SpyderGoat server-time API reference
GET /mjd returns server-derived MJD, UTC, Unix seconds, and a source marker. GET /jd returns the same fields and adds Julian Date. Both are unsigned HTTP receipts derived from the current Worker clock.
Endpoints and methods
The /mjd and /jd routes are exact paths. For example, /mjd/ is not the API route and currently falls through to 404. HEAD is bodyless and quota-neutral; it does not return timestamp payload or time fields.
| Endpoint | Supported request | Current result |
|---|---|---|
| /mjd | GET | JSON containing mjd, utc, unix, and source |
| /jd | GET | The /mjd fields plus jd |
| /mjd, /jd | HEAD | 200 with API headers and no response body; free quota is not consumed |
| /mjd, /jd | OPTIONS | 204 with current CORS headers |
| /mjd, /jd | Other methods | 405 with Allow: GET, HEAD, OPTIONS |
Response fields
MJD and JD are rounded numerically to eight decimal places. JSON number serialization may omit trailing zeroes, so eight displayed decimal places are not promised on every number. Displayed precision does not establish clock accuracy.
| Field | Type | Present on | Exact current meaning |
|---|---|---|---|
| mjd | number | /mjd and /jd | now / 86,400,000 + 40,587, rounded to eight decimal places |
| utc | string | /mjd and /jd | new Date(now).toISOString() for the Worker clock read during response construction |
| unix | integer | /mjd and /jd | Math.floor(now / 1000) |
| source | string | /mjd and /jd | Always the literal "server" marker in current responses |
| jd | number | /jd only | Unrounded MJD plus 2,400,000.5, then rounded to eight decimal places |
Make a request and read the examples
Actual timestamps change on every successful GET. The examples below were generated for the fixed input time 2026-03-08T09:07:22.000Z using the current buildTimeResponse implementation; they are illustrative response shapes, not a live response.
Rate limits and 429 responses
With the rate-limit KV binding configured, the current free path accepts one unauthenticated GET per CF-Connecting-IP value every 30 minutes, shared across /mjd and /jd. This is best-effort Cloudflare KV abuse control, not a globally guaranteed enforcement model.
If CF-Connecting-IP is absent, the current code uses the shared key unknown. If the Worker has no rate-limit KV binding, the current implementation bypasses this check; that fallback is not a promised service tier.
A successful free GET to either path can cause a subsequent request to either path from the same rate-limit key to receive 429. The retry_after body value and Retry-After header are matching runtime-calculated integer seconds; 1732 in the example is illustrative only.
HEAD, CORS, and cache behavior
Successful GET and HEAD responses use Content-Type: application/json; charset=utf-8 and Cache-Control: no-store, and include the current API CORS headers. A public HEAD request returns a bodyless 200, bypasses the free rate-limit check, and does not return a timestamp payload.
A 429 response uses Content-Type: application/json; charset=utf-8 and Cache-Control: no-store, and includes the current API CORS headers plus Retry-After.
OPTIONS returns a bodyless 204 with the current CORS headers, but does not send Content-Type or Cache-Control. An unsupported method response such as POST /mjd returns 405 with Content-Type: application/json; charset=utf-8 and Cache-Control: no-store, but does not include API CORS.
The current API CORS headers send Access-Control-Allow-Origin: *, advertise GET, HEAD, OPTIONS, and allow Content-Type, Authorization request headers. API CORS does not send Access-Control-Allow-Credentials. Cache-Control: no-store instructs caches not to store a response; it is not proof that every intermediary complied or that logging and client retention cannot occur.
Errors and malformed use
| Case | Current observable behavior |
|---|---|
| Free request inside the active window | 429 with rate_limited, a message, numeric retry_after, and Retry-After |
| Unsupported method such as POST /mjd | 405 with JSON {"error":"method_not_allowed"} and Allow: GET, HEAD, OPTIONS |
| Wrong path such as /mjd/ | 404 JSON with error: "not_found" |
| Network timeout or platform failure | No stable JSON body is promised; callers must handle transport failure and non-JSON responses |
| Unexpected response fields or wrongly typed fields | Treat the response as malformed in the caller rather than guessing values |
Examples
Request /mjd
curl --fail-with-body --max-time 5 --header 'Accept: application/json' https://spydergoat.com/mjdRequest /jd
curl --fail-with-body --max-time 5 --header 'Accept: application/json' https://spydergoat.com/jdFixed illustrative /mjd response
{
"mjd": 61107.38011574,
"utc": "2026-03-08T09:07:22.000Z",
"unix": 1772960842,
"source": "server"
}Fixed illustrative /jd response
{
"mjd": 61107.38011574,
"utc": "2026-03-08T09:07:22.000Z",
"unix": 1772960842,
"source": "server",
"jd": 2461107.88011574
}Illustrative 429 response
HTTP/1.1 429 Too Many Requests
Retry-After: <seconds>
Content-Type: application/json; charset=utf-8
Cache-Control: no-store
Access-Control-Allow-Origin: *
{
"error": "rate_limited",
"message": "Free tier: 1 request per 30 minutes",
"retry_after": 1732
}Limits and non-guarantees
- What this receipt does not guarantee: SpyderGoat returns a server-derived HTTP time receipt derived from the Cloudflare Worker runtime clock. The Worker clock is read during response construction. It is an unsigned HTTP receipt, not NTP, an atomic-clock feed, a signed timestamp, or an RFC 3161 authority or timestamp token. It does not synchronize or discipline your clock, and it does not prove when an external event occurred. Displayed precision is not an accuracy guarantee. HTTP and network latency affect comparisons. SpyderGoat publishes no uptime or accuracy SLA.
Runtime provenance
This page describes current behavior defined by buildTimeResponse, checkFreeRateLimit, and request routing in src/api/worker.js, with public API behavior asserted in test/worker.test.js. The value source: "server" is a literal marker added by the Worker. It is not a signature, authentication, origin proof, or clock-quality attestation.