diff --git a/API.md b/API.md
new file mode 100644
index 0000000..fd2e500
--- /dev/null
+++ b/API.md
@@ -0,0 +1,191 @@
+# API Endpoints
+
+A report of every REST API endpoint found in the JavaScript source files, listing where each call is made and what parameters it uses.
+
+---
+
+## `/api/1.0/most-common-problems/`
+
+- **File:** `src/errors/static/js/most_common_problems.js` (line 329)
+- **Called by:** `DataSource.IO` source used by the problems data table, loaded via `interval_changed()`
+- **Method:** GET
+- **Parameters (query string, all optional):**
+  - `format` – response format (always `json`)
+  - `release` – Ubuntu release codename
+  - `rootfs_build_version` – rootfs build version filter
+  - `channel_name` – system-image channel name
+  - `device_name` – device name
+  - `device_image_version` – device image version
+  - `package` – binary package name
+  - `snap` – whether the package is a snap (`True`)
+  - `packageset` – package set name
+  - `user` – Launchpad username (subscriber filter)
+  - `period` – time period (e.g. `day`, `week`, `month`)
+  - `from` – start date for a custom date range
+  - `to` – end date for a custom date range
+  - `version` – specific package version (URL-encoded)
+  - `pkg_arch` – package architecture
+
+---
+
+## `/api/1.0/create-bug-report/`
+
+- **Files:**
+  - `src/errors/static/js/most_common_problems.js` (line 48)
+  - `src/errors/templates/bucket.html` (line 203)
+- **Called by:** `createBug()` function
+- **Method:** POST
+- **Parameters:**
+  - `format=json` (query string)
+  - Request body (JSON): `{"signature": "<url-encoded signature>"}`
+- **Headers:** `Content-Type: application/json`, `X-CSRFToken: <token>`
+
+---
+
+## `/api/1.0/package-version-is-most-recent/`
+
+- **File:** `src/errors/static/js/most_common_problems.js` (line 78)
+- **Called by:** `getPackagesState()`
+- **Method:** POST (queued via `Y.io.queue`)
+- **Parameters:**
+  - `format=json` (query string)
+  - Request body (JSON): `{"packages": [...], "release": "<release>"}` (release is optional)
+- **Headers:** `Content-Type: application/json`
+
+---
+
+## `/api/1.0/release-package-version-pockets/`
+
+- **File:** `src/errors/static/js/most_common_problems.js` (line 102)
+- **Called by:** `getPackagesPockets()`
+- **Method:** POST (queued via `Y.io.queue`)
+- **Parameters:**
+  - `format=json` (query string)
+  - Request body (JSON): `{"packages_data": [...]}`
+- **Headers:** `Content-Type: application/json`
+
+---
+
+## `/api/1.0/reports-state/`
+
+- **File:** `src/errors/static/js/most_common_problems.js` (line 130)
+- **Called by:** `getReportsState()`
+- **Method:** POST (queued via `Y.io.queue`)
+- **Parameters:**
+  - `format=json` (query string)
+  - Request body (JSON): `{"reports": [...], "release": "<release>"}` (release is optional)
+- **Headers:** `Content-Type: application/json`
+
+---
+
+## `/api/1.0/binary-package-versions/`
+
+- **File:** `src/errors/static/js/most_common_problems.js` (line 789)
+- **Called by:** `package_changed()`
+- **Method:** GET
+- **Parameters (query string):**
+  - `format=json`
+  - `binary_package` – binary package name (required)
+  - `release` – Ubuntu release codename (optional)
+
+---
+
+## `/api/1.0/system-image-versions/`
+
+- **File:** `src/errors/static/js/most_common_problems.js` (line 812)
+- **Called by:** `populate_image_versions()`
+- **Method:** GET
+- **Parameters (query string):**
+  - `format=json`
+  - `image_type` – the type of system image (required)
+
+---
+
+## `/api/1.0/average-crashes/`
+
+- **File:** `src/errors/static/js/mean_time_between_failures.js` (lines 275 and 282)
+- **Called by:** `mean_time_between_failures_changed()` and `mean_time_between_failures_graph()`
+- **Method:** GET (data fetched via `d3.json()`)
+- **Parameters (query string):**
+  - `limit=0`
+  - `release` – Ubuntu release codename (optional)
+  - `package` – binary package name (optional)
+  - `version` – specific package version (optional)
+
+---
+
