A key is required for /api/transport/: a request without a key gets 401 KEY_REQUIRED. A request with a wrong, revoked or another project's key is still refused and is never served as a request without a key.
The older addresses without /transport (for example /api/stops/search) still answer without a key for now (transition), with limits per address; their end will be announced in advance. With a key they are checked exactly like /api/transport/.
X-RateLimit-Remaining shows the real remainder of the current minute (it was always 0).
Access by key: integrations send the key of an approved project as Authorization: Bearer <key>. Applications, review, keys, IP addresses and usage are in the developer cabinet; see how access works.
Limits belong to the project (per minute, day and month, at the same time, heavy operations) instead of one IP address. Refusals name the limit and link to access errors.
New operation: GET /api/access/whoami shows what the server sees about your request.
Transition: published operations keep answering without a key, with limits per network, until a date announced in advance.
The reference no longer sends requests from the page.
https://api.ibusisrael.online is the canonical address of the iBus transport API. The gateway's paths are published under /api/transport/, with the same answers as https://app.ibusisrael.online/api/transport/, which keeps working.
First public description: 22 read-only operations in openapi.json, guides in four languages, llms.txt.
Limits are shared between both addresses. A limit hit answers JSON with Retry-After.
Known limitation: on the nights when clocks change, UTC fields computed from the timetable can differ by an hour for trips before 02:00 (see data and time).
