Public API reference

Explore everypublic endpoint.

Search the English-language ItemData API contract, review exact requirements and billing rules, copy working examples, and send only the requests that are safe to run from a browser.

6Public operations
4Endpoint groups
6.0.0API version
GETRequest method

Public endpoints

6 of 6 endpoints
Endpoint group

Inventory

Fetch normalized Steam inventory pages with cache and billing metadata.

1 operation
GET/v1/inventoryFetch one Steam inventory page1–2 credits · Plan limits

Returns exactly one Steam page. A successful normal public request consumes one base credit and may use a fresh or stale-if-error public snapshot. no_cache=true, caller-supplied steam_login_secure or trade_url credentials, and try_first_seven_days_blocked_items=true each add +1 credit when the result is billable because they force a fresh fetch. Fresh-fetch additions never stack, so the maximum billable inventory-request price is 2 credits. Steam's undocumented Community inventory endpoint currently returns HTTP 401 with JSON null for structurally valid but unallocated SteamID64 values. Because 401 may also represent a public-empty state, ItemData treats it as a successful empty public page and follows normal public-page caching and billing. An upstream Steam HTTP 403 is treated as a confirmed private inventory and finalizes the full quote: 1 credit for a normal MISS or private-marker HIT, or 2 credits for a fresh-fetch mode. It is cached for 72 hours once per SteamID64; during that TTL it applies to every game and normal requests return HIT without contacting Steam. no_cache=true ignores both public snapshots and the private marker, charges 2 credits for a confirmed fresh 403, and refreshes the marker. A non-authoritative success=false result still removes an older public snapshot but is not charged. Caller-supplied and internal Steam-session requests always perform a fresh fetch and bypass all shared cache state. For an authorized account, provide a structurally valid steamLoginSecure cookie in X-Steam-Login-Secure to fetch the cookie owner's inventory for any supported game; for CS2, this avoids the normal 10-day visibility delay. steam_id is ignored and the owner SteamID64 is read from the cookie. Alternatively, provide a canonical Steam trade URL in X-Steam-Trade-URL to fetch that CS2 partner inventory, including 7-10 day trade-locked items; steam_id is then ignored and the target is read from the URL. If both credentials are present, X-Steam-Login-Secure takes precedence and the trade URL is ignored. Never put either secret in a URL unless legacy compatibility is unavoidable: query strings can enter browser history, access logs, and intermediary logs. Set try_first_seven_days_blocked_items=true for CS2 to try the internal partner-inventory session pool first; this forces non-tradable items to be included and falls back to a fresh public inventory request on the first page only when Steam rejects the partner request or the pool is temporarily unavailable. trade_url cannot be combined with try_first_seven_days_blocked_items. Broker authentication/configuration and invalid broker responses fail instead of being hidden by public fallback. Other failed requests and non-authoritative success=false responses consume zero credits. The upstream public Steam page size is fixed server-side at 2000; count and limit are not accepted. When more_items is true, pass last_assetid as start_assetid on the next request. Preserve cursor provenance using X-ItemData-Inventory-Source: keep the option enabled after partner, but omit it after public-fallback. The actual encoded JSON body is limited to 12 MiB for both compact and pretty output.

#get-/v1/inventory
Authentication
Bearer API key or legacy query keyOperation ID: getInventory
Credits
1–2 creditsSuccessful normal pages cost 1 credit. Any fresh-fetch mode adds +1, and fresh options never stack above 2 credits.
Rate limit
Plan limitsThe active plan's minute, day, and month request limits apply before Steam work begins.

