Sivitas API re-serves publicly available Indonesian higher-education data as a documented REST interface: forty-four endpoints across universities, study programmes, lecturers, students, fields of study, and national aggregates. It is an independent project with no affiliation to PDDikti or any government body, and every response carries that notice alongside the required attribution line.
Indonesia publishes a great deal about its universities: institutions and their facilities, study programmes and their costs, lecturer profiles with teaching and research history, student records, staffing ratios, and national counts by field of study. It is public, and it is awkward to consume programmatically.
Sivitas API groups all of it into seven collections — search, institutions, programmes, lecturers, students, statistics, and fields of study — behind one response envelope. Every payload carries an attribution line naming the data source and a disclaimer stating that the project is independent, that the data belongs to its original publisher, and that anything consequential should be verified against the official source.
The hard part is not parsing; it is being allowed to read. The upstream edge fingerprints the TLS handshake itself, so a request carrying a perfectly convincing browser User-Agent is still refused when it originates from a datacentre address — the same headers succeed from a residential connection.
The client performs a genuine Chrome TLS handshake when that library is available, and falls back to plain requests where the address is not the obstacle. The browser identity is kept coherent across every layer: User-Agent, client hint headers, and TLS profile all describe the same browser build, because a mismatch between them is itself the signal being looked for.
No upstream host, deployment URL, or third-party service appears in the source. Every one comes from the environment, so the repository can be public without disclosing which hosts the service talks to, and an unset value simply disables the feature that needed it instead of failing at import. What a running deployment actually resolved is visible on its own overview endpoint.
The branding works the same way — name, maintainer, attribution line and disclaimer all have defaults and can all be overridden, so a fork identifies itself honestly rather than inheriting someone else’s attribution.
The service is running in limited mode. The overview endpoint, the OpenAPI schema, the documentation and the browser playground all respond normally; the forty-four data endpoints return a structured 503 naming the condition, the documentation links, and any alternative endpoint configured.
That is a deliberate state rather than an outage. Upstream access is rate-limited and protected, and shedding data traffic while keeping the interface documented is the honest version of being unavailable.
“I am very happy with this API, it finally made retrieving PDDIKTI data possible for our statistical needs.”
Institutional user, data and statistics
Every one of these is a full five. Nobody was handed a rating scale — the feedback arrived as sentences, and none of them is qualified, so none is scored below five. If one ever comes back mixed, it will be published with the number it earned.