Back to the BIM & IFC blog
Digital twins · 2026-10-16 · 7 min
Which City Open Data Can a Web Page Read? 28 Feeds in 20 Cities, Tested
A digital twin that runs in the browser can only use data a web page is allowed to read. We requested 28 public feeds in 20 cities exactly as a browser would and recorded which ones answer. 25 do. Here is the list, what blocks the other three, and the data to download.
Barcelona from above in IFC Viewer Online with its open data on the map: Bicing stations, charging points, traffic on the streets and air quality, around the IFC models of Plaça de Catalunya
A digital twin that runs in the visitor's browser, with no server of its own, can only use data that a web page is allowed to read. That permission is not about licences or keys: it is a response header, CORS[cors], that the publisher's server sends or does not send. Without it, the data is public and still out of reach of a page.
So we tested. Twenty-eight public endpoints in twenty cities — bike share, real-time transit, city open-data portals, weather, a 3D city model — each requested once, exactly as a browser would, with the result recorded.
Key takeaways
- 25 of the 28 endpoints can be read straight from a web page.
- Bike share is the most open: 9 of the 10 GBFS feeds tested answer with CORS.
- The three blocked: Paris Vélib', HSL's GTFS-Realtime feed in Helsinki and the Wiener Linien real-time monitor in Vienna.
- Blocked is not the end: HSL publishes the same bus positions over MQTT, which a browser can read.
The result per city: green where a web page can read the feed, red where only a server can.
How we tested
Each endpoint got one GET request carrying an Origin header, as a page on this site would send, on 15 October 2026. "Readable" means the response came back with an Access-Control-Allow-Origin header that lets that page read it. The full list, with status codes and content types, is available as CSV[csv].
Bike share: the open standard works
Nine of the ten bike-share systems tested publish GBFS[gbfs] with CORS: Barcelona, Berlin, Oslo, New York, Chicago, San Francisco, Toronto, Montreal and Mexico City. Paris Vélib' publishes the same standard without the header. A shared format with permissive defaults is what makes the difference: once one city works, the next one does too.
Transit: the mixed picture
London's TfL API, Boston's MBTA, New York's subway GTFS-Realtime and both of Tokyo's ODPT feeds answer with CORS. HSL's GTFS-Realtime and Vienna's real-time monitor do not. HSL shows the way around it: the same vehicle positions are published over MQTT on a WebSocket, which is not subject to CORS — the Helsinki twin uses exactly that, as the bus terminal twin over MQTT explains.
City portals: mostly open
The portals built on common platforms — Opendatasoft in Paris and Melbourne, Socrata in New York, CKAN in Barcelona and Zurich — answered with CORS, as did Spain's national catalogue, Madrid's traffic sensors, Finland's weather service, Singapore's real-time API and Helsinki's 3D city model.
All 28 endpoints
| City | Source | Kind | From a web page |
|---|
| Barcelona | Bicing (GBFS 3.0) | Bike share | Readable |
| Barcelona | Open Data BCN resource (Endolla) | City data | Readable |
| Barcelona | Open Data BCN CKAN API | City data | Readable |
| Madrid | Informo traffic sensors (XML) | City data | Readable |
| Spain | datos.gob.es API | City data | Readable |
| Paris | Vélib' Métropole (GBFS) | Bike share | Blocked |
| Paris | opendata.paris.fr (Opendatasoft) | City data | Readable |
| London | TfL Unified API (BikePoint) | Transit | Readable |
| Oslo | Oslo Bysykkel (GBFS) | Bike share | Readable |
| Helsinki | HSL GTFS-Realtime | Transit | Blocked |
| Helsinki | FMI open data (WFS) | City data | Readable |
| Helsinki | Helsinki 3D (3D Tiles) | City data | Readable |
| Vienna | Wiener Linien real-time monitor | Transit | Blocked |
| Berlin | nextbike Berlin (GBFS) | Bike share | Readable |
| Zurich | Open Data Zürich (CKAN) | City data | Readable |
| Tokyo | ODPT public API (Toei trains) | Transit | Readable |
| Tokyo | ODPT Toei bus (GTFS-Realtime) | Transit | Readable |
| Singapore | data.gov.sg real-time API | City data | Readable |
| New York | Citi Bike (GBFS) | Bike share | Readable |
| New York | NYC Open Data (Socrata) | City data | Readable |
| New York | MTA subway (GTFS-Realtime) | Transit | Readable |
| Boston | MBTA V3 API | Transit | Readable |
| Chicago | Divvy (GBFS) | Bike share | Readable |
| San Francisco | Bay Wheels (GBFS) | Bike share | Readable |
| Toronto | Bike Share Toronto (GBFS) | Bike share | Readable |
| Montreal | BIXI (GBFS) | Bike share | Readable |
| Mexico City | Ecobici (GBFS) | Bike share | Readable |
| Melbourne | City of Melbourne (Opendatasoft) | City data | Readable |
Tested 15 October 2026. The CSV adds each response's status, CORS header and content type.When a feed is blocked
- Look for another channel. Publishers often offer the same data more than one way; HSL's MQTT stream is the example here.
- Ask the publisher. Adding the header is a one-line change on their side, and open-data teams often do it when asked.
- Put a server in between, knowing what that means: it fetches every request for your visitors, sees them all, and becomes something you have to run.
- Never put an API key in a public page to get around it: anything a page sends, a visitor can read.
How the live examples on this blog read their feeds, and where each one comes from, is in what an urban digital twin is and the Barcelona open-data twin.
Which City Open Data Can a Web Page Read? 28 Feeds in 20 Cities, Tested