API
Everything the site shows is readable as JSON, keyless and cross-origin. Responses carry the corpus version they were served from, so a result can always be traced to the exact data release behind it.
Endpoints
/api/v1/versionsCorpus versions available on this server
/api/v1/manifestThe full manifest of the current corpus, with checksums
/api/v1/surah/{number}One surah: metadata and its verses
/api/v1/verse/{surah}/{ayah}One verse: text, tokens, translations
/api/v1/token/{id}One word: morphology, gloss, transliteration, root
/api/v1/resolve?ref=…Resolve a citation string to its verse or word
The contract
The machine-readable specification lives at /api/v1/openapi.json. The rate limit is 600 requests per IP per minute, disclosed on every response in x-ratelimit-limit and x-ratelimit-remaining; exceeding it returns 429 with retry-after. Responses are cacheable and served identically to everyone — there are no keys, tiers or accounts.
For bulk work, download the corpus from /data instead of crawling the API — it is the same data, checksummed, in one archive.