Does the Robust Devs API need an API key?

No. There is no authentication, no signup and no key to rotate. Every documented operation is a GET over content already published on robustdevs.co, so the API exposes nothing that the website does not. Send the request and read the response.

Where is the Robust Devs OpenAPI specification?

At https://robustdevs.co/openapi.json, served as application/vnd.oai.openapi+json;version=3.1 with CORS open to any origin. It is also advertised as a Link header with rel="service-desc" on every route on the site, and listed in the RFC 9727 API catalog at /.well-known/api-catalog.

How do I connect the Robust Devs MCP server?

Point an MCP client at https://robustdevs.co/api/mcp using the Streamable HTTP transport. No authentication is required. The same server also answers on https://robustdevs.co/mcp and https://robustdevs.co/.well-known/mcp, and its card is published at /.well-known/mcp/server-card.json. It exposes four read-only tools: list_blog_posts, list_case_studies, get_pricing and get_capabilities.

What does a Robust Devs API error look like?

Every 4xx and 5xx response is application/problem+json (RFC 9457). The body carries the problem members — type, title, status, detail, and instance where one resource is at fault — and repeats the same facts in a nested error object with a stable code. Branch on error.code, never on the prose in title. The codes are invalid_limit, endpoint_not_found, rate_limited, internal_error and upstream_unavailable.

What are the Robust Devs API rate limits?

The advertised policy is 120 requests per 60 seconds, published on every response as RFC 9331 RateLimit and RateLimit-Policy headers so a caller can self-throttle rather than discover the limit by hitting it. Exceeding it returns 429 with Retry-After. Enforcement is best-effort and per instance rather than global, so treat the headers as a courtesy signal, not a security boundary.

How does Robust Devs version and deprecate its API?

Canonical paths are versioned in the URL at /api/v1/. Breaking changes ship under a new path version; a version is never changed in place. When a version is scheduled for removal its responses carry the RFC 9745 Deprecation header and the RFC 8594 Sunset header, with the sunset date at least 180 days after the first Deprecation header. No version is deprecated today, which is why neither header is present. The full policy is at /deprecation-policy.md.

Is there a sandbox environment?

No, because there is nothing to sandbox. Every documented operation is a GET over already-public content: no call can mutate, delete or bill anything. Production is the safe environment — exercise it directly.

Robust Devs Developer Resources — API, MCP Server, OpenAPI

The Robust Devs REST API

Base URL https://robustdevs.co. Every operation is a GET, every response is public information, and there is no authentication step to get wrong. Canonical paths are versioned under /api/v1/; the unversioned /api/ paths are stable aliases of the same handlers.

getApiIndex

GET /api/v1

The API root. Lists the operations, the error model and the rate-limit policy, so a caller can use the API without parsing the OpenAPI document first.

curl "https://robustdevs.co/api/v1"

listBlogPosts

GET /api/v1/blogs

Published articles, newest first.

limit: integer 1–50, default 3 — How many posts to return
slug: string — Restrict to one post by URL slug

curl "https://robustdevs.co/api/v1/blogs?limit=1"

listCaseStudies

GET /api/v1/case-studies

Client case studies, newest first, with outcome metrics and tech stack where the client permitted publication.

limit: integer 1–50, default 3 — How many case studies to return
slug: string — Restrict to one category by title, e.g. SaaS. Matches the category, not a case-study slug.

curl "https://robustdevs.co/api/v1/case-studies?limit=1"

The Robust Devs MCP server

Model Context Protocol over Streamable HTTP, protocol version 2025-06-18 and no authentication. Point a client at https://robustdevs.co/api/mcp; the same server also answers on /mcp and /.well-known/mcp, and publishes its card at /.well-known/mcp/server-card.json.

list_blog_posts: Published Robust Devs articles about AI product engineering.
list_case_studies: Published client case studies with outcome metrics and tech stack.
get_pricing: The one standing published price, and how everything else is scoped.
get_capabilities: What Robust Devs builds, which three markets it serves, and how to start.

