Request signals

GET /posts/the-shape-of-an-api · 2026-09-28T09:46:35.641Z

request.cf (Cloudflare signals)

asn

16509

asOrganization

Anthropic, PBC

botManagement

{
  "score": 1,
  "corporateProxy": false,
  "verifiedBot": true,
  "staticResource": false,
  "ja3Hash": "875e573c856162e708736df7ec74ddbb",
  "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
  "ja4Signals": {
    "h2h3_ratio_1h": 0.9979061,
    "cache_ratio_1h": 0.031880062,
    "reqs_quantile_1h": 0.9999125,
    "heuristic_ratio_1h": 0.3217121,
    "paths_rank_1h": 21,
    "reqs_rank_1h": 21,
    "browser_ratio_1h": 0.0033652058,
    "ips_rank_1h": 173,
    "ips_quantile_1h": 0.9992794,
    "uas_rank_1h": 22
  },
  "jsDetection": {
    "passed": false
  },
  "detectionIds": [
    50331656,
    33563859,
    118965407
  ]
}

city

Columbus

clientAcceptEncoding

gzip, deflate, br

clientQuicRtt

clientTcpRtt

clientTrustScore

colo

CMH

continent

country

edgeL4

{
  "deliveryRate": 1757281
}

edgeRequestKeepAliveStatus

httpProtocol

HTTP/2

isEUCountry

false

latitude

39.96118

longitude

-82.99879

metroCode

535

postalCode

43215

region

Ohio

regionCode

requestHeaderNames

{}

requestPriority

weight=16;exclusive=0;group=0;group-weight=0

timezone

America/New_York

tlsCipher

AEAD-AES256-GCM-SHA384

tlsClientAuth

{
  "certPresented": "0",
  "certVerified": "NONE",
  "certRevoked": "0",
  "certIssuerDN": "",
  "certSubjectDN": "",
  "certIssuerDNRFC2253": "",
  "certSubjectDNRFC2253": "",
  "certIssuerDNLegacy": "",
  "certSubjectDNLegacy": "",
  "certSerial": "",
  "certIssuerSerial": "",
  "certSKI": "",
  "certIssuerSKI": "",
  "certFingerprintSHA1": "",
  "certFingerprintSHA256": "",
  "certNotBefore": "",
  "certNotAfter": "",
  "certRFC9440": "",
  "certRFC9440TooLarge": false,
  "certChainRFC9440": "",
  "certChainRFC9440TooLarge": false
}

tlsClientCiphersSha1

WUS9+h7TjVkF9aEouGuCEMjGQGA=

tlsClientExtensionsSha1

HSFj7frrapbOk5E/35disC2hHb8=

tlsClientExtensionsSha1Le

UbsEllayFEo6nbs90QEtF3Ui8cI=

tlsClientHelloLength

258

tlsClientRandom

cWM8RZQBYTdw272VNfVRTpDS9HqAw1piMBfTONOHVes=

tlsExportedAuthenticator

{
  "clientHandshake": "f26947fe97817f220bf138b6ee7b60b6259d3caf822faacef216cb091069710abef42bfe21d4dec857206f3eb480e68f",
  "serverHandshake": "6aecc07f61f0d4e4241be72fb096e207427b77e1942fb20e36020b334ef6af82af12124db9313f17778d653ee0a65491",
  "clientFinished": "e7ad83455656aa5b4f00cece7ab9790e1311701002e57b303b2bf09bbaa747da15560640c3d71763f8b0cf541f392cd2",
  "serverFinished": "6165464fc00a84ee5ca51fbd59d4361b94cf6315c6eebc5f5acf051ecd7fb26d055f948f4659060435b2644ec519a057"
}

tlsVersion

TLSv1.3

verifiedBotCategory

AI Crawler

Cookies sent by browser

(none)

Request headers

*/*

accept-encoding

gzip, br

cf-connecting-ip

216.73.216.168

cf-ipcity

Columbus

cf-ipcontinent

cf-ipcountry

cf-iplatitude

39.96118

cf-iplongitude

-82.99879

cf-metro-code

535

cf-postal-code

43215

cf-ray

a421d2649ff13014

cf-region

Ohio

cf-region-code

cf-timezone

America/New_York

cf-visitor

{"scheme":"https"}

connection

Keep-Alive

host

in-nexarq.cftenant.com

true-client-ip

216.73.216.168

user-agent

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

x-forwarded-proto

https

x-real-ip

216.73.216.168

Papers a quiet little blog

← All posts

The Shape of an API

R. Vasquez · Feb 27, 2026

An API is a contract, but it is also a conversation. The first version is always too talkative.

Watch what people actually do with your API for a few weeks. The endpoints they ignore are not the ones to delete; they are the ones to study. Maybe the name was wrong. Maybe the shape was.

Subtract before you add. Every method removed is a method that does not have to be supported until the heat death of the universe.