Explore everypublic endpoint.
Search the English-language ItemData API contract, review exact requirements and billing rules, copy working examples, and send only the requests that are safe to run from a browser.
Public endpoints
Inventory
Fetch normalized Steam inventory pages with cache and billing metadata.
GET/v1/inventoryFetch one Steam inventory page1–2 credits · Plan limits
Returns exactly one Steam page. A successful normal public request consumes one base credit and may use a fresh or stale-if-error public snapshot. no_cache=true, caller-supplied steam_login_secure or trade_url credentials, and try_first_seven_days_blocked_items=true each add +1 credit when the result is billable because they force a fresh fetch. Fresh-fetch additions never stack, so the maximum billable inventory-request price is 2 credits. Steam's undocumented Community inventory endpoint currently returns HTTP 401 with JSON null for structurally valid but unallocated SteamID64 values. Because 401 may also represent a public-empty state, ItemData treats it as a successful empty public page and follows normal public-page caching and billing. An upstream Steam HTTP 403 is treated as a confirmed private inventory and finalizes the full quote: 1 credit for a normal MISS or private-marker HIT, or 2 credits for a fresh-fetch mode. It is cached for 72 hours once per SteamID64; during that TTL it applies to every game and normal requests return HIT without contacting Steam. no_cache=true ignores both public snapshots and the private marker, charges 2 credits for a confirmed fresh 403, and refreshes the marker. A non-authoritative success=false result still removes an older public snapshot but is not charged. Caller-supplied and internal Steam-session requests always perform a fresh fetch and bypass all shared cache state. For an authorized account, provide a structurally valid steamLoginSecure cookie in X-Steam-Login-Secure to fetch the cookie owner's inventory for any supported game; for CS2, this avoids the normal 10-day visibility delay. steam_id is ignored and the owner SteamID64 is read from the cookie. Alternatively, provide a canonical Steam trade URL in X-Steam-Trade-URL to fetch that CS2 partner inventory, including 7-10 day trade-locked items; steam_id is then ignored and the target is read from the URL. If both credentials are present, X-Steam-Login-Secure takes precedence and the trade URL is ignored. Never put either secret in a URL unless legacy compatibility is unavoidable: query strings can enter browser history, access logs, and intermediary logs. Set try_first_seven_days_blocked_items=true for CS2 to try the internal partner-inventory session pool first; this forces non-tradable items to be included and falls back to a fresh public inventory request on the first page only when Steam rejects the partner request or the pool is temporarily unavailable. trade_url cannot be combined with try_first_seven_days_blocked_items. Broker authentication/configuration and invalid broker responses fail instead of being hidden by public fallback. Other failed requests and non-authoritative success=false responses consume zero credits. The upstream public Steam page size is fixed server-side at 2000; count and limit are not accepted. When more_items is true, pass last_assetid as start_assetid on the next request. Preserve cursor provenance using X-ItemData-Inventory-Source: keep the option enabled after partner, but omit it after public-fallback. The actual encoded JSON body is limited to 12 MiB for both compact and pretty output.
