API Tester
Test REST API endpoints
About API Tester
API Tester sends one HTTP request at a time from your browser, with its built-in fetch(), to the full http:// or https:// address you type, and shows the status code and the response body. The methods are GET, POST, PUT, DELETE, and PATCH; headers are written as a JSON object, and a body can be added to every method except GET. A JSON response is re-indented from the text received, so long numbers keep every digit; any other body is shown as plain text. Response headers and timing are not displayed, and requests are not saved. Because the request leaves from your browser, the API's CORS rules decide whether the response can be read.
Example
How a JSON response body is displayed (the page's own formatter, run on this body): the 64-bit ID and the trailing zero of 1.10 stay exactly as sent.
Response body as received
{"id":9007199254740993,"price":1.10,"tags":["a","b"]}Shown under the status line
{
"id": 9007199254740993,
"price": 1.10,
"tags": [
"a",
"b"
]
}How to send an API request from your browser
- 1Pick the method in the list (GET, POST, PUT, DELETE, or PATCH) and type the full URL of the endpoint, starting with https:// or http://; any other address is refused and nothing is sent.
- 2Optionally fill "Headers (JSON)" with an object, for example {"Authorization": "Bearer token"}.
- 3For any method other than GET, type the request in "Body"; it is sent as application/json unless your headers set Content-Type, in any capitalization.
- 4Click "Send request": the status appears in green below 400, in yellow from 400, or in red if the request failed, with the body underneath.
Formats and limits
- Methods
- GET, POST, PUT, DELETE, and PATCH (HEAD and OPTIONS are not offered)
- Address
- An absolute http:// or https:// URL; a relative address such as /api/users, or one typed without http:// or https://, is refused before sending
- Request headers
- A JSON object; if it is not valid JSON, or not an object, the request is not sent and a message says why
- Request body
- Any text, for every method except GET; Content-Type: application/json is added; a Content-Type key in your headers replaces it, whatever its capitalization
- Response shown
- Status code and status text, then the body (JSON re-indented, other text as received); response headers are not shown
- Timeout
- None: the page waits until the server answers or the browser gives up
Where your request goes
The request goes from your browser straight to the http:// or https:// address you type, not through our servers; an address without one of them is refused before anything is sent. A shown error's cleaned message goes to our error log with the tool's name and your browser's name and version; URLs, quoted text, and long numbers are removed, but a few characters of a mistyped header can remain.
Frequently asked questions
Can I call an API that does not allow cross-origin requests?
No. The request runs in your browser, so the browser applies the API's CORS rules: if the API does not allow this site, the response is blocked and only the browser's network error message appears. Desktop clients such as curl or Postman are not subject to that check.
Does it show the response headers?
No. The result shows the status code, the status text, and the body only. To read a header such as a rate-limit counter, open your browser's developer tools, where the network panel lists every header of the same request.
Is a Content-Type header added automatically?
Yes, but only when a body is sent: POST, PUT, DELETE, and PATCH requests with a body get Content-Type: application/json, and a Content-Type key in your headers replaces it, written in any capitalization, so only one value is sent. GET requests carry no Content-Type, so they do not trigger an extra CORS preflight.
Why is my address refused?
It does not start with https:// or http://. A browser reads an address such as /api/users or api.example.com/users as a page of the site you are on, so the request would reach this site with your headers. The tool stops instead; add the scheme and send again.
Will large numbers in a JSON response be rounded?
No. The body is re-indented from the exact text received instead of being parsed and rewritten, so an ID such as 9007199254740993 or a price written 1.10 is shown exactly as the API sent it.
Tips and tricks
- ✓If the API returns a JWT, paste it into JWT Decoder to read its claims.
- ✓When only a network error appears, open the same GET address in a new tab: if it loads there, the API is most likely refusing cross-origin reads.