---
title: "Get a random firearm"
method: GET
path: "/v1/firearms/random"
tags: ["Firearm Discovery"]
---

# Get a random firearm

`GET /v1/firearms/random`

## Request

- Base URL: `https://api.gunspec.io`
- URL: `https://api.gunspec.io/v1/firearms/random`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Returns one firearm at random, optionally constrained by category or country. Responses are sent with `Cache-Control: no-store` so every call is a fresh draw.

Available on every plan. Requires an API key; Explorer keys receive a reduced field set.

## Query parameters

- `category` string
- `country` string

## Response `200`

Get a random firearm

- object
  - `success` boolean, required: Always true on a successful response. Every error carries `false` and an `error` object instead.
  - `data` object, required: The response payload.
    - `id` string: Slug of the drawn firearm.
    - `name` string: Display name, as the maker writes it.
    - `manufacturer_id` string, nullable: Slug of the manufacturer. Null where the maker is unrecorded.
    - `category_id` string, nullable: Slug of the category the firearm belongs to.
    - `year_introduced` integer, nullable: Year the model was introduced.
    - `status` string, nullable: Production status, one of `in_production`, `discontinued`, `out_of_production`, `in_service`, `limited_production`, `prototype`. Discontinued records are kept deliberately: a rifle built in 2004 wears parts nobody sells today.
    - `country_of_origin` string, nullable: ISO 3166-1 alpha-2 code of the country of origin.
    - `action_type` string, nullable: Operating action as stored, underscored, e.g. `short_recoil`, `bolt_action`, `gas_operated`. The full vocabulary is `/v1/firearms/action-types`; a hyphenated value matches nothing.
    - `weight_empty_g` number, nullable: Unloaded weight in grams.
    - `barrel_length_mm` number, nullable: Barrel length in millimetres.

## Other responses

- `400`: Validation error
- `401`: Missing or invalid API key
- `403`: The credential is valid and the caller is not permitted. Three causes, none of which reissuing a key changes: the plan is below the endpoint's tier, the account is suspended, or the key is not attached to the thing being acted on, meaning a user account for `/v1/me` or a shop for `/v1/vendor`. Distinct from 401, which means the credential is missing, malformed or expired and a new one can work.
- `404`: Resource not found
- `429`: A limit was reached. `RATE_LIMITED` is the per-minute limit: wait `Retry-After` seconds (a minute) and retry. `DAILY_CAP_EXCEEDED` is the plan's daily limit, per key: nothing will be served until the counters return to zero at midnight UTC. `MONTHLY_CAP_EXCEEDED` is the plan's monthly allowance, for the whole account: nothing will be served until midnight UTC on the first of next month, or until the plan changes. For both, `Retry-After` is the seconds until then and `error.resetsAt` says when as an instant. Calls made after a refusal are refused too and do not spend the month, and a free key that keeps calling is paused, so stop at the first one and resume at the reset.
- `500`: Internal server error

---

[API](https://skmtc.dev/gunspec/apis/gunspec-io-api.md) · [All operations](https://skmtc.dev/gunspec/apis/gunspec-io-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gunspec/apis/gunspec-io-api/revisions/f2e974d8b05c?raw)