Endpoint reference
POST /api/rotate
Rotate every page of a PDF, or only chosen pages. The turn is added to each page's current rotation. Returns the rotated PDF as application/pdf, with the same pages in the same order.
Request
Method: POST. URL: https://pdfops.dev/api/rotate. Body: multipart/form-data.
| Field | Type | Required | Description |
|---|---|---|---|
pdf | File (PDF binary) | Yes | The PDF to work on, up to 4 MB and 2,000 pages. The whole request must stay under 4.5 MB, Vercel's platform request limit. |
degrees | String | Yes | One of 90, 180, 270 or -90. |
pages | String | No | Page list such as 1-3,5 (see Page lists). Default: all pages. |
password | String | No | Opens a PDF that needs a user password. Not needed for owner-locked files with an empty user password. |
The optional X-API-Key header works as on /api/merge: no header is anonymous, 100 requests per IP per month; a valid key uses your tier's quota; an invalid or revoked key returns 401 invalid_api_key. A successful (2xx) call counts 1 request. Check consumption with GET /api/usage.
Page lists
The pages value is a comma list of items: N (one page), A-B (an inclusive range) or A- (page A through the last page). Pages are 1-based. Spaces around items and around the dash are ignored. last and negative numbers are not supported. A page past the end of the PDF, a reversed range, an empty item or an empty value fails with invalid_pages.
Response
On success: 200 OK, Content-Type: application/pdf, body is the rotated PDF.
On any failure: 4xx or 500, Content-Type: application/json, body is { "error": "<code>", "details": "<explanation>" }.
Error codes
| Error code | Status | Trigger |
|---|---|---|
invalid_multipart | 400 | Request body could not be parsed as multipart/form-data. |
missing_pdf | 400 | The request does not have exactly one pdf file field. |
pdf_too_large | 400 | The pdf file is over 4 MB. |
invalid_pdf | 400 | The PDF could not be parsed (corrupt, or not a PDF). |
encrypted_pdf | 400 | The PDF needs a password we were not given. Owner-locked files with an empty user password (most government blanks) open on their own; for a real user password send it as the password form field. |
decompressed_too_large | 400 | Object streams inside the PDF decompress to over 32 MB. |
too_many_pages | 400 | The PDF has over 2,000 pages. |
invalid_degrees | 400 | degrees is missing or not one of 90, 180, 270, -90. |
invalid_pages | 400 | pages is empty, malformed or out of range. details says which item failed. Pages listed more than once count once. |
save_failed | 500 | PDF serialization failed. Retryable. |
request_too_large | 413 | The whole request body is over 4.5 MB (Vercel's platform request limit). Rejected before anything is parsed. |
invalid_api_key | 401 | An X-API-Key header was sent but the key is unknown or revoked. No fallback to the anonymous IP cap. Get a fresh key at /pricing. |
rate_limited (anonymous) | 429 | No X-API-Key header and the per-IP limit (100/month) is exhausted. Retry-After gives seconds until next calendar month. |
rate_limited (keyed) | 429 | Your key's tier quota (Free 250 / Indie 4,000 / Pro 25,000 per month) is exhausted. Retry-After gives seconds until next calendar month. |
Example
curl -X POST https://pdfops.dev/api/rotate \
-F "pdf=@scan.pdf" \
-F "degrees=90" \
-F "pages=2-3" \
-o rotated.pdf \
-H "X-API-Key: pdfops_live_..." # optional, raises your quota to your tier
Keyless calls work: 100 requests per IP per month with no key.
Using this for real? A free API key raises the keyless 100 calls per IP to 250 requests a month, with no card.
Code examples
Have an API key? Add an X-API-Key header to any request. It is optional, and it raises your quota from 100/IP/month to your tier's.
JavaScript (Node.js 22+) — built-in fetch + FormData
import { readFile, writeFile } from 'node:fs/promises';
const fd = new FormData();
fd.append('pdf', new Blob([await readFile('scan.pdf')], { type: 'application/pdf' }), 'scan.pdf');
fd.append('degrees', '90');
fd.append('pages', '2-3'); // omit to rotate every page
const res = await fetch('https://pdfops.dev/api/rotate', {
method: 'POST',
headers: { 'X-API-Key': process.env.PDFOPS_API_KEY }, // optional
body: fd,
});
if (!res.ok) {
const err = await res.json();
throw new Error(`PDFops rotate failed: ${err.error}: ${err.details}`);
}
await writeFile('rotated.pdf', Buffer.from(await res.arrayBuffer()));
Behavioral notes
- The turn is added to the page's existing rotation and the result is normalized to 0 to 359. A page already at 90 degrees, rotated by 270, ends at 0.
- A page listed twice is rotated once.
- The output is deterministic. Dates are set to the Unix epoch and the producer to
pdfops.dev. - Limits: 4 MB per PDF, 2,000 pages, 4.5 MB per request (Vercel's platform limit).
FAQ
Does rotating twice cancel out?
Rotations add up. Call it with degrees=90 and then again with degrees=-90 and the pages are back where they started.
Can I rotate only the scanned pages?
Yes. Send pages, for example pages=4-6. Pages you do not list are left alone.
Related: Extract or reorder pages · Delete pages · Stamp page numbers.
Get a free API key. Keyless calls get 100 requests per IP per month; a free key raises that to 250, with no card. Enter your email and the key arrives in your inbox.