# Inconsistent API Results

**URL:** <https://discuss.circleci.com/t/inconsistent-api-results/3990>\
**Category:** Bug Reports\
**Tags:** api\
**Created:** [May 13, 2016, 5:29pm UTC](https://discuss.circleci.com/t/inconsistent-api-results/3990 "2016-05-13T17:29:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mostlygeek](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mostlygeek/32/2917_2.png) [@mostlygeek](https://discuss.circleci.com/u/mostlygeek)\
**Post date:** [May 13, 2016, 5:29pm UTC](https://discuss.circleci.com/t/inconsistent-api-results/3990/1 "2016-05-13T17:29:32Z")

</div>

Hi we build docker containers with CircleCI.

Using the API this works:

- curl -I [https://circleci.com/api/v1/project/mozilla/browserid-verifier](https://circleci.com/api/v1/project/mozilla/browserid-verifier)

but this project doesn’t:

- curl -I [https://circleci.com/api/v1/project/mozilla/testpilot](https://circleci.com/api/v1/project/mozilla/testpilot)

This returns a 404 result.

Whaa?

---

<div class="post-metadata">

**Author:** ![mostlygeek](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mostlygeek/32/2917_2.png) [@mostlygeek](https://discuss.circleci.com/u/mostlygeek)\
**Post date:** [May 13, 2016, 5:41pm UTC](https://discuss.circleci.com/t/inconsistent-api-results/3990/2 "2016-05-13T17:41:29Z")

</div>

Managed to figure this out. Clicking on the link above while signed into CircleCI produced the expected 200 page. It seems that anonymous access results in a 404.

Setting the project to “Free and Open Source” in Project Settings fixes the issue.

This is really confusing behavior and not clear at all why the API should 404 instead of 401 when the circleci session cookie is not sent.

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felicianotech/32/21348_2.png) [@FelicianoTech](https://discuss.circleci.com/u/FelicianoTech)\
**Post date:** [May 13, 2016, 5:58pm UTC](https://discuss.circleci.com/t/inconsistent-api-results/3990/3 "2016-05-13T17:58:46Z")

</div>

Returning 401 acknowledges that the repo exists, which isn’t great for security.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\
**Post date:** [June 18, 2018, 11:34am UTC](https://discuss.circleci.com/t/inconsistent-api-results/3990/4 "2018-06-18T11:34:09Z")

</div>