Application Programming Interface (API) Testing Tool

Introduction:

An application programming interface (API) lets one program request data or actions from another. In an HTTP request, the method describes the intended action, the URL identifies the resource, headers carry metadata or credentials, and an optional body carries data. The response supplies a status code, headers, and body that must be read together. A successful status can still contain the wrong record, while an error response can contain the exact validation detail needed to fix the request.

Browser testing adds another participant to that conversation. Page code uses the browser's Fetch rules, so Cross-Origin Resource Sharing (CORS), mixed-content protection, cookie policy, redirects, and the HTTP cache affect what can be sent or exposed. A request that succeeds in cURL may fail in a page because cURL is not enforcing the browser's cross-origin visibility rules.

HTTP response

The server returned a status, exposed headers, and a body that browser code was allowed to read.

Browser network error

Fetch did not expose a normal response. CORS, mixed content, DNS, TLS, connectivity, cancellation, or a rejected redirect can all look similar from page code.

Application result

The meaning inside the response body. It may disagree with a broadly successful HTTP status and must be checked against the API contract.

Request bodies also have formats, not just text. JSON must be valid JSON, form data becomes URL-encoded key-value pairs, and raw text is sent as plain text unless a different content type is supplied. GET and HEAD normally carry no body in browser workflows, while methods such as POST, PUT, and PATCH often do.

Timing is evidence about the whole browser-observed attempt, including network travel, redirects, server work, and response-body reading. It is not an isolated server-processing measurement. Compare repeated tests only when endpoint, payload, cache policy, credentials, network conditions, and timeout are similar.

API tests often contain bearer tokens, passwords, keys, cookies, personal records, or internal URLs. Use approved non-production endpoints and short-lived credentials where possible. Before sharing any trace or response, remove secrets and sensitive payload fields even when the visible authorization value has been redacted.

How to Use This Tool:

Build or import one browser request, check its validation state, then send it only when the target and side effects are understood.

1. Start with the editable sample request, choose Import cURL to paste a command, or open Saved / history to load a previous request. Loading or importing fills the request editors without sending.
2. Select the HTTP method and enter an absolute Request URL. Edit query parameters in the URL or the Parameters tab; each row can be included, disabled, or removed.
3. Open Headers to enter name/value rows, or choose Bulk edit for one Header-Name: value pair per line. Use Authentication for a Bearer token, Basic credentials, or an API-key header when the endpoint requires it.
4. Open Body for JSON, Form URL encoded, or Raw text. Form mode takes one decoded key=value pair per line; GET and HEAD retain the body draft without sending it.
5. Open Advanced only if you need to change the timeout, redirect, browser credential, or cache policy. The defaults are 9,000 ms, Follow, Omit, and Default; timeout accepts whole milliseconds from 0 to 120,000, with 0 disabling the explicit abort timer.
6. Choose Send request after checking the target and intended effect. If it is unavailable, correct the reported URL, header, authentication, body, or timeout issue; invalid JSON is blocked before transmission.
7. Compare the captured status and body with the API's expected result, then inspect Response headers, Timing and size, or Exchange trace as needed. Use Export response for the selected body view, or Request code to reproduce the current editable request in another client.

To reuse a request later, open Saved / history, name it, and choose Save request. Undo and Redo reverse completed edits or imports; text fields also keep native undo. On mobile, More contains these editing commands and Share link.

Interpreting Results:

Read the HTTP status as a category, then verify the body. A 2xx response means the HTTP operation was accepted as successful, not that every expected field or business effect is correct. A 4xx response points toward the request, authentication, permissions, route, or validation. A 5xx response says the server failed while handling the exchange.

The final URL matters when redirects are followed, and Response headers may show only a subset of what the server sent. An empty body can be valid, including for HEAD or a 204 response.

Editing the request leaves the captured response tied to the last send. The unsent-edits notice marks that difference, and changing the timeout does not recalculate the old exchange against a new deadline. Exchange trace describes that captured exchange; Request code follows the current draft. Starting another send clears the previous response.

Pretty formats valid, untruncated JSON when the response content type identifies it as JSON. Otherwise it shows the same decoded text as Raw. Body copy and download use the selected view; for a response larger than 2 MiB, both export only the preview. The full exposed byte count remains available in Timing and size.

A browser error does not supply a reliable hidden status code. Reproduce the request in a server-side client when you need to separate endpoint reachability from browser policy, and compare the same method, headers, credentials, body, and redirect expectations.

Technical Details:

A browser API request combines an HTTP method and URL with headers, authentication, an optional encoded body, and transport policies. Fetch applies the browser's HTTP and CORS rules before page code can inspect the response. The prepared request records the intended exchange; browser-managed headers can differ from that record.