Parameters

15 parameters
ParameterLocation & typeDefault / allowedDescription
key
OptionalSensitive · never persist
query
string
Default:
Allowed:
API key. Authorization Bearer is preferred outside compatibility integrations.
steam_id
Conditional
query
string
Default:
Allowed:
Example: 76561198000000000
Public individual SteamID64 only, in the inclusive range 76561197960265729 through 76561202255233023. SteamID2, SteamID3, vanity names, profile URLs, whitespace, and other Steam account types are rejected before inventory capacity or credits are reserved. Required unless steam_login_secure or trade_url supplies the target. When either credential supplies the target, steam_id may be omitted; if supplied, it must still satisfy this schema but its value is not used. steam_login_secure takes precedence when both credentials are present.
Required unless X-Steam-Login-Secure or X-Steam-Trade-URL is provided.
game
Optional
query
string
Default: cs2
Allowed: cs2, rust, dota, dota2, tf2, pubg
Supported canonical values are cs2, rust, dota2, tf2, and pubg. dota is accepted as a compatibility alias and is returned canonically as dota2.
language
Optional
query
string
Default: english
Allowed:
Steam inventory localization language. Defaults to english and accepts Steam-compatible language identifiers.
start_assetid
Optional
query
string
Default:
Allowed:
Opaque Steam cursor from the previous response's last_assetid. Omit for the first page.
include_non_tradable
Optional
query
boolean
Default: false
Allowed:
Include non-tradable assets. Filtering never changes total_inventory_count or cursor progression.
with_no_tradable
Optional
query
boolean
Default: false
Allowed:
SteamWebAPI-compatible alias for include_non_tradable. If both are provided, their values must match.
no_cache
Optional
query
boolean
Default: false
Allowed:
Force a new public Steam fetch instead of serving a public snapshot or confirmed-private marker. Additional cost is +1 credit for a billable result; a confirmed Steam HTTP 403 therefore costs 2 credits and refreshes the account-wide private marker. The response is not published as another shared immutable object. A non-authoritative success=false response still durably removes any older public snapshot and is refunded. A concurrent no_cache call for the same SteamID64 returns refresh_in_progress and is not charged. Requests authorized by steam_login_secure or trade_url and internal Steam-session requests already bypass the shared cache and do not need this flag. Fresh-fetch additions never stack, so the maximum billable inventory-request price is 2 credits.
try_first_seven_days_blocked_items
Optional
query
boolean
Default: false
Allowed:
For CS2 only, try Steam's partner-inventory path through an internal service-account session before the normal public endpoint. It cannot be combined with steam_login_secure or trade_url, always bypasses the shared cache, and forces include_non_tradable=true. Additional cost is +1 credit for a billable result, including a confirmed Steam HTTP 403 from the public fallback. If Steam rejects the first partner request or the pool is temporarily unavailable, ItemData performs one fresh public fallback and reports public-fallback in X-ItemData-Inventory-Source; broker configuration/authentication and protocol failures do not silently fall back. For the next page, keep this flag after a partner response but omit it after public-fallback. A later partner cursor never falls back to the semantically different public cursor.
steam_login_secure
OptionalDeprecatedSensitive · never persist
query
string
Default:
Allowed:
Legacy query form of X-Steam-Login-Secure. Prefer the header because query strings can be retained in browser history and access or intermediary logs.
X-Steam-Login-Secure
OptionalSensitive · never persist
header
string
Default:
Allowed:
Preferred transport for a structurally valid steamLoginSecure cookie that contains its owner SteamID64. Supported for every game; for CS2, it fetches the authorized owner's inventory without the normal 10-day visibility delay. steam_id is ignored and derived from the cookie. The value is forwarded only for this request, bypasses all shared cache reads and writes, adds +1 credit for a billable result including a confirmed Steam HTTP 403, and is never persisted. If X-Steam-Trade-URL is also present, this header takes precedence and the trade URL is ignored.
trade_url
OptionalDeprecatedSensitive · never persist
query
string
Default:
Allowed:
Legacy query form of X-Steam-Trade-URL. Prefer the header because the trade token is a secret and query strings can be retained in browser history and access or intermediary logs.
X-Steam-Trade-URL
OptionalSensitive · never persist
header
string
Default:
Allowed:
Example: https://steamcommunity.com/tradeoffer/new/?partner=123456&token=AbCdEf
Preferred transport for a canonical HTTPS Steam trade URL with exactly partner=<AccountID32> and token=<6-128 characters from A-Z, a-z, 0-9, underscore, or hyphen>. CS2 only. Fetches the partner inventory including 7-10 day trade-locked items; steam_id is ignored and derived from partner. It always bypasses shared cache reads and writes, adds +1 credit after success, is never persisted, and cannot be combined with try_first_seven_days_blocked_items. It is ignored when X-Steam-Login-Secure is present.
format
Optional
query
string
Default: json
Allowed: json, prettyjson, pretty
Use prettyjson for indented JSON; pretty remains a compatibility alias.
pretty
Optional
query
boolean
Default: false
Allowed:
Set to 1 or true for indented JSON. Pretty output is subject to the same 12 MiB encoded-body limit as compact JSON. ItemData intentionally supports JSON only.

