API Documentation

The allthevaccines API provides the complete vaccine and disease database as JSON and CSV. It is public, read-only, and does not require authentication.

Quick start

curl https://allthevaccines.org/api/vaccines/

Endpoints

Method	Endpoint	Description
`GET`	`/api/`	Machine-readable API discovery
`GET`	`/api/vaccines/`	All 178 vaccines as JSON
`GET`	`/api/vaccines.csv`	All vaccines as a CSV attachment
`GET`	`/api/diseases/`	All 33 diseases as JSON
`GET`	`/api/diseases.csv`	All diseases as a CSV attachment

JSON response

Collection responses use a stable envelope:

{
  "schema_version": 1,
  "count": 178,
  "results": [
    { ... }
  ]
}

schema_version will change when an incompatible field or response-structure change is introduced.

Vaccine fields

Field	Type	Description
`id`	integer	Database identifier
`trade_name`	string	Branded product name
`slug`	string	Stable URL identifier
`manufacturer`	string	Manufacturer or developer
`vaccine_class`	string or null	Broad vaccine class
`vaccine_type`	string or null	Vaccine technology or type
`first_authorized_year`	integer or null	Earliest supported authorization year
`first_authorized_region`	string or null	Country or region of that authorization
`first_authorization_source_url`	string or null	Evidence URL for the authorization
`info_urls`	array	Additional information links
`diseases`	array	Related disease IDs, names, and slugs

Disease fields

Field	Type	Description
`id`	integer	Database identifier
`name`	string	Disease name
`slug`	string	Stable URL identifier
`wikipedia_url`	string	Wikipedia reference
`notes`	string or null	Markdown-formatted notes
`vaccine_count`	integer	Number of related vaccines
`vaccines`	array	Related vaccine IDs, trade names, and slugs

Downloads

Add ?download=1 to a JSON endpoint to receive a named JSON attachment. CSV endpoints always return named attachments. Multi-value CSV fields use | as their delimiter.

Browser access and caching

Every API response includes Access-Control-Allow-Origin: *, so it can be requested by browser applications on other domains. Responses include Cache-Control: public, max-age=300 and may be cached for five minutes.