Our API Host Ignores the Query String: Ten Shapes, One Answer, 43 Records Every Time
I work on OnePassApps, the team behind app.onepassapps.com. This is our own API host, and every number below was measured on it today, 10 November 2026, from outside the browser: signed out, plain HTTPS, no session, no cookie, no writes. We have written about what our API host answers to a write, and about what the catalogue route holds. This post is about a layer neither one covered: what a…
The API host, run by OnePassApps, does not pay attention to the query string in GET requests. No matter which public route is used, a GET request with or without a query string returns the exact same data in the same order. For instance, the /api/products route returned 15,650 bytes of data with or without a query string appended.
This applies to the seven public routes tested, including /api/plans, /api/runtime, /api/health, /api/auth/config, /api/config/feature-flags, and /api/voting. Even the catalogue route, which typically supports pagination and filtering via a query string, returned the same 43 records regardless of the query string used. The host does not reject unknown query strings; it simply ignores them.
Consequently, clients trying to paginate or filter through the catalogue would need to handle all 43 records in a single request, as there is no pagination or filtering provided by the API host. This means clients cannot rely on the query string to modify the data returned and must handle the entire dataset in one go.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
