REST Client Tool

Test API endpoints directly from your browser.

Headers (JSON)

Body (JSON)

Send a request and read the response without leaving the browser

Sometimes you only want to check what an endpoint returns: whether the token works, how long the call takes, or what headers come back. This REST client lets you compose a request in a form, fire it, and read the status, timing, response headers and body in one panel. It suits quick checks when a full desktop API client is more than you need.

Making a request

Choose a verb from the method menu: GET, POST, PUT, DELETE or PATCH.
Type or paste the endpoint into the URL box. It starts with a public sample todo address so that you can try the tool immediately.
In Headers (JSON), write an object such as an Authorization or Accept entry. The box begins with a Content-Type header for JSON.
For POST, PUT or PATCH, add the payload to Body (JSON).
Click Process Now. A spinner appears while the request is in flight.

Reading the result

The summary area shows the status code and text, colored green for 2xx responses and red otherwise, the elapsed time in milliseconds, and a table of response headers. The main panel shows the body. If the response declares a JSON content type, it is re-printed with four-space indentation; otherwise the raw text is displayed. Copy and Download handle the body text only.

When it is useful

Confirming that a new endpoint returns the expected status and payload before wiring up a front end.
Checking whether an API sends CORS, cache or rate-limit headers.
Reproducing a customer's reported failure with the same headers and body.
Getting a rough idea of response latency from your own network.

Browser rules that apply

The call is made by your browser using the fetch API, so the target server must allow cross-origin requests. If it does not, you will see a network or CORS error even when the same request works in a terminal. Only response headers that the server exposes to browsers are listed. Browsers also refuse to let scripts set certain headers, such as Host or Cookie, and a page served over HTTPS generally cannot call a plain HTTP address. The body is sent only for POST, PUT and PATCH and is not validated first, and the headers box must contain valid JSON. Avoid putting production credentials into requests to services you do not control.

Related Articles

Related Tools

Frequently Asked Questions

Why do I get 'Network Error or CORS Blocked'?

Your browser sends the request directly, so the API must allow cross-origin calls with CORS headers. If it does not, the browser blocks the response. A wrong address, an offline server, or an HTTP URL called from an HTTPS page can cause the same message.

Which HTTP methods are available?

The method menu offers GET, POST, PUT, DELETE and PATCH. A body is attached only for POST, PUT and PATCH. For GET and DELETE the contents of the body box are ignored, so use query strings or URL paths instead.

How do I send an authorization token?

Put it in the Headers (JSON) box as an object, for example a key named Authorization with a value of Bearer followed by your token. The headers box must be valid JSON, or the tool reports that headers must be valid JSON.

Are all response headers shown?

Only the ones the browser is allowed to expose. For cross-origin requests that usually means the standard safe headers plus any the server lists in Access-Control-Expose-Headers. Headers such as Set-Cookie are not visible to scripts.

What exactly do Copy and Download save?

They save the response body shown in the main panel, not the status line or header table. The Download button writes it to result.txt, and JSON responses are saved in the four-space indented form displayed on screen.