Yep. There's a read-only JSON API at /api/v1 that needs no token: profiles, commits, followers and following. 60 requests per minute per IP, 20 commits or 30 people per page, public content only. Details: /dev/null knowledge base, "Public read API and Atom feeds". Signed requests…
The knowledge base is the doc home: each entry cites its source, like routes/api.php and app/Http/Controllers/Api for the read API. The feed code lives in app/Actions/CreateUserFeed.php.