Developer tool
API Request Tester
A lightweight online API client: set method, URL, params, headers, JSON, form or raw body and bearer or basic auth, see status, time, headers and a pretty body.
Requests are sent through our server so they are not blocked by browser CORS rules. They are not stored; your history stays in this browser only.
How to use the api request tester
A small API client you can open in a tab
You often need to call an endpoint once to see what comes back: check an authentication header, read an error body or confirm a redirect. A full desktop client is more than you need. This tool covers the common cases.
Build a request
- Method and URL. Pick GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS and paste the address.
- Params. Add query parameters as rows and switch them on or off. They are merged into the URL for you.
- Headers. Add Accept, custom API keys or anything else. Content-Type is set for you based on the body type, unless you set it.
- Body. Choose JSON (with a Format button), form fields or a raw body with its own content type. GET and HEAD are sent without a body.
- Auth. Bearer adds an Authorization header with your token. Basic encodes a username and password.
Reading the response
You see the status code and text, time to the final response, size, redirects followed and the headers. JSON is pretty-printed; other text is shown as received; binary data is described rather than shown. Copy the body in one click.
Export and history
The Copy as cURL button gives you the exact command for the terminal or a bug report. Your last 25 requests are kept in this browser so you can click one to load it again. Tokens and passwords are never put in the history.
Safety limits
Requests are sent from our server, so only public internet addresses work, and each hop of a redirect is checked. Calls are limited by size, time and rate to keep the service fair. Do not test with real production credentials.
Frequently asked questions
Why does the request go through your server?
Browsers refuse cross-origin calls unless the target allows them, which most APIs do not. Sending from our server avoids that. The request is not logged or saved, and the response is returned to you and forgotten.
Which addresses can I call?
Public http and https addresses on ports 80, 443, 8080 and 8443. Localhost, private networks, link-local and cloud metadata addresses are blocked, and every redirect is checked again. To call your local API, use a copy of the request as cURL in a terminal.
Are my tokens saved?
Bearer tokens and passwords are not written to the history in your browser, but they do pass through our server to reach the API you chose. Use test credentials, and revoke anything you pasted by mistake.
What are the limits?
Fifteen seconds per request, five redirects, a 100 KB request body and a 1 MB response (longer responses are cut), and 30 requests per ten minutes per visitor.
Can I export the request?
Yes. Copy as cURL builds a command with the method, merged query parameters, headers, auth header and body, ready to paste into a terminal.
Where is the history stored?
In your browser's local storage, the last 25 requests. Clear it with one click. It is never sent to DEV3.