Here is how they differ from a developer's side, how to fetch both as JSON, and the mistake that cost us a day.

The short version

If you only need "what ITC do I have for April", fetch 2B. If you need "what has this supplier filed so far", or the TDS or TCS entries, fetch 2A.

GSTR-2A: twelve tables, not one document

The network serves 2A as 12 tables: b2b, b2ba (amended), cdn (credit and debit notes), cdna, impg (import of goods), impgsez, tcs, tds, amdhist (bill-of-entry amendment history), ecom, ecoma and isd.

A full 2A for one GSTIN and one period is therefore up to 12 calls. TDS and TCS are not separate endpoints: they are two values of the table field.

curl -X POST "https://www.gstinapi.in/v1/gstr2a/fetch" \
  -H "x-api-key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{ "table": "b2b", "gstin": "27ABCDE1234F1Z5", "ret_period": "042026" }'

ret_period is MMYYYY. Most tables also take ctin (one supplier's GSTIN) as a filter. amdhist is the odd one: it also needs portcode, benumber and bedate.

Empty is normal

Most GSTINs have nothing in several tables every month: no TCS, no ISD credit, no imports. The network answers those with "No document found for the provided Inputs" (error code RET13509). Through the API used here that comes back as a 400 with that error_code, and it is not charged. It means "this table is empty", not that the call failed, so map it to an empty result in your code. If you treat it as a hard failure, you will page yourself every month-end.

GSTR-2B: one statement

curl -X POST "https://www.gstinapi.in/v1/gstr2b/fetch" \
  -H "x-api-key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{ "gstin": "27ABCDE1234F1Z5", "ret_period": "042026" }'

The statement comes back under data, with the ITC summary, the supplier-wise summary and the document data (each supplier's GSTIN as ctin, its trade name as trdnm, and a checksum). If suppliers filed late and you want a statement that reflects them, you can ask for it to be regenerated on demand and poll until it finishes. Generating and polling cost nothing; the fetch is the only billed step.

Field shapes can still shift as more periods are seen, so read the statement defensively: look fields up by name rather than by position, and do not assume every optional field is present.

Both need a connection first

These calls act on a taxpayer's own data, so the GSTIN has to be connected once with an OTP that the GST portal sends to its registered mobile or email. The connection lasts about six hours, after which the API answers NOT_CONNECTED and you reconnect. One connection covers 2A, 2B and the other return calls. There is also a test_mode on every call that returns a sample in the live shape, so you can build the parsing before connecting anything.

The mistake that cost us a day

On the first live test, every data call failed. 2A returned "API Authorization Failed". 2B returned "GSTIN in request doesnt match with session". Even a call for a completely different return failed with the same sentence. The OTP step had succeeded, which made it more confusing, not less.

We assumed the feature was not available to us and started chasing settings: a second fresh OTP session to rule out a stale token, an "enable API access" toggle on the GST portal. Neither changed anything.

The turning point was that a different return failed with the same message. That meant the problem was not 2A or 2B at all. The username we had connected was the API user of a different GSTIN than the one we were querying. The OTP validates the username on its own, so it passed. Every data call then checks that the username belongs to the GSTIN in the request, so every one failed.

Once we paired the right username with the right GSTIN, everything worked: real invoices from 2A b2b, a real ITC statement from 2B, and a clean "no document found" from 2A tcs.

If you see "GSTIN in request doesnt match with session" or "API Authorization Failed", check the pairing first. The GST portal's Manage API Access page also states that only a selected GSP-ASP combination is permitted API access, so check that selection as well.

Which one should you build on?

• Monthly ITC reconciliation: GSTR-2B, one call per GSTIN per month.
• Continuous supplier tracking, or anything involving TDS, TCS, imports or ISD: GSTR-2A, only the tables you need.
• Both, if you want a monthly statement and a running view: they do not overlap enough to cancel each other out.

The reference for both, with fields, prices and error cases, is here: GSTR-2B and GSTR-2A API, including a 2A vs 2B page written for people calling the API.