Nekosia API

aid: nekosia
name: Nekosia API
description: Nekosia is a free, keyless anime-image REST API serving cute anime "neko" (catgirl) imagery and related metadata,
  backed by the provider's own Booru. Three documented GET operations return JSON carrying dominant colours, original and
  compressed image variants, dimensions, tags, content ratings, anime and character names, the original source and full artist
  attribution. No API key, no registration and no account are required; rate limits are enforced per IP address and reported
  through standards-track RateLimit response headers. Standard public use is free, but commercial use requires prior written
  consent from the operator.
image: https://nekosia.cat/images/og-preview.gif
url: https://raw.githubusercontent.com/api-evangelist/nekosia/refs/heads/main/apis.yml
created: '2026-08-19'
modified: '2026-08-19'
specificationVersion: '0.21'
tags:
- Anime
- neko
- nekos
- neko api
- booru
- Image
- Media
- Entertainment
- Free API
- Open Access
tags_raw:
- anime
- neko
- api
- nekos
- neko api
- booru
- image
- media
- entertainment
- images
- free api
- open access
apis:
- name: Nekosia REST API
  description: Free keyless RESTful JSON API serving random anime/neko images across many categories with rich metadata, a
    tags endpoint, session mechanism, and content ratings.
  humanURL: https://nekosia.cat/documentation?page=introduction
  baseURL: https://api.nekosia.cat/api/v1
  tags:
  - Anime
  - neko
  - nekos
  - neko api
  - booru
  - Image
  - Media
  - Entertainment
  tags_raw:
  - anime
  - neko
  - api
  - nekos
  - neko api
  - booru
  - image
  - media
  - entertainment
  properties:
  - type: Documentation
    url: https://nekosia.cat/documentation?page=introduction
maintainers:
- FN: Nekosia API
  email: support@nekosia.cat
  url: https://nekosia.cat/
generated:
  by: apis.io/add
  model: claude-opus-4-8
  confidence: 90
  at: '2026-08-19T02:43:46.970Z'
common:
- type: VulnerabilityDisclosure
  url: security/nekosia-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/nekosia-domain-security.yml
- type: Security
  url: security/nekosia-vulnerability-disclosure.yml
- type: Website
  url: https://nekosia.cat/
- type: DeveloperPortal
  url: https://nekosia.cat/documentation
- type: Documentation
  url: https://nekosia.cat/documentation?page=introduction
- type: APIReference
  url: https://nekosia.cat/documentation?page=endpoints
- type: GettingStarted
  url: https://nekosia.cat/documentation?page=getting-started
- type: Support
  url: https://discord.gg/pba76vJhcP
- type: GitHubOrganization
  url: https://github.com/Nekosia-API
- type: Login
  url: https://nekosia.cat/login
- type: TermsOfService
  url: https://nekosia.cat/documentation?page=tos
- type: PrivacyPolicy
  url: https://nekosia.cat/documentation?page=privacy-policy
- type: StatusPage
  url: https://status.nekosia.cat
- type: ChangeLog
  url: https://nekosia.cat/documentation?page=changelog
- type: ChangeLog
  url: changelog/nekosia-changelog.yml
- type: Lifecycle
  url: lifecycle/nekosia-lifecycle.yml
- type: Authentication
  url: authentication/nekosia-authentication.yml
- type: Conventions
  url: conventions/nekosia-conventions.yml
- type: Conformance
  url: conformance/nekosia-conformance.yml
- type: ErrorCatalog
  url: errors/nekosia-problem-types.yml
- type: DataModel
  url: data-model/nekosia-data-model.yml
- type: Examples
  url: examples/_index.yml
- type: Packages
  url: packages/nekosia-packages.yml
- type: SDKs
  url: packages/nekosia-packages.yml
- type: RateLimits
  url: rate-limits/nekosia-rate-limits.yml
- type: Plans
  url: plans/nekosia-plans-pricing.yml
- type: WellKnown
  url: well-known/nekosia-well-known.yml
- type: SecurityTxt
  url: well-known/nekosia-security.txt
- type: LLMsTxt
  url: llms/nekosia-llms.txt
- type: GitHubRepository
  url: https://github.com/Nekosia-API/documentation
- type: X-Documentation-Source
  url: https://raw.githubusercontent.com/Nekosia-API/documentation/main/endpoints.md
x-enrichment:
  date: '2026-08-19'
  status: enriched
  artifacts_added: 24
  pass: local-v1
x-no-contract:
  openapi: false
  asyncapi: false
  graphql: false
  mcp: false
  agent_card: false
  detail: 'STEP 0b contract discovery ran in full against api.nekosia.cat, nekosia.cat and cdn.nekosia.cat and found no machine-readable
    contract of any kind. Probed and recorded: /openapi.json, /openapi.yaml, /swagger.json, /api-docs, /docs, /redoc, /rapidoc,
    /spec, /api/v1/openapi.json (404 on the API host; the edge returned 403 for /openapi.yaml on nekosia.cat), /graphql (404),
    /mcp and /api/v1/mcp (404), /llms.txt (404), and /.well-known/agent-card.json plus the legacy /.well-known/agent.json
    on all three hosts (404). The API is real, live and well documented — the description of it is human-readable prose only.
