API reference
every endpoint, explained

Parameters, request examples and responses for every v3 resource, made from the OpenAPI spec.

Base URLhttps://gorest.co.in/public/v3

This is v3, the current version. The v2 reference or the Swagger UI.

My data

What your account holds, and a reset to empty or to your own copy of the sample data.

Endpoints

GET/public/v3/my-data POST/public/v3/my-data/reset

Your counts and caps

GET/public/v3/my-data

How many rows of each resource your account holds and the most it may hold, and whether your lists show your copy of the sample data. Needs a token with my-data:read.

curl "https://gorest.co.in/public/v3/my-data" \
  -H "Authorization: Bearer YOUR_TOKEN"

Response 200

{
  "sample_data_at": "2026-10-31T09:30:00Z",
  "resources": {
    "users": {
      "count": 3,
      "cap": 100
    },
    "posts": {
      "count": 3,
      "cap": 100
    },
    "tasks": {
      "count": 3,
      "cap": 100
    },
    "products": {
      "count": 3,
      "cap": 100
    },
    "carts": {
      "count": 3,
      "cap": 100
    },
    "cart_items": {
      "count": 3,
      "cap": 100
    },
    "orders": {
      "count": 3,
      "cap": 100
    },
    "order_items": {
      "count": 3,
      "cap": 100
    },
    "access_tokens": {
      "count": 3,
      "cap": 100
    }
  }
}

Reset your data

POST/public/v3/my-data/reset

Deletes every v3 row your account owns (users, posts, comments, tasks, products, carts and orders; your tokens stay) in one transaction. With {"sample_data": true} it then copies the sample data in as your own rows, with new ids, so you can change them; your lists show these copies instead of the sample data. This is the only way to free the order caps, as orders cannot be deleted. A reset while another reset of the account runs gets 409. Needs a token with my-data:write.

Parameters

Idempotency-Keyheader, stringoptional: A unique key (a UUID is fine) that makes a POST safe to retry for 24 hours. A retry with the same key, path and body gets the first answer again with Idempotent-Replayed: true and creates nothing; a retry while the first is still running gets 409 conflict with Retry-After: 1. The same key with another request gets 422 idempotency_key_mismatch. Only a 2xx answer is kept, so after an error the retry runs again. An answer over 64 KiB, or one that holds a new token's value, is not kept: its retry gets 409 conflict with the Location of what the first request made.
sample_databody, booleanoptional: Copy the sample data in as your own rows after the delete.

curl -X POST "https://gorest.co.in/public/v3/my-data/reset" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"sample_data":false}'

Response 200

{
  "sample_data_at": "2026-10-31T09:30:00Z",
  "resources": {
    "users": {
      "count": 3,
      "cap": 100
    },
    "posts": {
      "count": 3,
      "cap": 100
    },
    "tasks": {
      "count": 3,
      "cap": 100
    },
    "products": {
      "count": 3,
      "cap": 100
    },
    "carts": {
      "count": 3,
      "cap": 100
    },
    "cart_items": {
      "count": 3,
      "cap": 100
    },
    "orders": {
      "count": 3,
      "cap": 100
    },
    "order_items": {
      "count": 3,
      "cap": 100
    },
    "access_tokens": {
      "count": 3,
      "cap": 100
    }
  }
}

Authentication

Most reads need no token: you see the read only sample data. With a token you also see your own rows. Writes, and the access tokens, my data and change stream calls, need a token with the scope the call names, such as users:write. Make a token on the tokens page after you log in.

Authorization: Bearer YOUR_TOKEN: The only way to send a token in v3. A token never goes in the URL.

No token or a wrong one gives 401 with WWW-Authenticate. A token without the scope gives 403 with error="insufficient_scope". Sample rows (read_only: true) cannot be changed.

Make a token

Pagination

A list answers {"data": [...], "meta": {...}}, 25 items by default. Set page[size] from 1 to 100. For the next page send page[after] with meta.next_cursor; the same link is in the Link header.

meta.has_more: true when there is a next page.
meta.next_cursor: Send it as page[after] for the next page; null on the last one.
meta.total: Only with page[count]=true, or with page[number].
page[number]: Offset paging from 1 to 10,000, in place of page[after].
Link: rel="next", "prev", "first" and, for offset paging, "last" (RFC 8288).

Rate limits

Every answer carries the IETF rate limit fields. A token has its own limit, 300 calls a minute by default (1 to 600, set on the tokens page). With no token, an IP gets 120 calls a minute. Past the limit you get 429 with Retry-After.

RateLimit-Policy: The limit and its window, for example "token";q=300;w=60.
RateLimit: Calls left and the seconds until the window resets.
Retry-After: On a 429: the seconds to wait.

Errors and status codes

200 OK: The item or the list is in the body.
201 Created: The new item is in the body, and Location has its URL.
204 No Content: A delete worked. The body is empty.
304 Not Modified: Your copy (If-None-Match with the ETag) is still good.
400 Bad Request: A parameter is wrong, unknown or out of range.
401 Unauthorized: No token, or it is wrong, expired or revoked.
403 Forbidden: The token lacks the scope, or the row is sample data.
404 Not Found: No such item, or you cannot see it.
409 Conflict: A duplicate, or the same Idempotency-Key is busy.
412 Precondition Failed: If-Match did not match: someone changed the item.
422 Unprocessable: A field failed a check. errors has a pointer and a code for each.
429 Too Many Requests: The rate limit is used up; wait Retry-After seconds.
500 Server Error: A fault on our side. Send the request_id when you report it.

A 422 body 422Every error code

{
  "type": "https://www.gorest.co.in/docs/api/errors#validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Some fields are not valid.",
  "instance": "/public/v3/users",
  "request_id": "0190a8e4-0000-7000-8000-0000000000aa",
  "errors": [
    { "pointer": "/email", "code": "taken", "detail": "has already been taken" }
  ]
}

Format and testing

/http/status/503: Answers with that status, with the headers a real one carries. Any code from 200 to 599.
/http/delay/1500: Waits that many milliseconds, up to 10,000, then answers.
ETag and If-Match: Send If-Match on PATCH or DELETE so you never overwrite a newer change (412 if it changed).
Idempotency-Key: A header on POST that makes a retry safe: the same answer for 24 hours.
fields, include, sort: fields[users]=id,name returns fewer fields; include=user embeds the related item; sort=-created_at orders a list.

Want to try a call now? Open the REST console.

API referenceevery endpoint, explained