The Robust Devs CLI and SDK

One npm package, zero dependencies, no API key. It is a thin client over the same endpoints documented above — nothing is available through it that is not available through curl.

npx robustdevs blog --limit 3     # no install
npm install -g robustdevs         # CLI
npm install robustdevs            # SDK

import { RobustDevsClient } from 'robustdevs';
const client = new RobustDevsClient();
await client.listBlogPosts({ limit: 5 });

Errors, rate limits and versioning

Typed errors

Every failure is application/problem+json (RFC 9457) and validates against the ApiError schema in the OpenAPI document. Branch on error.code, never on the prose in title.

invalid_limit: 400 — limit was not an integer between 1 and 50.
endpoint_not_found: 404 — No endpoint is published at that path.
rate_limited: 429 — Too many requests. Wait for Retry-After.
internal_error: 500 — Unexpected server error. Retry once.
upstream_unavailable: 502 — The CMS could not be reached. Transient — retry.

Rate limits

120 requests per 60 seconds, advertised on every response — success and failure alike — as RFC 9331 headers, so a caller can self-throttle instead of discovering the limit by hitting it. Exceeding it returns 429 with Retry-After. Enforcement is best-effort and per instance rather than global: read the headers as a courtesy signal, not a security boundary.

RateLimit-Policy: "content";q=120;w=60
RateLimit: "content";r=118;t=57

Versioning and deprecation

The version is in the path. Breaking changes ship under a new one — /api/v2/ — and a version is never changed in place. Every response names the version that served it in an API-Version header. When a version is scheduled for removal its responses carry Deprecation (RFC 9745) and Sunset (RFC 8594), with the sunset date at least 180 days out. No version is deprecated today, which is why neither header is present. Full policy: /deprecation-policy.md.

Every machine-readable file Robust Devs publishes

All of these are also advertised as RFC 8288 Link headers on every route on this site, so an agent that lands anywhere can find them with one HEAD request.

/api/v1: The API root: operations, error model, rate-limit policy, documentation links.
/openapi.json: OpenAPI 3.1 description of the public content API, including the typed error schema. Also served at /.well-known/openapi.json and /api/openapi.json.
/api.md: The same API in markdown: operations, errors, rate limits.
/api/mcp: MCP server, Streamable HTTP. Also answers on /mcp and /.well-known/mcp.
/.well-known/mcp/server-card.json: MCP server card: transport, protocol version, tool list.
/.well-known/agent-card.json: A2A agent card: the skills this company answers for.
/.well-known/agent-skills/index.json: Capability index with explicit when-to-use guidance for each skill.
/.well-known/api-catalog: RFC 9727 linkset pointing at the API description and its documentation.
/.well-known/ai-catalog.json: Agentic Resource Discovery catalog of every agent-facing resource here.
/agents.md: Agent briefing: what this company does and when to use it.
/llms.txt: Structured index of every page on the site.
/llms-full.txt: The long form, with the content inlined.
/pricing.md: Machine-readable pricing.
/deprecation-policy.md: How and when an API version is retired.
/sitemap.xml: Every indexable URL.

Questions developers and agents ask

No. There is no authentication, no signup and no key to rotate. Every documented operation is a GET over content already published on robustdevs.co, so the API exposes nothing that the website does not. Send the request and read the response.
Every 4xx and 5xx response is application/problem+json (RFC 9457). The body carries the problem members — type, title, status, detail, and instance where one resource is at fault — and repeats the same facts in a nested error object with a stable code. Branch on error.code, never on the prose in title. The codes are invalid_limit, endpoint_not_found, rate_limited, internal_error and upstream_unavailable.
Canonical paths are versioned in the URL at /api/v1/. Breaking changes ship under a new path version; a version is never changed in place. When a version is scheduled for removal its responses carry the RFC 9745 Deprecation header and the RFC 8594 Sunset header, with the sunset date at least 180 days after the first Deprecation header. No version is deprecated today, which is why neither header is present. The full policy is at /deprecation-policy.md.

We build the AI products behind APIs like this one

Robust Devs builds AI products for marketing, healthtech and fintech. If you are integrating agents into a product rather than reading about ours, start with a conversation.

Talk to a founder Read the agent briefing

Robust Devs developer and agent resources