The GPU Where API

A keyed, read-only JSON interface over the GPU provider catalogue: providers, accelerator SKUs, host packages and the latest observed availability. The same data is published openly at /v1; the keyed API exists so traffic can be metered and abuse rate-limited.

Base URL

https://gpuwhere.io/api/v1

Until the custom domain is attached, use
https://<project>.pages.dev/api/v1.

Authentication

Send a key in either header:

Authorization: Bearer <key>
X-API-Key: <key>

Keys are issued by the operator during the beta. Never ship a key in client-side code.

Quick start

export GPUWHERE_KEY="paste-your-key"

curl -s https://gpuwhere.io/api/v1/index \
  -H "Authorization: Bearer $GPUWHERE_KEY"

# one GPU family, one provider, orderable packages only
curl -s "https://gpuwhere.io/api/v1/skus?gpu=H100&provider=e2e-networks&status=active" \
  -H "X-API-Key: $GPUWHERE_KEY"

Endpoints

Endpoint	Returns	Query parameters
GET `/api/v1/index`	Counts, artifact timestamp and the endpoint map.	—
GET `/api/v1/catalog`	Everything in one document: providers, GPUs, SKUs, channels, capacity, latest availability.	—
GET `/api/v1/providers`	Provider identity, regions, access path, storage and reliability.	—
GET `/api/v1/gpus`	Accelerator families and variants with VRAM, precision, dense/sparse FLOPS and MIG.	—
GET `/api/v1/skus`	Host packages with prices, status and the last observed availability.	`provider`, `region`, `gpu`, `shape`, `variant`, `status`, `pricing_status`
GET `/api/v1/availability/latest`	Latest free-GPU observation per provider, region, GPU and shape.	`provider`, `region`, `gpu`, `shape`, `variant`

Filters are exact and case-insensitive. An unknown filter value returns an empty list, not an error. HEAD works on every endpoint; OPTIONS answers CORS preflight.

Example response

{
  "api_version": 1,
  "schema_version": "1",
  "generated_at": "2026-11-09T09:00:00Z",
  "count": 2,
  "filters": { "gpu": "H100", "provider": "e2e-networks" },
  "skus": [
    {
      "id": "e2e-networks/IN-DEL/H100/8x/standard",
      "provider": "e2e-networks",
      "region": "IN-DEL",
      "gpu": "H100",
      "shape": "8x",
      "gpus_per_vm": 8,
      "pricing": { "on_demand": { "usd_per_gpu_hr": 2.49, "usd_per_vm_hr": 19.92 } },
      "status": "active",
      "pricing_status": "published"
    }
  ]
}

Rate limits

Surface	Budget	Keyed by
Keyed API	60 requests / minute	API key (invalid keys fall back to IP)
Pages and assets	300 requests / minute	Client IP
Analytics beacon	120 events / minute	Client IP

Limits are per Cloudflare location and deliberately approximate — they damp abuse, they are not a billing meter. Over budget returns 429 with Retry-After: 60.

Errors

Status	Code	Meaning
`401`	`unauthorized`	Missing or invalid key. Send `WWW-Authenticate: Bearer`.
`404`	`not_found`	Unknown endpoint under `/api/v1/`.
`405`	`method_not_allowed`	Only `GET`, `HEAD` and `OPTIONS`.
`429`	`rate_limited`	Over the per-key budget; wait `Retry-After` seconds.
`502`	`upstream_unavailable`	The published artifact is missing. Rebuild and redeploy.
`503`	`not_configured`	No API keys are set on the deployment yet.

Errors always carry {"error": {"code", "message"}} so clients can branch on the code.

Try it

The key stays in this tab and is sent only to this origin.

No request yet.

Machine-readable spec

/api/openapi.json is an OpenAPI 3.1 document covering every endpoint, the bearer scheme and the response envelope. The JSON Schemas the data validates against live under /v1/schema/.

Analytics and privacy

The site counts pageviews, in-app route changes, link clicks and searches with a first-party beacon. It sets no cookies, stores no IP addresses and does not build a cross-site profile. A random session id lives in sessionStorage for the life of the tab; the referrer is reduced to its hostname; the country comes from Cloudflare's edge. Do Not Track and Global Privacy Control are honoured. Events are retained for 90 days in Workers Analytics Engine.

Open data. The bulk catalogue at /v1/* is public and cacheable on purpose. Keys gate the query API so it can be rate-limited and attributed — they are not a confidentiality control.