API Tester (Online REST Client)

An API tester: a lightweight REST client in the browser

Desktop tools like Postman and Insomnia are powerful, but for a quick check of an endpoint you do not always want to install software or sign in. This API tester lets you write a request in a simple text format, send it with the browser's fetch API and inspect everything that comes back. JSON responses are pretty-printed automatically.

Request format

POST https://jsonplaceholder.typicode.com/posts
Content-Type: application/json
Accept: application/json

{
  "title": "Hello from the API tester",
  "body": "It works",
  "userId": 1
}

• First line – the method and URL (the method is optional; GET is used without a body, POST with one). You can also use the separate URL and method fields.
• Headers – one per line as Name: value.
• Body – everything after the first blank line.
• Lines starting with # or // before the request line are comments.

This is the same style used by the ".http" files of popular editor extensions, so requests are easy to copy between them.

What you see in the response

• The status code and text, colored green for 2xx, amber for 3xx and red for errors.
• Response time in milliseconds and body size.
• All response headers the browser is allowed to read.
• The body, formatted as JSON when possible, otherwise shown as HTML, XML or text.

Redirects are followed automatically, and a configurable timeout (1–300 seconds, default 30) stops requests that hang.

The CORS limitation

Because requests are sent by your browser, they follow the browser's security rules. The target server must allow cross-origin requests with CORS headers (Access-Control-Allow-Origin), otherwise the browser blocks the response and the tool reports that the request failed before a response was received. Also:

• Only response headers exposed by the server's CORS configuration are visible.
• Browsers do not let scripts set certain headers, such as Cookie, Host or Origin.
• Cookies are not sent (credentials: 'omit'), so authenticate with headers such as Authorization: Bearer ….
• APIs on localhost work only if they send CORS headers; plain http:// targets may be blocked as mixed content.

If an API does not support CORS, click Copy as cURL and run the command in a terminal, where no such restrictions apply. You can also turn that command into code with cURL to Python or cURL to JavaScript.

Good APIs for practicing

Public test APIs such as JSONPlaceholder (fake posts and users), httpbin-style echo services and many open-data APIs allow CORS and are ideal for learning how methods, headers and status codes behave. Try sending the same request as GET and POST, remove a required header, or send invalid JSON, and compare the status codes you get back: 200 and 201 for success, 400 or 422 for bad input, 401 and 403 for authentication problems, 404 for a wrong URL.

Privacy and security

Requests go directly from your browser to the API you specify; they do not pass through this website's servers. Still, treat tokens with care: use test credentials where possible and revoke keys you have pasted into shared computers.

To explore a large JSON response further, paste it into the JSON viewer.