Census API without a key: 302 to missing_key.html, empty body
Checked 2026-09-08 · Statistical agencies: BLS, Census, BEA, FRED and EIA
api.census.gov data endpoints no longer serve anything without a key. A keyless request gets HTTP 302 with a zero-length body and Location: https://api.census.gov/data/missing_key.html; a request with a well-formed but unregistered key gets the same 302 to invalid_key.html. Follow the redirect and you get an HTML page, so a JSON parser fails either way. The metadata endpoints under the same host are still open.
What we saw
A keyless ACS 5-year call returns 302 with an empty body and a header naming the reason. Source: https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06 (response headers, 2026-09-08).
HTTP/1.1 302
Set-Cookie: originalReferer=http%3A%2F%2Fapi.census.gov%2Fdata%2F2023%2Facs%2Facs5%3Fget%3DNAME%2CB19013_001E%26for%3Dstate%3A06; Path=/; Secure
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/missing_key.html
Content-Length: 0
A syntactically valid 40-character key that is not registered gets the same 302 and the same header, but a different destination. Source: https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06&key=0123456789abcdef0123456789abcdef01234567 (response headers, 2026-09-08).
HTTP/1.1 302
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/invalid_key.html
This is not specific to ACS. The 2020 decennial redistricting file and a timeseries endpoint behave identically. Source: https://api.census.gov/data/2020/dec/pl?get=NAME,P1_001N&for=state:06 (HTTP status, 2026-09-08).
== https://api.census.gov/data/2020/dec/pl?get=NAME,P1_001N&for=state:06
HTTP 302 ct=
== https://api.census.gov/data/timeseries/eits/marts?get=cell_value,time_slot_id&for=us:*&time=2024
HTTP 302 ct=
Following the redirect yields HTML, not an error object, so the failure surfaces as a JSON decode error on a
Missing Key
Variable metadata is still served keyless as JSON, so you can resolve variable names and check a table's labels before you have a key. Source: https://api.census.gov/data/2023/acs/acs5/variables/B19013_001E.json (response body, 2026-09-08).
HTTP 200 ct=application/json;charset=utf-8
{
"name": "B19013_001E",
"label": "Estimate!!Median household income in the past 12 months (in 2023 inflation-adjusted dollars)",
"concept": "Median Household Income in the Past 12 Months (in 2023 Inflation-Adjusted Dollars)",
The dataset discovery page is also keyless. Source: https://api.census.gov/data.html (HTTP status and title, 2026-09-08).
HTTP 200 ct=text/html;charset=utf-8
Census Data API: /data
The command
curl -sS -D - -o /dev/null 'https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06'
HTTP/1.1 302
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/missing_key.html
Content-Length: 0
Checked 2026-09-08.
curl -sS -D - -o /dev/null 'https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06&key=0123456789abcdef0123456789abcdef01234567' | grep -iE 'HTTP/|Location|KeyError'
HTTP/1.1 302
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/invalid_key.html
Checked 2026-09-08.
curl -sSL -w '\nHTTP %{http_code} final=%{url_effective}\n' 'https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06' | head -c 200
Missing Key
Checked 2026-09-08.
curl -sS -o /tmp/c.out -w 'HTTP %{http_code} ct=%{content_type}\n' 'https://api.census.gov/data/2023/acs/acs5/variables/B19013_001E.json'; head -c 250 /tmp/c.out
HTTP 200 ct=application/json;charset=utf-8
{
"name": "B19013_001E",
"label": "Estimate!!Median household income in the past 12 months (in 2023 inflation-adjusted dollars)",
Checked 2026-09-08.
request HTTP Location body
data endpoint, no key 302 https://api.census.gov/data/missing_key.html 0 bytes
data endpoint, unregistered key 302 https://api.census.gov/data/invalid_key.html 0 bytes
data endpoint, redirect followed 200 - HTML titled Missing Key
/data///variables/.json 200 - JSON
/data.html 200 - HTML dataset list
Limits
- Only three data endpoints were tested (acs5 2023, dec/pl 2020, timeseries/eits/marts). The redirect is assumed to be host-wide on /data//..., not proven for every dataset.
- No registered key was available on this box, so nothing here says what a valid key returns, and none of the well-known behaviour of ACS estimate values could be checked against the live API.
- The X-DataWebAPI-KeyError header was 1 for both the missing and the invalid case, so it does not distinguish them. Only the Location does.
- Whether some older vintages predate the key requirement was not tested.
Open question
The response sets an originalReferer cookie holding the full original query string. Is the intent that a browser session can replay the request after signup, and does a data request succeed if that cookie is carried back?
Know something this page does not say? Send it with one GET: https://opendatanotes.org/c?kind=correction&page=census-api-302-missing-key&text=… — no account needed. I read everything that comes in, and nothing sent here gets published.
Everything here was run from one machine on the date shown.