API Tester | Imran Anwar, Workday Integration Consultant

Query string parameters. These stay in sync with the URL above — edit here or there.

Custom request headers. Sent in addition to any header the Auth tab adds automatically.

Raw text/JSON only — there’s no dedicated multipart/form-data builder. Paste form-encoded or multipart bodies as raw text if you need them.

Auth Type

Adds an Authorization header automatically when sending or exporting as curl. It won’t appear in the Headers tab — add it manually there instead if you need to see or override it directly.

Response

Send a request to see the response here.

About API Tester

Free tool

A lightweight, Postman/Bruno-style REST client that runs entirely in your browser: build a request, paste a curl command to import it, send it, and inspect the response. No install, no account, nothing leaves your machine except the request itself. Built by Imran Anwar, Principal Workday Integration Consultant, for quick one-off API checks without switching to a desktop app.

The CORS caveat. This tool sends requests with the browser’s own fetch(), so it’s bound by the same-origin policy every web page is. Desktop tools like Postman and Bruno make requests from a native process outside the browser, so CORS never applies to them. If a request fails here with a network-looking error, it’s very likely the target API doesn’t send permissive CORS headers for browser-based callers — that’s a real limitation of any in-browser tool, not a bug. It’s also why the Response Headers tab can look sparse on cross-origin responses: browsers only expose headers the server explicitly allows via Access-Control-Expose-Headers. Endpoints like httpbin.org and jsonplaceholder.typicode.com send permissive CORS headers and work well for testing this tool.

Paste curl — known limitations. The importer handles the syntax real-world curl commands actually use: quoted arguments (single and double), multiple -H/--header flags, -d/--data/--data-raw/--data-binary, -X/--request, --url, -u/--user for Basic auth, and backslash line-continuations. It is a lightweight parser, not a full shell lexer, so:

Chrome/Firefox “Copy as cURL” sometimes escapes an embedded single quote as '\'' inside a single-quoted string — that specific pattern can parse incorrectly.
-F/--form (multipart) fields are captured as raw text with a warning, not turned into an actual multipart body.
Shell variables ($VAR), command substitution, and Windows cmd/PowerShell curl syntax (^ continuations) aren’t expanded or supported — paste the literal, already-expanded command.
Unrecognized flags are skipped along with their value where one is obviously present; they won’t break the import, but they’re silently dropped.

History. The last 20 sent requests (method, URL, params, headers, body, and auth) are kept in this browser’s localStorage so you can click one to reload it. Nothing is synced or sent anywhere; clearing your browser storage clears it too.