode every single time: a 200 that is empty, stale, or deprecated, never an honest 500.

FAQ

Are government APIs really free with no API key? Yes. Most US federal APIs (USAspending, Federal Register, openFDA, Treasury FiscalData) and intergovernmental ones (World Bank, GBIF) return JSON with no key and no signup. A few (NASA, FEC, Congress.gov) require a free key, and those are excluded from this list by design.

What is the catch with keyless government APIs? Polite-use throttling and a User-Agent gate rather than a key, plus real per-IP limits on a few (openFDA 1,000/day, PubMed 3/second). And the big one: HTTP 200 does not guarantee usable data. No key does not mean no etiquette, and it does not mean unlimited.

Can I use US government data in a commercial product? Data produced by the US federal government is public domain under 17 U.S.C. Section 105, so it can go into a commercial product. World Bank and GBIF use permissive licenses; always check the specific dataset’s terms before you ship.

Why did an API return HTTP 200 but no usable data? Because 200 means the request was handled, not that the answer is right. REST Countries v3.1 returns a 200 whose body says “deprecated.” A CDC Socrata dataset can return a 200 full of data frozen in 2023. Always assert on a field you expect, not on the status code alone.

Which free government API should I start with? For US federal spending, USAspending. For the national debt and Treasury data, FiscalData. For drug and device safety, openFDA. For anything global and comparative, the World Bank. All four are keyless with no signup.

---

Written by Aleksei Spinov. I build web-scraping and data-enrichment tool layers, currently 2,190 runs across 32 actors in production. Every API above was re-verified with a live curl (HTTP 200, real response) on July 6, 2026 before publishing; responses are trimmed, not paraphrased. Two endpoints are live feeds (Federal Register and USGS Earthquakes), so results[0] moves; run the curl yourself for the current value. Drafted with an AI assistant, then fact-checked and edited by me against the raw responses.

Follow for the next batch of keyless APIs I test for the enrichment layer. And tell me: which government or open-data API has quietly handed you a clean 200 with a wrong body, and what field finally gave the bug away? I read every comment.

---

More production scraping tips: t.me/scraping_ai