Home › Developer Tools › API Request Tester

API Request Tester

Send HTTP requests to any REST API straight from your browser: set the method, query parameters, headers, auth and body, then inspect the status, timing, headers and formatted JSON response. Copy the request as cURL or JavaScript fetch code.

Try:

Query parameters are encoded and kept in sync with the URL.

Request history

Response will appear here. Press Ctrl+Enter to send.

How to use the API Request Tester

Choose a method and enter the URL. You can leave out https://, it is added for you.
Add query parameters and headers in their tabs; untick a row to disable it without deleting it. Use the Auth tab for a Bearer token or Basic login.
Add a body for POST, PUT and PATCH: pick JSON, text or form data. The matching Content-Type header is set for you.
Click Send request (or press Ctrl+Enter). The status, time, size, headers and formatted body appear below.
Copy the request as a cURL command or fetch() code to reuse it in a terminal or your app, or pick an earlier request from History.

HTTP methods at a glance

Method	Typical use	Has a body?	Safe / idempotent
GET	Read a resource or a list	No	Safe, idempotent
POST	Create a resource or trigger an action	Yes	Neither
PUT	Replace a resource completely	Yes	Idempotent
PATCH	Update some fields of a resource	Yes	Not guaranteed
DELETE	Remove a resource	Usually no	Idempotent
HEAD	Same as GET but only the headers (check size, type, caching)	No	Safe, idempotent
OPTIONS	Ask which methods and headers the server allows (used by CORS preflight)	No	Safe, idempotent

Safe means the request should not change data on the server; idempotent means sending it several times has the same effect as sending it once (RFC 9110).

Testing APIs from a browser: what CORS means for you

This tool sends requests with the browser's fetch(), exactly like a web app would. That makes it a realistic test of whether your API works for front-end code, and it also means the browser's same-origin rules apply:

Simple requests (GET, HEAD or POST with only standard headers and a form or plain-text body) are sent directly, but the response is only readable if the server returns Access-Control-Allow-Origin with * or this page's origin.
Preflighted requests (PUT, PATCH, DELETE, JSON bodies, or custom headers such as Authorization) first send an OPTIONS request. The server must answer it with Access-Control-Allow-Methods and Access-Control-Allow-Headers that cover your request.
Cookies are only sent when you tick Send cookies, and then the server must reply with Access-Control-Allow-Credentials: true and a specific origin (not *).

If a request fails here but works with cURL, the API simply does not allow browser access from other sites. That is normal for many private APIs: use Copy as cURL and run it in a terminal.

Frequently asked questions

Why do I get a CORS error?

Browsers only let a web page read a response from another site if that server allows it with an Access-Control-Allow-Origin header. Many public APIs do; many private or internal APIs do not. This is a browser security rule, not a problem with your request. To test those APIs, copy the request as cURL and run it in a terminal, or enable CORS on your own server.

Is my data sent to FreeToolCabin?

No. Requests go directly from your browser to the API you enter. There is no proxy server, so your tokens, request bodies and responses never pass through our servers. History is stored only in your browser's local storage and you can clear it at any time.

Why are some response headers missing?

For cross-origin requests, browsers only expose a few safe headers (such as Content-Type and Cache-Control) plus any the server lists in Access-Control-Expose-Headers. The rest are hidden from web pages, even though they were sent.

Can I set any request header?

Most, but browsers forbid a few for security, including Host, Origin, Cookie, Content-Length, Referer and Connection. The browser sets those itself. Custom headers like Authorization or X-Api-Key work, but they trigger a CORS preflight (OPTIONS) request that the server must accept.

Can I call an http:// API?

If this page is open over HTTPS, browsers block plain http:// requests as mixed content, except to localhost. Use the https:// address of the API, or run the request with cURL.

What do the timing numbers mean?

Time to headers is measured from sending the request until the status line and headers arrive (it includes DNS, connection, TLS and server time). Total time also includes downloading the full body.

What is the difference between PUT and PATCH?

PUT replaces the whole resource with the body you send, while PATCH applies a partial update to only the fields you include. POST usually creates a new resource, and DELETE removes one.

Related tools