Skip to content
Go RESTLog in

REST API for testing and prototyping

Realistic data for users, posts, comments and todos. Bearer token auth, your own rate limit, JSON or XML. Spend your time on the app you are building, not on fake data.

Log in to get a tokenRead the docs
curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://gorest.co.in/public/v2/users

Skip the backend. Ship the frontend.

Free, no quota

Log in with Google, Microsoft or GitHub, make a token, and start.

Realistic data

Names, emails, posts and comments, seeded again every 3 hours. Relations work like a real app.

JSON or XML

Add the format to the path or set the Accept header.

You set the limit

Each token has its own rate limit. Pagination headers do the rest.

From zero to the first request in a minute

  1. 1

    Log in

    With Google, Microsoft or GitHub. We never see a password.

    Log in →
  2. 2

    Make a token

    Set its rate limit, and revoke it any time.

    Your tokens →
  3. 3

    Send requests

    Put the token in the Authorization header. Try things in the console first if you like.

    Open the console →

Endpoints

Every path is under https://gorest.co.in. Reads need no token. Writes need one.

Method Path What it does
GET /public/v2/users List users, with optional filters
GET /public/v2/users/{id} Fetch one user
POST /public/v2/users Create a user
PATCH /public/v2/users/{id} Update some fields of a user
PUT /public/v2/users/{id} Replace a user
DELETE /public/v2/users/{id} Delete a user
GET, POST /public/v2/users/{id}/posts Posts of a user
GET, POST /public/v2/posts/{id}/comments Comments on a post
GET, POST /public/v2/users/{id}/todos Todos of a user

The same paths work for /public/v2/posts, /public/v2/comments and /public/v2/todos. Any field is a filter, for example /public/v2/users?name=kumar. Page with page and per_page (at most 100).

What you get back

The body is the resource itself. Pagination is in the headers.

[
  {
    "id": 4521,
    "name": "Avani Iyer",
    "email": "avani.iyer@example.com",
    "gender": "female",
    "status": "active"
  },
  {
    "id": 4520,
    "name": "Pranav Kapoor",
    "email": "pranav.kapoor@example.com",
    "gender": "male",
    "status": "inactive"
  }
]

For XML, add .xml to the path or send Accept: application/xml.

Authentication

Send your token with every write, over HTTPS, in one of two ways:

  • Header: Authorization: Bearer YOUR_TOKEN
  • Query parameter: https://gorest.co.in/public/v2/users?access-token=YOUR_TOKEN

The header is the better choice: URLs end up in logs. Make a token on your tokens page. It is shown only once.

Warning: do not put real personal data here. This is a public sandbox.

Headers

Header Meaning
X-RateLimit-Limit Requests per minute allowed for this token
X-RateLimit-Remaining Requests left in the current window
X-RateLimit-Reset Seconds until the window resets
X-Pagination-Total Total matching results
X-Pagination-Pages Total pages
X-Pagination-Page Current page
X-Pagination-Limit Results per page
X-Links-Previous Full URL of the previous page; empty on page 1
X-Links-Current Full URL of this page
X-Links-Next Full URL of the next page; empty on the last page

Response codes

Code Meaning Common reason
200 OK GET worked; the resource is in the body.
201 Created POST made a new resource; the Location header points to it.
204 No Content DELETE worked; there is no body.
304 Not Modified Your cached copy is still fresh.
400 Bad Request The body or query string is malformed.
401 Unauthorized The token is missing, wrong or expired.
403 Forbidden The token cannot access this resource.
404 Not Found Nothing at this URL, or it belongs to another token.
405 Method Not Allowed The URL does not accept this HTTP method.
415 Unsupported Media Type Content-Type is not JSON or XML.
422 Unprocessable The JSON parsed but failed validation; the body lists the bad fields.
429 Too Many Requests The rate limit is used up; retry after X-RateLimit-Reset seconds.
500 Server Error Something broke on our side. Quote X-Request-Id when you report it.
503 Service Unavailable Down for maintenance or busy for a moment. Retry soon.

Questions

Is it really free? Yes. No card and no paid tier. The data is reset often, so do not store anything you need.

What gets reset? All records are wiped and seeded again every 3 hours, so the API always has fresh data.

Can other people see my data? No. Records you create or change are visible only to your token. The seeded data is shared.

JSON or XML? Either. Add .json or .xml to any path, or set the Accept header.

What is the rate limit? 300 requests a minute per token by default. You can set it per token from 1 to 600.

Can I test loading states and error handlers? Yes. Add ?delay=1500 to a GET to wait up to 5 seconds, or ?force_status=500 to get that error. Allowed codes are 400, 401, 403, 404, 405, 415, 422, 429, 500 and 503. The answer carries an X-Simulated-Delay-Ms or X-Simulated-Status header. See the recipes for examples.

Can I call it from the browser? Yes. CORS is open. Keep your token out of code you ship to users.

How do I report a bug? Ask in Q&A, or write to the address on the about page.