+## `/api/1.0/average-instances/`
+
+- **File:** `src/errors/templates/bucket.html` (line 67)
+- **Called by:** inline script on the bucket detail page, passed to `mean_time_between_failures_request()`
+- **Method:** GET (data fetched via `d3.json()`)
+- **Parameters (query string):**
+  - `limit=0`
+  - `id` – bucket identifier (required)
+
+---
+
+## `/api/1.0/versions`
+
+- **File:** `src/errors/templates/bucket.html` (line 127)
+- **Called by:** `DataSource.IO` source for the versions table on the bucket page
+- **Method:** GET
+- **Parameters (query string, appended by datasource load):**
+  - `limit=0`
+  - `id` – bucket identifier (required)
+
+---
+
+## `/api/1.0/instances`
+
+- **File:** `src/errors/templates/bucket.html` (line 216)
+- **Called by:** `DataSource.IO` source for the examples/instances table on the bucket page
+- **Method:** GET
+- **Parameters (query string, appended by datasource load):**
+  - `limit` – number of results (e.g. `100`)
+  - `id` – bucket identifier (required)
+  - `start` – incident ID for pagination (optional, used for infinite scroll)
+
+---
+
+## `/api/1.0/reports-for-system`
+
+- **File:** `src/errors/templates/user.html` (line 23)
+- **Called by:** `DataSource.Get` source for the user's crash reports table
+- **Method:** GET
+- **Parameters (query string, appended by datasource load):**
+  - `limit` – number of results (e.g. `50`)
+  - `system` – system identifier (required)
+
+---
+
+## `/api/1.0/retracers-average-processing-time/`
+
+- **File:** `src/errors/static/js/retracers.js` (line 67)
+- **Called by:** `retracers_graph()`
+- **Method:** GET (via `Y.io`)
+- **Parameters (query string):**
+  - `limit=32767`
+  - `format=json`
+
+---
+
+## `/api/1.0/retracers-results/`
+
+- **File:** `src/errors/static/js/retracers.js` (line 95)
+- **Called by:** `retracers_results_graph()`
+- **Method:** GET (via `Y.io`)
+- **Parameters (query string):**
+  - `limit=32767`
+  - `format=json`
+
+---
+
+## `/api/1.0/instances-count/`
+
+- **File:** `src/errors/static/js/retracers.js` (line 122)
+- **Called by:** `instances_graph()`
+- **Method:** GET (via `Y.io`)
+- **Parameters (query string):**
+  - `limit=365`
+  - `format=json`
diff --git a/src/errortracker/config.py b/src/errortracker/config.py
index e6c89f9..c9a3fcc 100644
--- a/src/errortracker/config.py
+++ b/src/errortracker/config.py
@@ -57,6 +57,9 @@
 # Allow the Django app to fill bugs
 allow_bug_filing = True
 
+# API keys for the instance API endpoint
+api_keys = []
+
 # Some variable still used by the launchpad.py module
 lp_oauth_token = "todofixme"
 lp_oauth_secret = "todofixme"
diff --git a/src/errortracker/launchpad.py b/src/errortracker/launchpad.py
index b2beb2c..d126256 100644
--- a/src/errortracker/launchpad.py
+++ b/src/errortracker/launchpad.py
@@ -19,7 +19,7 @@
 ):
     raise ImportError("You must set lp_oauth_token and lp_oauth_secret in local_config")
 
-if config.lp_use_staging == "True":
+if config.lp_use_staging:
     _create_bug_url = "https://api.qastaging.launchpad.net/devel/bugs"
     _ubuntu_target = "https://api.qastaging.launchpad.net/devel/ubuntu"
     _oauth_realm = "https://api.qastaging.launchpad.net"
@@ -491,7 +491,9 @@ def is_valid_source_version(src_package, version):
         urllib.parse.quote_plus(version),
     )
     json_data = json_request(url)
-    if "total_size" not in list(json_data.keys()):
+    if not isinstance(json_data, dict):
+        return False
+    if "total_size" not in json_data:
         return False
     if json_data["total_size"] == 0:
         return False
@@ -626,7 +628,7 @@ def create_bug(signature, source="", releases=[], hashed=None, lastseen=""):
     response.read()
     try:
         number = response.headers["Location"].rsplit("/", 1)[1]
-        if config.lp_use_staging == "True":
+        if config.lp_use_staging:
             return (number, "https://qastaging.launchpad.net/bugs/" + number)
         else:
             return (number, "https://bugs.launchpad.net/bugs/" + number)