JSON API
Everything the website shows is also served as JSON under /api/v1. All endpoints are GET, need no authentication, and are readable from a browser: replies carry Access-Control-Allow-Origin: *.
The data only changes when a new scan is loaded, so replies are cacheable for an hour. There is no rate limit. Please be reasonable.
Endpoints
| Endpoint | Returns |
|---|---|
| /api/v1 | Service metadata and the endpoint list |
| /api/v1/stats | Entry counts and the date the data was last updated |
| /api/v1/search?q= | Search over codes and message text, same as the site search |
| /api/v1/windows/code/{code} | A code decoded as HRESULT and NTSTATUS, with every module and header defining it. Takes hexadecimal, decimal, or signed decimal. |
| /api/v1/windows/error/{symbolic} | A symbolic name, its code, and the modules carrying it |
| /api/v1/windows/headers | Every Windows header |
| /api/v1/windows/header/{header} | One header with all of its symbolic entries |
| /api/v1/windows/modules | Every Windows module |
| /api/v1/windows/module/{module} | One module with all of its messages |
| /api/v1/windows/releases | The Windows releases the module scans were taken from |
| /api/v1/crt | The C runtimes on file |
| /api/v1/crt/{runtime} | One C runtime with all of its messages |
Codes
Wherever a code appear, on a code lookup, a symbolic entry, a module message, it comes as the three forms it gets written in, plus the format it most plausibly belongs to.
"code": 2147942405, "hex": "0x80070005", "signed": -2147024891, "kind": "win32InHresult"
| Field | Type | Values |
|---|---|---|
code | number | 0 to 4294967295. The value as an unsigned 32-bit integer. |
hex | string | The same value, zero-padded to eight digits. This is the form /windows/code/ canonicalizes to. |
signed | number | -2147483648 to 2147483647. The same value read as a signed integer, which is how shells and runtimes usually print it. |
kind | string | success, win32, ntstatus, ntstatusInHresult, win32InHresult, hresult. |
Decoding
Code and symbolic lookups carry an hresult and an ntstatus object. Both are always present, whatever kind says, since either reading is legal for any 32-bit value. The error formats page has the bit layouts these come from.
hresult
| Field | Type | Values |
|---|---|---|
severity | boolean | S. true on failure, false on success. |
reserved | boolean | R. false in a well-formed HRESULT, unless ntstatus is set, where it belongs to the wrapped severity. |
customer | boolean | C. true for customer-defined values, false for Microsoft ones. |
ntstatus | boolean | N. true when the value wraps an NTSTATUS. |
reservedX | boolean | X. false everywhere but the TRK exceptions. |
facility | object | Error source. See facility. |
code | number | 0 to 65535. The low 16 bits. |
ntstatus
| Field | Type | Values |
|---|---|---|
severity | number | 0 to 3. |
severityName | string | STATUS_SEVERITY_SUCCESS, STATUS_SEVERITY_INFORMATIONAL, STATUS_SEVERITY_WARNING, or STATUS_SEVERITY_ERROR. |
customer | boolean | C. true for customer-defined values. |
reserved | boolean | N. false in a well-formed NTSTATUS. |
facility | object | Error source. See facility. |
code | number | 0 to 65535. The low 16 bits. |
facility
Facility numbers are per format: the same id means different things under each, and the two lists are on the error formats page.
| Field | Type | Values |
|---|---|---|
id | number | 0 to 2047 under hresult (11 bits), 0 to 4095 under ntstatus (12 bits). |
name | string or null | Symbolic name, e.g. FACILITY_WIN32. null for an id MS-ERREF does not name. |
description | string or null | Short blurb, null alongside an unnamed facility. |
Entries
Fields carried by headers, modules, runtimes, and the entries under them. A listing gives the summary fields only; the page for a single header, module, or runtime adds its entries.
| Field | Type | Values |
|---|---|---|
key | string | Lowercase identifier, and the one to put in a URL. Header names and runtimes are reachable by key, modules by name. |
name | string | Display name of a header, module, runtime, or release. |
description | string or null | Blurb for a header, module, or symbolic entry. null when the source gives none, which is common for symbolic entries. |
message | string | Error text, verbatim. May span several lines and may hold %1-style insertion placeholders that Windows fills in at runtime, so it is not always a finished sentence. |
symbolic | string | Symbolic name, e.g. ERROR_ACCESS_DENIED. |
header | string | Name of the header defining a symbolic entry, with headerKey alongside it for the URL. |
module | string | File name of the module a message was found in. |
arch | string | Architecture a runtime was scanned on. |
build | string or null | Build a module scan was taken on, e.g. 10.0.26200.9168. |
releases | array of strings | Release keys an entry was found in, currently 7, 8.1, 10, 11. Only Windows module data carries these; /api/v1/windows/releases describes them. A code with the same value but different text between releases is two entries, not one. |
count | number | Length of the array in the same reply. On a listing entry, messages, modules, and symbolics are counts of what the entry's own page returns. |
Search results
/api/v1/search takes the same queries as the site: a code in any of the three forms, or text to look for in messages. It returns at most 50 results, and no more than one page of them — there is no cursor.
| Field | Type | Values |
|---|---|---|
query | string | The query, echoed back. |
type | string | windows-module, windows-symbol, or crt, naming which of the three the entry came from. |
id | string | How the entry spells its own identifier: a code for windows-module and crt results, a symbolic name for windows-symbol ones. |
source | string | The module, header, or runtime the entry belongs to. |
url | string | Path of the page for this entry on the site, to hand back to a reader. |
excerpt | string | The matched text with up to 40 characters of either side, an ellipsis marking where it was cut. Absent on code queries, which match the code alone. |
match | string | The matched substring itself, present whenever excerpt is. |
Errors
A failed request answers with the matching status code and a body holding one error object, in place of whatever the endpoint would have returned.
| Field | Type | Values |
|---|---|---|
error.status | number | 400 for a code that will not parse or a search with no q, 404 for an unknown symbolic name, header, module, runtime, or endpoint, 500 for a server-side fault. |
error.message | string | Short reason, meant to be read rather than matched on. |
A well-formed code is never a 404: the reply decodes it and returns empty modules and headers arrays, since the decoding holds whether or not anything on file uses the value.