Mechanism Core:

Repeated query parameters keep their order. For repeated header names, matching ignores case and the last enabled value wins. HTTP token punctuation such as an underscore is allowed in a header name, while browser-controlled headers such as Cookie, Host, and Content-Length are rejected as custom headers. Basic authentication requires a nonempty username without a colon and supports Latin-1 characters; another credential encoding requires an explicit Authorization header.

The body defaults are application/json, application/x-www-form-urlencoded;charset=UTF-8, and text/plain;charset=UTF-8. In form mode, name=Ada Lovelace becomes name=Ada+Lovelace; entering already encoded text would encode its percent signs again. Request bodies are limited to 1 MiB of UTF-8 data, header text to 65,536 characters, and the encoded URL to 16,384 characters. Binary and non-UTF-8 responses may not be readable in the text preview.

cURL import and generated code

Import accepts one literal HTTP(S) request of at most 50,000 characters, including supported method, header, data, Basic, bearer-token, redirect, and timeout options. It does not execute shell text, expand variables, read files, or accept arbitrary cURL options. A rejected command leaves the current request unchanged. Existing transport settings remain in effect unless a supported option in the command changes them.

Generated cURL, Browser Fetch, Node Fetch, and Python Requests code uses the prepared current request. Client behavior still differs: browser cookies and cache settings do not transfer to the server-side clients, and cURL and Node Fetch do not reproduce the browser's CORS restrictions. Python Requests uses a socket inactivity timeout rather than the whole-request deadline measured here. Review the target client's limits before treating two runs as equivalent.

Formula Core:

Elapsed time covers the browser attempt from just before sending through completion of body reading. The start and finish times below use milliseconds; the displayed elapsed time is rounded to the nearest whole millisecond.

For a nonzero timeout, the remaining budget subtracts the rounded elapsed time from the timeout used for that send, with a minimum of 0 ms. The chart compares elapsed time with that sent deadline.

If timeout is 9,000 ms and the exposed response finishes in 640 ms, the remaining budget is 8,360 ms. When timeout is 0, Sent timeout reads No explicit deadline, Remaining budget reads Not applicable, and there is no timeout chart. Response size counts exposed body bytes, not compressed network traffic.

CORS is a response-sharing protocol layered over HTTP. Some cross-origin requests trigger a preflight before the intended method is sent. Credentialed cross-origin responses require explicit server permission, and the wildcard origin cannot authorize a credentialed response. Manual redirects may appear opaque because browser APIs intentionally limit redirect details.

A manual redirect can therefore produce no readable status or body. Following the redirect requests the final response, while rejecting redirects ends the attempt with an error. Neither choice bypasses CORS or guarantees that a state-changing request had no effect.

Privacy and Safety Notes:

The browser sends the request directly to the chosen endpoint, which can receive the URL, method, headers, authentication, allowed browser credentials, and body. The destination controls its own logs and retention. Local saving and automatic masking do not guarantee that a request is safe to share.

• Saved requests keep up to 50 definitions in this browser. New saves omit Authentication fields, the selected API-key header, and recognized credential header and query names. Other values can still contain secrets. Bodies are omitted unless you choose Include the body in this browser's saved request; an included body is saved without scrubbing.
• Recent history keeps up to 12 compact attempts with method, target URL without its query, status or outcome, and timing when available. Persistent history excludes response data, bodies, and authentication. While the tab stays open, Load request can restore more of the request, including its body but with recognized credentials removed; after reload, Load target restores only the stored method and target.
• Exchange trace masks recognized credential query parameters and request/response headers, including the selected API-key request header. Request code masks recognized request credentials by default; selecting Include credentials in displayed code also includes them in code exports. The visible name-matching rule can catch ordinary parameters such as page_token while missing secrets under other names. Bodies are not scrubbed, and the response body and header views are not redacted.
• Share link includes only the method and transport settings by default. Adding the request URL requires an explicit choice and includes that URL as entered, which may expose private targets or query values. Headers, bodies, Authentication fields, and responses are never added separately. Opening the link does not send a request.
• Browser storage may be unavailable or cleared. An unsaved-storage warning means the current work remains in the tab; use Retry storage or export reviewed Request code before leaving. Reading older saved requests does not rewrite the stored originals.
• Prefer test accounts, short-lived credentials, and reversible endpoints for state-changing requests. Cancellation or a timeout stops waiting without undoing server work; verify remote state before retrying a write.

Worked Examples:

References:

• RFC 9110: HTTP Semantics, RFC Editor, June 2022.
• Fetch Standard, WHATWG.
• RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage, RFC Editor, October 2012.
• Quickstart: Timeouts, Requests documentation.
• How to test an authenticated API workflow with cURL, Simplified Guide.
• How to create Playwright API tests, Simplified Guide.