Responses

10 documented statuses
200
One inventory page, including a cacheable success=false response for a confirmed private inventory. Upstream Steam 401/403 statuses are domain inputs and do not become this API's HTTP 401/403 responses. A Steam 401, including the response observed for an unallocated but structurally valid SteamID64, becomes a billable successful empty page.
application/json · Inventory
400
Invalid request
application/json · Error
401
Missing or invalid API key
application/json · Error
402
Insufficient credits
application/json · Error
403
API key is inactive, its assigned plan has expired (`plan_expired`), or access is forbidden
application/json · Error
429
Account-wide fixed-window request rate exceeded. All API keys for the same Steam account and every application replica share the minute, UTC-day, and UTC-month counters.
application/json · Error
499
Request context was canceled by the client
application/json · Error
502
Steam returned invalid data, or the decoded or final encoded inventory exceeded a safety limit (`pagination_limit`)
application/json · Error
503
Required dependency or proxy gateway unavailable (`cache_unavailable` or `upstream_unavailable`), or an identical refresh is still in progress (`refresh_in_progress`)
application/json · Error
504
Steam request timed out
application/json · Error

Request examples

cURL · Python payload · JavaScript
cURL
curl --fail-with-body --get \
  -H 'Accept: application/json' \
  -H "Authorization: Bearer $ITEMDATA_API_KEY" \
  --data-urlencode 'steam_id=76561198000000000' \
  --data-urlencode 'game=cs2' \
  'https://itemdata.net/v1/inventory'
Python
import os
import requests

payload = {
    "key": os.environ["ITEMDATA_API_KEY"],
    "steam_id": "76561198000000000",
    "game": "cs2",
}

response = requests.get(
    "https://itemdata.net/v1/inventory",
    params=payload,
    timeout=30
)
response.raise_for_status()
print(response.json())
JavaScript
const params = new URLSearchParams({
  "steam_id": "76561198000000000",
  "game": "cs2",
});

const response = await fetch(`https://itemdata.net/v1/inventory?${params}`, {
  method: "GET",
  headers: {
    "Accept": "application/json",
    "Authorization": `Bearer ${process.env.ITEMDATA_API_KEY}`,
  },
});

if (!response.ok) {
  throw new Error(`ItemData request failed: ${response.status}`);
}

console.log(await response.json());

Try the inventory endpoint

Secrets remain in page memory only
LIVE EXPLORER

Try the endpoint

Enter your own key to send a real request. The key stays in this page's memory and is never saved by the explorer.

GET/v1/inventory?game=cs2&pretty=1&steam_id=76561198000000000
Steam credentials stay in this page's memory, are sent only in request headers, and are never added to the URL. ItemData does not persist them.Sent only to your configured ItemData API origin and never stored.
ResponseExample response
{
  "success": true,
  "steam_id": "76561198000000000",
  "game": "cs2",
  "appid": 730,
  "total_inventory_count": 184,
  "items": [
    {
      "assetid": "34589211402",
      "market_hash_name": "AK-47 | Slate (Field-Tested)",
      "tradable": true
    }
  ],
  "last_assetid": "34589211402",
  "more_items": true
}
Endpoint group

Plans

Discover the currently published ItemData plans and request limits.

1 operation
GET/v1/plansList published plansFree · Public read

Returns the currently published ItemData plans, credit balances, and minute, day, and month request limits without requiring an API key.

#get-/v1/plans
Authentication
NoneOperation ID: listPublishedPlans
Credits
FreeThis endpoint does not consume inventory credits.
Rate limit
Public readProtected by bounded service capacity; no API key is required.

Parameters

0 parameters

No parameters.

Responses

2 documented statuses
200
Published plans ordered by sort_order and code.
application/json · PlanList
503
Web account service unavailable
application/json · ConsoleError

Request examples

cURL · Python payload · JavaScript
cURL
curl --fail-with-body --get \
  -H 'Accept: application/json' \
  'https://itemdata.net/v1/plans'
Python
import requests

response = requests.get(
    "https://itemdata.net/v1/plans",
    timeout=30
)
response.raise_for_status()
print(response.json())
JavaScript
const response = await fetch("https://itemdata.net/v1/plans", {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`ItemData request failed: ${response.status}`);
}

console.log(await response.json());
Try this endpointFixed same-origin GET · no credentials

This browser runner accepts no custom URL, method, headers, or body. It never stores request or response data.

Ready to send a safe GET request.
Endpoint group

Operations

Read-only service liveness and dependency health endpoints.

2 operations
GET/v1/healthService, dependency, proxy, and runtime healthFree · Health probe

Reports dependency-aware service readiness, including the runtime components required to serve inventory traffic.