#get-/v1/inventoryParameters
15 parameters| Parameter | Location & type | Default / allowed | Description |
|---|---|---|---|
keyOptionalSensitive · never persist | querystring | Default: — Allowed: — | API key. Authorization Bearer is preferred outside compatibility integrations. |
steam_idConditional | querystring | Default: — Allowed: — Example: 76561198000000000 | Public individual SteamID64 only, in the inclusive range 76561197960265729 through 76561202255233023. SteamID2, SteamID3, vanity names, profile URLs, whitespace, and other Steam account types are rejected before inventory capacity or credits are reserved. Required unless steam_login_secure or trade_url supplies the target. When either credential supplies the target, steam_id may be omitted; if supplied, it must still satisfy this schema but its value is not used. steam_login_secure takes precedence when both credentials are present. Required unless X-Steam-Login-Secure or X-Steam-Trade-URL is provided. |
gameOptional | querystring | Default: cs2 Allowed: cs2, rust, dota, dota2, tf2, pubg | Supported canonical values are cs2, rust, dota2, tf2, and pubg. dota is accepted as a compatibility alias and is returned canonically as dota2. |
languageOptional | querystring | Default: english Allowed: — | Steam inventory localization language. Defaults to english and accepts Steam-compatible language identifiers. |
start_assetidOptional | querystring | Default: — Allowed: — | Opaque Steam cursor from the previous response's last_assetid. Omit for the first page. |
include_non_tradableOptional | queryboolean | Default: false Allowed: — | Include non-tradable assets. Filtering never changes total_inventory_count or cursor progression. |
with_no_tradableOptional | queryboolean | Default: false Allowed: — | SteamWebAPI-compatible alias for include_non_tradable. If both are provided, their values must match. |
no_cacheOptional | queryboolean | Default: false Allowed: — | Force a new public Steam fetch instead of serving a public snapshot or confirmed-private marker. Additional cost is +1 credit for a billable result; a confirmed Steam HTTP 403 therefore costs 2 credits and refreshes the account-wide private marker. The response is not published as another shared immutable object. A non-authoritative success=false response still durably removes any older public snapshot and is refunded. A concurrent no_cache call for the same SteamID64 returns refresh_in_progress and is not charged. Requests authorized by steam_login_secure or trade_url and internal Steam-session requests already bypass the shared cache and do not need this flag. Fresh-fetch additions never stack, so the maximum billable inventory-request price is 2 credits. |
try_first_seven_days_blocked_itemsOptional | queryboolean | Default: false Allowed: — | For CS2 only, try Steam's partner-inventory path through an internal service-account session before the normal public endpoint. It cannot be combined with steam_login_secure or trade_url, always bypasses the shared cache, and forces include_non_tradable=true. Additional cost is +1 credit for a billable result, including a confirmed Steam HTTP 403 from the public fallback. If Steam rejects the first partner request or the pool is temporarily unavailable, ItemData performs one fresh public fallback and reports public-fallback in X-ItemData-Inventory-Source; broker configuration/authentication and protocol failures do not silently fall back. For the next page, keep this flag after a partner response but omit it after public-fallback. A later partner cursor never falls back to the semantically different public cursor. |
steam_login_secureOptionalDeprecatedSensitive · never persist | querystring | Default: — Allowed: — | Legacy query form of X-Steam-Login-Secure. Prefer the header because query strings can be retained in browser history and access or intermediary logs. |
X-Steam-Login-SecureOptionalSensitive · never persist | headerstring | Default: — Allowed: — | Preferred transport for a structurally valid steamLoginSecure cookie that contains its owner SteamID64. Supported for every game; for CS2, it fetches the authorized owner's inventory without the normal 10-day visibility delay. steam_id is ignored and derived from the cookie. The value is forwarded only for this request, bypasses all shared cache reads and writes, adds +1 credit for a billable result including a confirmed Steam HTTP 403, and is never persisted. If X-Steam-Trade-URL is also present, this header takes precedence and the trade URL is ignored. |
trade_urlOptionalDeprecatedSensitive · never persist | querystring | Default: — Allowed: — | Legacy query form of X-Steam-Trade-URL. Prefer the header because the trade token is a secret and query strings can be retained in browser history and access or intermediary logs. |
X-Steam-Trade-URLOptionalSensitive · never persist | headerstring | Default: — Allowed: — Example: https://steamcommunity.com/tradeoffer/new/?partner=123456&token=AbCdEf | Preferred transport for a canonical HTTPS Steam trade URL with exactly partner=<AccountID32> and token=<6-128 characters from A-Z, a-z, 0-9, underscore, or hyphen>. CS2 only. Fetches the partner inventory including 7-10 day trade-locked items; steam_id is ignored and derived from partner. It always bypasses shared cache reads and writes, adds +1 credit after success, is never persisted, and cannot be combined with try_first_seven_days_blocked_items. It is ignored when X-Steam-Login-Secure is present. |
formatOptional | querystring | Default: json Allowed: json, prettyjson, pretty | Use prettyjson for indented JSON; pretty remains a compatibility alias. |
prettyOptional | queryboolean | Default: false Allowed: — | Set to 1 or true for indented JSON. Pretty output is subject to the same 12 MiB encoded-body limit as compact JSON. ItemData intentionally supports JSON only. |
Responses
10 documented statuses- 200
- One inventory page, including a cacheable success=false response for a confirmed private inventory. Upstream Steam 401/403 statuses are domain inputs and do not become this API's HTTP 401/403 responses. A Steam 401, including the response observed for an unallocated but structurally valid SteamID64, becomes a billable successful empty page.
