ISO 8601 API Developer Guide: REST, GraphQL, and JSON

A developer's guide to using ISO 8601 in APIs. Discover best practices for REST, GraphQL, and JSON, including backend system integration and validation examples.

Executive Summary
When building modern APIs, standardizing how dates and times are communicated is critical. ISO 8601 is the de facto standard for REST, GraphQL, and JSON payloads. If you need to debug API payloads, use our ISO Converter.


Why ISO 8601 is the API Standard

Before ISO 8601 became universally adopted, APIs often used custom string formats or Unix Timestamps. While Unix timestamps are efficient, they lack human readability, which hampers the Developer Experience (DX) when debugging JSON payloads.



Using ISO 8601 in REST APIs

In RESTful design, resources should expose dates as ISO 8601 strings (specifically following the RFC 3339 profile). This ensures that standard parsers across Java, Python, Go, and JavaScript can natively deserialize the data.

When using query parameters (e.g., ?start_date=2026-06-04T12:00:00+05:30), remember to URL-encode the plus sign to %2B to avoid it being interpreted as a space.



GraphQL and Custom Date Scalars

GraphQL's type system does not include a native Date type. Developers must define a custom scalar, commonly named DateTime, which maps to an ISO 8601 string in the JSON response.

scalar DateTime

type User {
  id: ID!
  createdAt: DateTime!
}


JSON Data Serialization

JSON natively supports strings, numbers, booleans, arrays, and objects, but not dates. Therefore, calling JSON.stringify() on a JavaScript Date object automatically invokes the toISOString() method, outputting a standard ISO 8601 string.



Backend Systems Integration

Regardless of what timezone the server runs in, APIs should always communicate in UTC. Ensure your backend ORMs (like Prisma, Hibernate, or Entity Framework) are configured to store times in UTC and emit them with the 'Z' suffix.



Validation Examples

Validating incoming payloads is critical to prevent database errors. You can use regex or schema validation libraries (like Zod or Joi) to ensure clients are sending valid ISO strings.

import { z } from "zod";

const UserSchema = z.object({
  name: z.string(),
  birthDate: z.string().datetime() // Validates ISO 8601 (RFC 3339)
});


Frequently Asked Questions

Why should my API use ISO 8601?

It provides a clear, universally understood string format that includes timezone data and avoids regional ambiguities.

What is RFC 3339 in APIs?

RFC 3339 is a strict profile of ISO 8601 favored by Internet protocols. It requires a 4-digit year, full date, and full time with an explicit timezone.

Should APIs return dates in local time or UTC?

APIs should almost always return dates in UTC (indicated by the 'Z' suffix) and let the frontend client convert it to the user's local time.

How do I validate an ISO 8601 string in Node.js?

You can use a regex or a library like date-fns (e.g., `parseISO`) or moment.js.

Does GraphQL have a built-in Date type?

No, GraphQL only has String, Int, Float, Boolean, and ID. You must define a custom scalar (e.g., `scalar DateTime`) to handle ISO 8601 strings.

How do I serialize a Date object to JSON?

In JavaScript, calling `JSON.stringify()` on an object containing a Date automatically calls the Date's `.toISOString()` method.

Should I accept Unix timestamps instead?

It depends. Unix timestamps are better for low-level performance, but ISO 8601 is vastly superior for debuggability and Developer Experience (DX).

What if the client sends an invalid ISO string?

Your API should return an HTTP 400 Bad Request error with a clear message explaining the required format.

Can I use ISO 8601 for URL query parameters?

Yes, but you must URL-encode it. For example, the '+' in `+05:30` must be encoded as `%2B`, or it will be interpreted as a space.

How do databases store the ISO 8601 string?

Most databases parse the string and store it internally as a numeric timestamp (like UTC epoch), then format it back when queried.

What is the correct HTTP header for dates?

Standard HTTP headers like `Date` or `Last-Modified` use RFC 1123 format (e.g., `Wed, 21 Oct 2015 07:28:00 GMT`), not ISO 8601.

How do I parse ISO 8601 in Go?

Use `time.Parse(time.RFC3339, myString)`.

How do I parse ISO 8601 in Python?

Use `datetime.fromisoformat('2026-06-04T12:00:00+00:00')`.

Is it safe to rely on JavaScript's Date.parse()?

Modern environments support it reliably for ISO 8601, but older browsers had inconsistencies. It's safe on modern backends (Node/Deno).

Can ISO 8601 contain timezone names like 'EST'?

No. It only supports numeric offsets (like -05:00) or 'Z'.

Why is my API stripping milliseconds?

Some JSON serializers or ORMs truncate milliseconds by default. Check your backend configuration.

Does OpenAPI (Swagger) support ISO 8601?

Yes, use `type: string` with `format: date-time`.

Should I include microseconds in API responses?

Only if your domain requires it (e.g., high-frequency trading). For most apps, milliseconds are sufficient.

How do I handle recurring events in an API?

You can use ISO 8601 recurring intervals (starting with 'R'), or handle the logic with standard cron expressions alongside standard datetimes.

Where can I test converting these strings?

Use our ISO 8601 Converter tool to validate and convert strings instantly.