Public API

Public data is available through read-only JSON endpoints. API access is granted individually by email; calls without authorisation are a violation. Authorised responses match the values the site renders.

Quick start

curl -H "Authorization: Bearer <your-key>" \
  "https://cybercredit.org/api/score/steam/76561198000000900?lang=en"

Example response (truncated)

{
  "game": { "slug": "steam", "name": "Steam Account", "modelVersion": "steam@1.0.0" },
  "score": 96,
  "band": { "key": "excellent", "label": "No issues found" },
  "coverage": 1,
  "source": "live",
  "dimensions": [
    { "key": "bans", "label": "Ban record", "weight": 40, "score": 100,
      "reasons": ["No bans found"] }
  ]
}

Endpoints

GET/api/games

Game catalogue, scoring dimensions and weights.

GET/api/score/{game}/{id}

One account’s score, band, coverage and per-dimension reasons.

GET/api/health

Liveness probe. Returns service status only, no configuration.

GET/openapi.json

OpenAPI 3.1 description for Postman or client generation.

Query parameters

lang

Response language: zh (default) or en.

refresh

Set to 1 to force a refresh; counts towards the rate limit and is limited to once per account every 30 minutes.

history

Set to 1 to return the permanent score history (up to 20 snapshots, newest first).

Score response fields

score

Integer 0–100; null when less than half the weight has data.

band

{ key, label } for the score band.

rawScore

Weighted score before any cap was applied.

cappedBy

Why the score was capped (for example a VAC ban); null when no cap applied.

coverage

0–1, the share of weight with available data.

account.steamrep

SteamRep 2024 archive flag; a banned flag caps the score at 30.

dimensions[]

key, label, weight, score and reasons per dimension; score is null when data is missing.

source

live or demo. Demo data must always be labelled as such.

warnings[]

Degradation codes, for example steam_key_missing.

cached

Whether this response came from cache.

fetchedAt

When the data was fetched (ISO 8601).

history[]

Present only when ?history=1; permanent score snapshots, newest first.

lang

Language of this response.

Errors

400 INVALID_ID

The account ID format is invalid.

404 GAME_NOT_FOUND

No such game.

404 NOT_FOUND

Account does not exist or has no public data.

409 MODEL_NOT_READY

The scoring model for this game is not live yet.

429 RATE_LIMITED

Too many new lookups; see the Retry-After header.

429 REFRESH_COOLDOWN

This account was refreshed within the last 30 minutes; see the Retry-After header.

502 UPSTREAM

The upstream data source is temporarily unavailable.

Limits and terms of use

Rate limit: 10 new lookups per IP per minute; cached reads do not count.
Auth: all data endpoints (games / score / health) require `Authorization: Bearer <key>` or `X-API-Key`; unauthenticated calls return 401. Keys are issued only by email to cybercreditc@outlook.com, case by case. Any call, automated scraping or bulk request without written authorisation is a violation.
Human verification: the website search form requires Turnstile; the API uses a key instead and does not require Turnstile.
CORS: responses carry Access-Control-Allow-Origin: *, so browsers can call directly.
Demo data: when source is demo it must be labelled as demo and never presented as a real conclusion.
Attribution: when reusing the data publicly, credit CyberCredit and keep the original link.

OpenAPI description

Machine-readable definition for Postman or client generators. It is a file, not a page — download it instead of reading it in the browser.

Download OpenAPI description/openapi.json