- 400
- Invalid request
- 401
- Missing or invalid API key
- 402
- Insufficient credits
- 403
- API key is inactive, its assigned plan has expired (`plan_expired`), or access is forbidden
- 429
- Account-wide fixed-window request rate exceeded. All API keys for the same Steam account and every application replica share the minute, UTC-day, and UTC-month counters.
- 499
- Request context was canceled by the client
- 502
- Steam returned invalid data, or the decoded or final encoded inventory exceeded a safety limit (`pagination_limit`)
- 503
- Required dependency or proxy gateway unavailable (`cache_unavailable` or `upstream_unavailable`), or an identical refresh is still in progress (`refresh_in_progress`)
- 504
- Steam request timed out
application/json · Inventoryapplication/json · Errorapplication/json · Errorapplication/json · Errorapplication/json · Errorapplication/json · Errorapplication/json · Errorapplication/json · Errorapplication/json · Errorapplication/json · ErrorRequest examples
cURL · Python payload · JavaScriptcURL
curl --fail-with-body --get \
-H 'Accept: application/json' \
-H "Authorization: Bearer $ITEMDATA_API_KEY" \
--data-urlencode 'steam_id=76561198000000000' \
--data-urlencode 'game=cs2' \
'https://itemdata.net/v1/inventory'Python
import os
import requests
payload = {
"key": os.environ["ITEMDATA_API_KEY"],
"steam_id": "76561198000000000",
"game": "cs2",
}
response = requests.get(
"https://itemdata.net/v1/inventory",
params=payload,
timeout=30
)
response.raise_for_status()
print(response.json())JavaScript
const params = new URLSearchParams({
"steam_id": "76561198000000000",
"game": "cs2",
});
const response = await fetch(`https://itemdata.net/v1/inventory?${params}`, {
method: "GET",
headers: {
"Accept": "application/json",
"Authorization": `Bearer ${process.env.ITEMDATA_API_KEY}`,
},
});
if (!response.ok) {
throw new Error(`ItemData request failed: ${response.status}`);
}
console.log(await response.json());Try the inventory endpoint
Secrets remain in page memory onlyTry the endpoint
Enter your own key to send a real request. The key stays in this page's memory and is never saved by the explorer.
{
"success": true,
"steam_id": "76561198000000000",
"game": "cs2",
"appid": 730,
"total_inventory_count": 184,
"items": [
{
"assetid": "34589211402",
"market_hash_name": "AK-47 | Slate (Field-Tested)",
"tradable": true
}
],
"last_assetid": "34589211402",
"more_items": true
}Plans
Discover the currently published ItemData plans and request limits.
GET/v1/plansList published plansFree · Public read
Returns the currently published ItemData plans, credit balances, and minute, day, and month request limits without requiring an API key.
#get-/v1/plansParameters
0 parametersNo parameters.
Responses
2 documented statuses- 200
- Published plans ordered by sort_order and code.
- 503
- Web account service unavailable
application/json · PlanListapplication/json · ConsoleErrorRequest examples
cURL · Python payload · JavaScriptcURL
curl --fail-with-body --get \
-H 'Accept: application/json' \
'https://itemdata.net/v1/plans'Python
import requests
response = requests.get(
"https://itemdata.net/v1/plans",
timeout=30
)
response.raise_for_status()
print(response.json())JavaScript
const response = await fetch("https://itemdata.net/v1/plans", {
method: "GET",
headers: {
"Accept": "application/json",
},
});
if (!response.ok) {
throw new Error(`ItemData request failed: ${response.status}`);
}
console.log(await response.json());This browser runner accepts no custom URL, method, headers, or body. It never stores request or response data.
