Test Data — entry 017 of 19
UUID Generator
UUIDTools is a free, keyless REST API for minting and inspecting UUIDs: GET endpoints generate v1 (timestamp-based), v4 (random), and namespace-derived v3/v5 UUIDs in bulk via a count parameter, plus a /decode route that extracts the version, variant, and embedded timestamp from any UUID string. Every response is a plain JSON array, requests are capped at 60 per minute per IP, and there is no signup or paid tier.
UUIDTools is a free, keyless REST API for minting and inspecting UUIDs: GET endpoints generate v1/v3/v4/v5 UUIDs in bulk via a count path segment, and a /decode route extracts the version, variant, and embedded byte content from any UUID string. A live probe this run confirmed the documented 60-requests-per-minute cap is still enforced (x-ratelimit-limit: 60 on every response) and that generation and decoding return two different shapes — a bare array versus a plain object.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/uuid-generator/"><img src="https://greatapis.com/badge/uuid-generator.svg" alt="Scored 74 on greatapis.com"></a>Auth quickstart
- No API key or signup required for any route. Every response carries
x-ratelimit-limit: 60withx-ratelimit-remainingcounting down live — confirmed this run across several consecutive calls — so the documented 60/minute-per-IP figure is still accurate; there's no separate quota or header to watch for auth.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Generate a single v4 UUID
GEThttps://www.uuidtools.com/api/generate/v4
["c9ac7763-bf82-44c1-b668-d163fcf1097f"]
Try it
Developer reference
https://www.uuidtools.com/api60 requests per minute, per an example error message in uuidtools.com/docs ("You may have exceeded the rate limit (60 requests per minute)")
- GET/generate/v4
- GET/generate/v4/count/{count}
- GET/decode/{uuid}
Gotchas & limits
- Every
/generate/*response is a bare JSON array, even for a single UUID — there's no wrapping object to unwrap, unlike/decode, which returns a plain object: a liveGET /decode/c9ac7763-bf82-44c1-b668-d163fcf1097fthis run returned{"encode":{"STR":"...","SIV":"..."},"decode":{"variant":"DCE 1.1, ISO/IEC 11578:1996","version":"4 (random data based)","contents":"..."}}. - The count is a path segment, not a query parameter, and it's capped at 100: a live
GET /generate/v4/count/999999this run returned HTTP 400 with{"errors":{"count":["The count must be between 1 and 100."]}}— request in batches of 100 or fewer. - A non-numeric count also 400s with a distinct message: a live
GET /generate/v4/count/abcthis run returned{"errors":{"count":["The count must be a number."]}}, still withaccess-control-allow-origin: *and the rate-limit headers present on the error response itself. - CORS is wide open unconditionally, unlike the docs host at the stored
url: a live GET against the real API host with noOriginheader at all still returnedaccess-control-allow-origin: *— confirmed with and without anOriginheader, so no proxy is ever required. - An
OPTIONSrequest against/generate/v4returns HTTP 200 with a plainallow: GET,HEADheader rather than theaccess-control-allow-methodsheader a strict CORS preflight would check — browsers accept this in practice since only simple GETs are ever made, but a stricter CORS client wouldn't find the header it's looking for.