Art & Design — entry 015 of 20

Metropolitan Museum of Art

Verified Jul 2026

The Met's Collection API exposes all 502,000+ objects in its Open Access collection — the same data behind its own site — fully keyless and free, asking only that callers self-throttle to 80 requests per second. A live GET against the real gateway, collectionapi.metmuseum.org, returned genuine object data carrying Access-Control-Allow-Origin: *, correcting cors no -> yes while reconfirming auth None.

The Met's Collection API exposes all 502,000+ objects in its Open Access collection, fully keyless and free. It's deliberately two-step: GET /search never returns object data, only a bare array of matching IDs, so every real lookup is a search followed by one GET /objects/{objectID} fetch per result you actually want. A live GET this run against /search?q=sunflowers returned 98 matching IDs; a follow-up GET /objects/{objectID} on one of them returned the full record.

museumopen-accessartcc0
AuthenticationNone requiredCall it straight away — no key, no signup.
HTTPSSupportedTraffic is encrypted in transit.
CORSEnabledCallable directly from browser JavaScript.
PricingFreeNo paid tier — free for the documented use case.
FormatsJSONResponses can be requested as JSON.

GreatAPIs Score

Score74out of 100
Authentication25/25No authentication required
Pricing20/20Free to use
Docs0/20No docs or spec available
Formats9/15Single response format
Freshness20/20Verified within 6 months

Embed this badge

Scored 74 on greatapis.com
<a href="https://greatapis.com/api/metropolitan-museum-of-art/"><img src="https://greatapis.com/badge/metropolitan-museum-of-art.svg" alt="Scored 74 on greatapis.com"></a>

Auth quickstart

  1. No API key, signup, or credit card required. A live GET this run against a real object record returned genuine data, and an Origin-header probe against the real gateway returned access-control-allow-origin: *. There is no token to obtain, but the rate limit is published rather than absent: the Met's own docs state "we do not require API users to register or obtain an API key to use the service. Please limit request rate to 80 requests per second" — self-throttling guidance, not an enforced quota with headers to read.
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.

Search for objects, then fetch one full record

GEThttps://collectionapi.metmuseum.org/public/collection/v1/search?q=sunflowers

200 application/json

{"total":98,"objectIDs":[436524,484935,437112,431264,397949,656530,480725,486590,485308,375281,"88 more IDs, same shape"]}

The search response carries no titles, images, or artist names — only IDs. A live follow-up GET /objects/436524 this run returned the actual object record (title, artist, images, dates); the search step alone is never enough to render a result.

Try it

Developer reference

Base URLhttps://collectionapi.metmuseum.org/public/collection/v1
Rate limit

80 requests/second (self-throttling guidance, not an enforced quota)

Key endpoints
  • GET/objects/{objectID}
  • GET/search?q={query}
  • GET/departments

Gotchas & limits

  • A no-match search returns null, not [], for objectIDs — a live GET this run against /search?q=zzzzznomatchxyz123 returned {"total":0,"objectIDs":null}. Code that calls .length or .map() on objectIDs unconditionally will throw on a genuinely empty result, not just skip a loop.
  • GET /objects (no filter) doesn't paginate — a live GET this run confirmed it returns all ~502,000+ object IDs in one multi-megabyte response with no limit/offset params to shrink it. Always filter through /search or /objects?departmentIds= first.
  • A nonexistent object ID 404s with a minimal, non-standard body — a live GET this run against /objects/999999999 returned HTTP 404 {"message":"ObjectID not found"}, a different shape from the search endpoint's error-free null.
  • CORS is not advertised on a plain request — a live GET this run with no Origin header returned no access-control-allow-origin header at all, while the identical request with Origin: https://example.com set returned access-control-allow-origin: *. Code that checks for the header on a bare curl probe will wrongly conclude CORS is closed.

Changelog

  • Jul 2026gained rate limits

See every tracked change ↗ ·Subscribe with RSS ↗