#get-/v1/health
Authentication
NoneOperation ID: getHealth
Credits
FreeThis endpoint does not consume inventory credits.
Rate limit
Health probeIntended for dependency-aware health and status checks.

Parameters

0 parameters

No parameters.

Responses

2 documented statuses
200
Healthy
application/json · Health
503
One or more required dependencies are unavailable
application/json · Health

Request examples

cURL · Python payload · JavaScript
cURL
curl --fail-with-body --get \
  -H 'Accept: application/json' \
  'https://itemdata.net/v1/health'
Python
import requests

response = requests.get(
    "https://itemdata.net/v1/health",
    timeout=30
)
response.raise_for_status()
print(response.json())
JavaScript
const response = await fetch("https://itemdata.net/v1/health", {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`ItemData request failed: ${response.status}`);
}

console.log(await response.json());
Try this endpointFixed same-origin GET · no credentials

This browser runner accepts no custom URL, method, headers, or body. It never stores request or response data.

Ready to send a safe GET request.
GET/v1/liveProcess livenessFree · Health probe

Confirms that the ItemData HTTP process is running. This lightweight probe does not verify downstream dependencies.

#get-/v1/live
Authentication
NoneOperation ID: getLiveness
Credits
FreeThis endpoint does not consume inventory credits.
Rate limit
Health probeIntended for lightweight process-liveness checks.

Parameters

0 parameters

No parameters.

Responses

1 documented statuses
200
The process is running and can serve HTTP.
application/json · Liveness

Request examples

cURL · Python payload · JavaScript
cURL
curl --fail-with-body --get \
  -H 'Accept: application/json' \
  'https://itemdata.net/v1/live'
Python
import requests

response = requests.get(
    "https://itemdata.net/v1/live",
    timeout=30
)
response.raise_for_status()
print(response.json())
JavaScript
const response = await fetch("https://itemdata.net/v1/live", {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`ItemData request failed: ${response.status}`);
}

console.log(await response.json());
Try this endpointFixed same-origin GET · no credentials

This browser runner accepts no custom URL, method, headers, or body. It never stores request or response data.

Ready to send a safe GET request.
Endpoint group

Reference

Human-readable and machine-readable API contracts.

2 operations
GET/v1/docsSelf-contained OpenAPI documentationFree · Public reference

Returns the backend's embedded, English-language OpenAPI documentation for human inspection.

#get-/v1/docs
Authentication
NoneOperation ID: getEmbeddedDocumentation
Credits
FreeThis endpoint does not consume inventory credits.
Rate limit
Public referenceServed as a short-lived cacheable documentation response.

Parameters

0 parameters

No parameters.

Responses

1 documented statuses
200
Human-readable embedded OpenAPI documentation
No response schema

Request examples

cURL · Python payload · JavaScript
cURL
curl --fail-with-body --get \
  'https://itemdata.net/v1/docs'
Python
import requests

response = requests.get(
    "https://itemdata.net/v1/docs",
    timeout=30
)
response.raise_for_status()
print(response.text)
JavaScript
const response = await fetch("https://itemdata.net/v1/docs", {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`ItemData request failed: ${response.status}`);
}

console.log(await response.text());
GET/v1/openapi.yamlRaw OpenAPI contractFree · Public reference

Returns the authoritative English-language OpenAPI 3.0 YAML contract used to generate the public endpoint catalog.

#get-/v1/openapi.yaml
Authentication
NoneOperation ID: getOpenAPIContract
Credits
FreeThis endpoint does not consume inventory credits.
Rate limit
Public referenceServed as a short-lived cacheable machine-readable contract.

Parameters

0 parameters

No parameters.

Responses

1 documented statuses
200
OpenAPI 3.0 YAML
application/yaml · string

Request examples

cURL · Python payload · JavaScript
cURL
curl --fail-with-body --get \
  -H 'Accept: application/yaml' \
  'https://itemdata.net/v1/openapi.yaml'
Python
import requests

response = requests.get(
    "https://itemdata.net/v1/openapi.yaml",
    timeout=30
)
response.raise_for_status()
print(response.text)
JavaScript
const response = await fetch("https://itemdata.net/v1/openapi.yaml", {
  method: "GET",
  headers: {
    "Accept": "application/yaml",
  },
});

if (!response.ok) {
  throw new Error(`ItemData request failed: ${response.status}`);
}

console.log(await response.text());