Base URL: https://api.wxalerts.org
Plain HTTPS and JSON. Most routes are public: no key needed, because this site
is built static and calls the same endpoints from the browser. The rest are
served only under /v1 with an API key. Browsers block
calls from other websites (CORS allows only wxalerts.org), so call the API from
a server, script or app. Each area has
its own page; the index lists every route and which kind it
is. None of it is exempt from the Terms of Service; the clauses that
decide what you may build are collected at the bottom.
For alerts and lightning as they happen, MQTT pushes them instead of you polling for them.
Public and keyed
| public routes | key-only routes | |
|---|---|---|
| path | /alerts/at |
/v1/alerts/active |
| also at | /v1/alerts/at, with a key |
nowhere else: the bare path answers 401 |
| who is counted | your address | your key |
| caching | shared caches may cache | Cache-Control: private |
A key is sent as X-API-Key: wx_live_... or Authorization: Bearer wx_live_..., never in the URL. A key on a public route moves that request off
your address’s budget and onto the key’s. API keys covers
making one, scopes and the per-key limits.
Every route
Read routes only. Account, sign-in and admin routes belong to this site and the app and are not part of the API.
| route | access | page |
|---|---|---|
/alerts/at, /alerts/in-bounds, /alerts/ended-in-bounds, /alerts/highest-severity, /alerts/focus, /alerts/{identifier}, /alerts/page/{short_id}, /alerts/page/{short_id}/rundown |
public | Alerts |
/alerts/active, /alerts/active/geojson |
key only | Alerts |
/stats/summary, /stats/latency |
public | Statistics |
/stats/lightning/daily |
key only | Statistics |
/outlooks, /outlooks/{product}/geojson |
public | SPC outlooks |
/weather |
public | Weather |
/forecast |
public | Forecast |
/forecast/sounding |
key only | Point soundings |
/forecast/raw |
key only, by arrangement | Raw model data |
/conditions, /stations, /stations/{station_id}, /stations/{station_id}/history |
public | Observations |
/sky/outlook |
public | Sunrise and sunset outlook |
/visibility, /visibility/point |
key only | Low visibility |
/storms/active/geojson, /storms/{storm_id}/track, /storms/{storm_id}/forecast-track, /storms/{storm_id}/cone |
public | Storm cells |
/storms/active, /storms/{storm_id}, /storms/couplets/{couplet_id}/cone |
key only | Storm cells |
/lightning/flashes |
public | Lightning |
/lsr/reports |
public | Local storm reports |
/tropical/storms, /tropical/storms/{storm_id}, /tropical/storms/{storm_id}/models, /tropical/outlook, /tropical/for-place |
key only | Tropical cyclones |
/winter/at, /winter/hazards, /winter/odds, /winter/wssi |
key only | Winter weather |
Key-only routes are written with /v1 in front on their pages; public routes
without it. The live schema, with every parameter, is at
api.wxalerts.org/docs.
Rate limits
Unauthenticated clients get 60 requests per minute. Past that a client is presumptively unreasonable and may be throttled or blocked, per Terms §3.
Enforcement is per source address at 120 requests a minute (burst 60),
across every public route together, because one address behind carrier-grade
NAT or an office is many clients. Past it you get 429 with a Retry-After
and RateLimit-* headers. The gap is not headroom: 60 is still the limit your
client is held to. Send an API key and the request is
charged to the key instead of your address.
A few routes that return a lot keep a tighter limit of their own, on top of this one, whether or not a key is sent. Their pages say so.
Sixty is more than this data justifies anyway. Alerts change on the order of
minutes and the stats summary on the order of seconds, so cache what you can,
send If-None-Match and take the 304, and poll on the interval your display
actually refreshes at. If you have a case for more, say hello in
Discord before you start rather than after you are blocked.
Keyed API access and authenticated MQTT are governed by the API Terms in Terms §20 and §21 and the limits set at issuance.
Errors
Errors carry a JSON body. The key and rate limit errors put a machine-readable
code in detail:
{ "detail": { "code": "api_key_required", "message": "This endpoint needs an API key: it is served at /v1/alerts/active. ..." } }| status | means |
|---|---|
400 |
a bad request the route explains, such as key_in_query |
401 |
api_key_required (a key-only route without a key) or api_key_invalid |
403 |
insufficient_scope: the key lacks the route’s scope |
404 |
nothing by that id, or a point outside the product’s coverage |
422 |
a parameter is missing or out of range; detail lists which |
429 |
rate_limited: wait Retry-After seconds |
503 |
the data behind the route is not available yet; try again later |
Terms
The full text is at /terms. Three clauses decide whether what you are building is allowed:
- Personal, educational and research use. The license covers those (§4.1). Reselling the feed, redistributing it for gain, or building a commercial service on top of it needs written permission first (§3). The endpoints being open is not that permission; ask first.
- Attribute, and do not imply endorsement. NWS and NOAA data stays theirs:
do not claim it as your own, do not present it as official government output,
and do not imply NOAA or the NWS endorses what you built
(§4.3, §3). The derived
products (processed GLM, ML nowcasts, anything under
focus) are ours, and are not official NWS products either. Credit both: NWS/NOAA for the alert, WxAlerts for the processing. - No EAS or WEA tones. You may not reproduce, transmit or simulate the WEA attention signal, the EAS Attention Signal or EAS header codes, or anything substantially similar, from API output, including as a notification sound (§3.1). This one is FCC rule, not house style.