The Partner API
Read-only, key-authenticated access to data that is already public on ChabadUp: listings, profiles, skills, aggregate stats. It exists so a partner site can show the marketplace to its own audience without scraping or manual copying.
This page is the technical reference. For what a partnership is and how to start one, see partnerships.
Ground rules
The API is deliberately powerless. Before you decide whether to build against it, know what a key does and does not get you:
Read-only, GET only.
A key grants access to the public API path and nothing else: no sessions, no dashboards, no admin, no writes.
No PII, ever.
No email addresses, no phone numbers, no internal ids. If it is not already public on the site, it is not in the API.
Scoped.
A key is granted only the datasets it needs. A key for showing job listings cannot read the freelancer directory.
Accountable.
Every key has its own rate limit, can expire, can be revoked, and every call is logged.
Authentication
The base URL is https://www.chabadup.com/api/public/v1. Every authenticated request carries the key as a bearer token:
Authorization: Bearer cup_live_...How keys work
- Keys are issued by hand. There is no self-serve signup, and that is deliberate: we want to know who is consuming community data and why. Request one here and mention which datasets you need.
- The raw key is shown exactly once, at creation. Store it somewhere safe. We keep only a SHA-256 hash and cannot show it again.
- Keys can carry an expiry date and can be revoked at any time. If yours stops working, ask us before assuming a bug.
Try it now
The discovery root GET /api/public/v1 is unauthenticated and returns endpoint metadata only. You can curl it right now, before you have a key, to check connectivity and see the endpoint list.
# No key needed - the discovery root is open
curl https://www.chabadup.com/api/public/v1
# With a key - first page of public services
curl -H "Authorization: Bearer cup_live_YOUR_KEY" \
"https://www.chabadup.com/api/public/v1/services?page=1&limit=20"Endpoints and scopes
All paths are relative to the base URL. The scope column is what a key must be granted to call the endpoint; reference covers both /skills and /categories.
| Endpoint | Scope | Returns |
|---|---|---|
| /freelancers | freelancers | Public freelancer profiles |
| /services | services | Active service listings |
| /jobs | jobs | Open job postings |
| /projects | projects | Open project postings |
| /organizations | organizations | Organization profiles |
| /skills | reference | The platform skill list |
| /categories | reference | Service categories |
| /stats | stats | Aggregate platform counts |
The first five endpoints are lists and paginate with ?page= (1 or higher) and ?limit= (1–100, default 20). /skills, /categories and /stats return a single complete object, so they take no pagination parameters and do not use the envelope below.
Responses
Successful list responses use one envelope:
{
"data": [ ... ],
"pagination": {
"page": 1,
"limit": 20,
"totalCount": ...,
"totalPages": ...,
"hasNextPage": true,
"hasPrevPage": false
}
}Errors use another:
{ "error": { "code": "scope_forbidden", "message": "..." } }| Status | Code | Meaning |
|---|---|---|
| 401 | missing_key | No Authorization header was sent |
| 401 | invalid_key | Key is unrecognized, disabled, expired, or revoked |
| 403 | scope_forbidden | The key is valid but not granted this dataset |
| 429 | rate_limited | The key's rate limit was exceeded. Back off and retry |
| 500 | internal_error | Temporary server error. Retry shortly |
Every key carries its own hourly request limit, 1,000 requests per hour by default, and yours is set when the key is issued. Going over returns 429 with the headers you need to back off politely: Retry-After (seconds to wait), plus X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Cache responses on your side rather than polling; the data does not change by the second.
What you can do with the data
- The data is for display and integration on your approved site. Do not resell it or redistribute the raw dataset.
- Always link back. Every record carries a
urlorprofileUrl— use it, so that people contact and transact on ChabadUp rather than around it. - A key is issued for a specific site and purpose. If either changes, tell us, so the scopes still match what you are actually doing.