Endpoint catalog

$ curl -sD - -H "Authorization: Bearer $EMCURSO_KEY" \
    "https://api.emcurso.pt/prociv/incendios/ativos"

HTTP/2 200
content-type: application/json; charset=utf-8
cache-control: public, s-maxage=30, stale-while-revalidate=60
x-cache: HIT
x-auth-method: bearer
x-ratelimit-limit: 60
x-ratelimit-remaining: 57
x-ratelimit-reset: 2026-08-01T11:43:00.000Z
x-ratelimit-reset-after: 38
x-ratelimit-window: minute

$ curl -sD - "https://api.emcurso.pt/prociv/incendios/ativos"

HTTP/2 401
www-authenticate: Bearer realm="EmCurso API"
content-type: application/json
x-request-id: 8f1c2e40-9b3a-4d61

{
  "success": false,
  "error": "Unauthorized",
  "message": "Missing or invalid API key",
  "requestId": "8f1c2e40-9b3a-4d61",
  "hint": "Para acesso externo, use Authorization: Bearer <API_KEY>"
}

What each status means

200

Request served

X-Cache says whether it came from cache (HIT), from origin (MISS), or from a stale copy served while revalidating (STALE).

304

Nothing changed

Answer to an If-None-Match carrying the current ETag: no body, the one you hold is still valid. Authenticated and counted towards quota like any request.

401

Key missing, invalid or revoked

The message field says which of the three. Check the header before suspecting the key — a path that does not exist answers 404, never 401.

403

User-Agent refused

The key requires a declared User-Agent and the one sent does not match. The observed identifiers are listed in the console.

429

Limit exceeded

Retry-After states the seconds to wait and is never zero. The body repeats it in retryAfterSeconds, alongside resetAt and the window that fired.

404

Path does not exist

Returned to any caller, with or without a key. A caller sending an issued key also receives the near matches and the full list.

Every response carries X-Request-ID, repeated in the body of a refusal. That is the identifier to quote when reporting a problem.

All three windows are checked at once. Whichever runs out first is the one that answers 429, and its name is what X-RateLimit-Window carries.

x-ratelimit-limit: 60
x-ratelimit-remaining: 57
x-ratelimit-reset: 2026-08-01T11:43:00.000Z
x-ratelimit-reset-after: 38
x-ratelimit-window: minute

HTTP/2 429
retry-after: 38
x-ratelimit-limit: 60
x-ratelimit-remaining: 0
x-ratelimit-window: minute

{
  "success": false,
  "error": "Too Many Requests",
  "retryAfterSeconds": 38,
  "resetAt": "2026-08-01T11:43:00.000Z",
  "limit": 60,
  "window": "minute",
  "hint": "Limite excedido. Repetir dentro de 38s."
}