Operations
Read-only service liveness and dependency health endpoints.
GET/v1/healthService, dependency, proxy, and runtime healthFree · Health probe
Reports dependency-aware service readiness, including the runtime components required to serve inventory traffic.
#get-/v1/healthParameters
0 parametersNo parameters.
Responses
2 documented statuses- 200
- Healthy
- 503
- One or more required dependencies are unavailable
application/json · Healthapplication/json · HealthRequest examples
cURL · Python payload · JavaScriptcURL
curl --fail-with-body --get \
-H 'Accept: application/json' \
'https://itemdata.net/v1/health'Python
import requests
response = requests.get(
"https://itemdata.net/v1/health",
timeout=30
)
response.raise_for_status()
print(response.json())JavaScript
const response = await fetch("https://itemdata.net/v1/health", {
method: "GET",
headers: {
"Accept": "application/json",
},
});
if (!response.ok) {
throw new Error(`ItemData request failed: ${response.status}`);
}
console.log(await response.json());This browser runner accepts no custom URL, method, headers, or body. It never stores request or response data.
GET/v1/liveProcess livenessFree · Health probe
Confirms that the ItemData HTTP process is running. This lightweight probe does not verify downstream dependencies.
#get-/v1/liveParameters
0 parametersNo parameters.
Responses
1 documented statuses- 200
- The process is running and can serve HTTP.
application/json · LivenessRequest examples
cURL · Python payload · JavaScriptcURL
curl --fail-with-body --get \
-H 'Accept: application/json' \
'https://itemdata.net/v1/live'Python
import requests
response = requests.get(
"https://itemdata.net/v1/live",
timeout=30
)
response.raise_for_status()
print(response.json())JavaScript
const response = await fetch("https://itemdata.net/v1/live", {
method: "GET",
headers: {
"Accept": "application/json",
},
});
if (!response.ok) {
throw new Error(`ItemData request failed: ${response.status}`);
}
console.log(await response.json());This browser runner accepts no custom URL, method, headers, or body. It never stores request or response data.
Reference
Human-readable and machine-readable API contracts.
GET/v1/docsSelf-contained OpenAPI documentationFree · Public reference
Returns the backend's embedded, English-language OpenAPI documentation for human inspection.
#get-/v1/docsParameters
0 parametersNo parameters.
Responses
1 documented statuses- 200
- Human-readable embedded OpenAPI documentation
No response schemaRequest examples
cURL · Python payload · JavaScriptcURL
curl --fail-with-body --get \
'https://itemdata.net/v1/docs'Python
import requests
response = requests.get(
"https://itemdata.net/v1/docs",
timeout=30
)
response.raise_for_status()
print(response.text)JavaScript
const response = await fetch("https://itemdata.net/v1/docs", {
method: "GET",
});
if (!response.ok) {
throw new Error(`ItemData request failed: ${response.status}`);
}
console.log(await response.text());GET/v1/openapi.yamlRaw OpenAPI contractFree · Public reference
Returns the authoritative English-language OpenAPI 3.0 YAML contract used to generate the public endpoint catalog.
#get-/v1/openapi.yamlParameters
0 parametersNo parameters.
Responses
1 documented statuses- 200
- OpenAPI 3.0 YAML
application/yaml · stringRequest examples
cURL · Python payload · JavaScriptcURL
curl --fail-with-body --get \
-H 'Accept: application/yaml' \
'https://itemdata.net/v1/openapi.yaml'Python
import requests
response = requests.get(
"https://itemdata.net/v1/openapi.yaml",
timeout=30
)
response.raise_for_status()
print(response.text)JavaScript
const response = await fetch("https://itemdata.net/v1/openapi.yaml", {
method: "GET",
headers: {
"Accept": "application/yaml",
},
});
if (!response.ok) {
throw new Error(`ItemData request failed: ${response.status}`);
}
console.log(await response.text());