    See conformance/nekosia-conformance.yml.'
  checked: '2026-08-19'
x-evidence:
  round: '2026-08-19'
  admitted_from: Add-API gate auto-publish 2026-08-19 02:46 UTC, confidence 90.
  renamed: nekosia-api -> nekosia, domain-derived slug (nekosia.cat). Renamed BEFORE enrichment so artifacts were written
    with the correct names. Never published under the old slug.
  the_split_surface:
    finding: The API host is wide open. The website host blocks machines outright.
    api.nekosia.cat: 'root 200, invented path 404 — discriminates. Keyless: a live unauthenticated GET /api/v1/images/catgirl
      returned 200 with a full payload on 2026-08-19.'
    nekosia.cat: 'CORRECTED 2026-08-19, same day. First recorded as "403 on EVERY path ... a WAF block, not a JS challenge".
      That was wrong. The block is USER-AGENT BASED: a default curl/SDK/agent UA gets 403 with a 4,572b Cloudflare "Attention
      Required" page, but the SAME URL with an ordinary Chrome UA returns 200 — the documentation page is 24,154b of real
      HTML. Not a WAF challenge, not unreachable: a UA filter that any browser passes and most non-browser clients fail.'
    consequence: The eight nekosia.cat/documentation?page=... pointers are kept and ARE reachable — but only to a client that
      sends a browser user-agent. An agent, SDK or crawler using its own UA gets 403. That is an agent-readiness problem rather
      than a dead-pointer problem, and it is cheap for the provider to fix.
    verified_reachable: status.nekosia.cat 200, discord.gg invite 200, github.com/Nekosia-API 200.
  documentation_is_readable_after_all: The docs are NOT machine-unreachable, they are just not readable at nekosia.cat. The
    source of truth is a public GitHub repo — Nekosia-API/documentation, pushed 2026-08-03 — and raw.githubusercontent.com/Nekosia-API/documentation/main/endpoints.md
    returns 200 text/plain 9,421b. Wired as X-Documentation-Source so the machine-readable path is recorded alongside the
    blocked canonical one.
  no_openapi: No OpenAPI, on either host or in the GitHub org. The pipeline deliberately did NOT derive one — there is no
    openapi/ directory in this repo. The data-model artifact reconstructs the response shape from the provider's own published
    schema and states in its own derivation_note that every field was observed on the wire. That is ours, labelled as ours,
    and not recorded as a contract they publish.
  also_ships: An official JavaScript SDK, Nekosia-API/nekosia.js, pushed 2026-08-06.
  no_llms_txt: 'Established only after the UA correction: with a browser UA, /llms.txt returns an honest 404 (5,806b). The
    earlier 403 masked the absence. Nekosia publishes no llms.txt.'
  correction_note: Recorded rather than silently amended. The original claim went out in commit ecf25d2 and was wrong about
    the mechanism; a browser-UA retry while profiling sniffcat, which showed the same behaviour, is what surfaced it.