News — entry 014 of 17
The Guardian
The Guardian's Open Platform serves the publication's own articles, tags, and section metadata across more than 1.9 million pieces of content, with a free Developer key limited to 1 call/second and 500 calls/day for non-commercial projects. A separate Commercial key removes those caps for a usage-based fee and adds images, audio, and video. Requests are authenticated with an API key and return JSON by default, with an XML format option available.
The Guardian's Open Platform serves the publication's own articles, tags, and section metadata as JSON, authenticated by a single api-key query parameter. It normally requires a free Developer key from a registration form, but The Guardian also runs a shared, documented test key, the literal string test, for evaluating the API before signing up. A live GET this run against /search with api-key=test returned genuine, current article JSON.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/the-guardian/"><img src="https://greatapis.com/badge/the-guardian.svg" alt="Scored 67 on greatapis.com"></a>Auth quickstart
- Pass
api-key=testas a query parameter to try the API with no signup at all — a live GET this run against/search?api-key=test&page-size=1returnedHTTP 200with real, current article data and"userTier":"developer"in the response body. - The shared test key is rate-limited but not scoped to you — a live GET this run against it showed
x-ratelimit-limit-day: 50000andratelimit-limit: 720(per-minute) shared across every caller usingtest, so it can throttle unpredictably if traffic elsewhere spikes; do not ship it in a production app. - For real use, register at open-platform.theguardian.com for a free Developer key (1 call/second, 500 calls/day, non-commercial use only) or a paid Commercial key (higher limits, adds images/audio/video fields) and swap it in for
testin the sameapi-keyparameter. - A missing or invalid key fails closed — a live GET this run against
/search?api-key=bogus123&page-size=1returnedHTTP 401with body{"message":"Unauthorized"}and awww-authenticate: Keyheader, not a degraded/anonymous response.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Search articles with the shared test key
GEThttps://content.guardianapis.com/search?api-key=test&page-size=1
{"response":{"status":"ok","userTier":"developer","total":2684259,"startIndex":1,"pageSize":1,"currentPage":1,"pages":2684259,"orderBy":"newest","results":[{"id":"uk-news/2026/aug/08/navy-says-it-is-spending-25-more-time-monitoring-russian-vessels-around-uk-waters","type":"article","sectionId":"uk-news","sectionName":"UK news","webPublicationDate":"2026-08-08T20:03:34Z","webTitle":"Navy says it is spending 25% more time monitoring Russian vessels around UK waters","webUrl":"https://www.theguardian.com/uk-news/2026/aug/08/navy-says-it-is-spending-25-more-time-monitoring-russian-vessels-around-uk-waters","apiUrl":"https://content.guardianapis.com/uk-news/2026/aug/08/navy-says-it-is-spending-25-more-time-monitoring-russian-vessels-around-uk-waters","isHosted":false,"pillarId":"pillar/news","pillarName":"News"}]}}total/pages count The Guardian's entire archive (2.68M articles at capture time), not this query — /search with no q parameter returns the newest articles across all sections, newest first by default. Add q=<term> to filter, and show-fields=headline,body to pull article text into the same response instead of following apiUrl.
Developer reference
Gotchas & limits
- The response is double-wrapped — every field lives under
response, soresultsis atresponse.results, not the top level, unlike most REST search APIs. - The test key's rate-limit numbers looked higher than a personal free key's documented 500/day in this run's headers (
x-ratelimit-limit-day: 50000, shared across everyone usingtest) — that generosity is a side effect of it being a shared pool, not a guarantee; a personal Developer key's per-caller 500/day, 1/sec limits are what to design against for anything beyond quick testing. fields(headline, body, thumbnail, etc.) are opt-in viashow-fields=<comma-separated list>and cost nothing extra against the rate limit, but omitting them meansresultsonly carries id/URL/section metadata — no article text at all.- CORS is a bare wildcard on this endpoint — a live GET this run returned
access-control-allow-origin: *withaccess-control-allow-credentials: true, so browser-side JavaScript can call it directly, though the key still appears in the URL for anyone inspecting network traffic. - An invalid
api-keyisHTTP 401with a JSON body, but the failure mode is silent for typos that still resemble a real key shape — always checkresponse.statusin a 200 rather than assuming any 200 means the query matched what was intended.