Test API Online: REST Client with cURL Export

How this online API tester works (and its one big limit)

Everything runs in your browser. When you press Send, the page builds the request from the method, URL, query params, headers, body and auth you entered and sends it with the browser's own fetch() — straight from your machine to the API. There is no TechLogHub proxy in the middle, nothing is logged or stored on our servers, and cookies are not attached. The status, response time (measured with performance.now(), so it includes DNS, TLS and network time), size, headers and body come back from that single request.

The limit that follows from this is CORS. Browsers only let a page read a response from another origin if the API says so with an Access-Control-Allow-Origin header, and requests with a JSON body, an Authorization header or any custom header are preceded by an OPTIONS preflight the API must also accept. Public APIs designed for browsers (GitHub's REST API, most mock and sandbox APIs, your own API with CORS enabled) work. Many internal and server-to-server APIs do not, and when that happens the browser reports only a generic network error — the tester tells you so instead of guessing. For those APIs, use Copy as cURL and run the request in a terminal, or a desktop client like Postman or Insomnia, neither of which is bound by CORS.

Reading the response: status, timing, size and headers

The status line shows the HTTP code and reason: 2xx success, 3xx redirect (fetch follows redirects automatically and the tester notes the final URL), 4xx a problem with your request — 401 missing or bad credentials, 403 not allowed, 404 wrong path, 422 validation failed — and 5xx a server error. Size is the number of bytes in the response body after decompression.

JSON responses are pretty-printed automatically; anything else is shown as text, and binary types such as images are summarised rather than dumped. One thing that surprises people: the headers list is not the complete set the server sent. Browsers expose only CORS-safelisted response headers (Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified, Pragma) plus whatever the server names in Access-Control-Expose-Headers. If you need to see Set-Cookie or a custom X- header the API does not expose, curl -i shows everything.

Copy as cURL, and when to switch to Postman

Every request you build is mirrored as a curl command below the response, quoted for bash and zsh, including headers, the body and the Authorization header the Auth tab generates. Paste it into a terminal to run the same request without CORS, into a bug report so someone else can reproduce it, or into another tool: Postman's Import → Raw text accepts curl commands, and the cURL to Fetch and cURL to Axios converters on this site turn it into code.

This page is for quick checks: is the endpoint up, what does it return, does my token work, is my JSON body accepted. Postman, Insomnia, Bruno or HTTPie make more sense once you need saved collections, environments and variables, scripted tests, file uploads, or APIs that do not allow CORS.

Try it on a mock API

The URL field starts with TechLogHub's free mock REST API, which allows CORS from any origin. Send the default GET to list three fake posts, switch to POST with the JSON body to see a 201 Created echo, or request /api/mock/users/999 to see a 404. Endpoints, filters and pagination are documented on the Mock REST API tool page.