There is a whitelist, stored in the configuration variable $wgCrossSiteAJAXdomains in CommonSettings.php. This file can be viewed at [1], or in revision control at [2].

You can query anonymously using JSONP (e.g. [3]), or by querying from your own server rather than from a webpage. If you are going to be querying from a webpage, do review the API Etiquette page.[4]



 [1]: https://noc.wikimedia.org/conf/highlight.php?file=CommonSettings.php
 [2]: https://git.wikimedia.org/blob/operations%2Fmediawiki-config.git/master/wmf-config%2FCommonSettings.php

 [3]: https://et.wikipedia.org/w/api.php?action=query&list=recentchanges&format=jsonfm&callback=foobar
 [4]: https://www.mediawiki.org/wiki/API:Etiquette