DevToolsmith

API Debugging Lab

Send HTTP requests, exchange WebSocket messages and inspect SSE streams. Connections go directly from your browser to the endpoint you choose, with no intermediary proxy.

Sends requests only to the endpoints you choose

Sending or connecting transmits your URL, headers and payload directly to the endpoint you choose. No request is sent automatically or through our servers. Nothing is saved to history. CORS and browser network restrictions apply.

Exported request files include headers and body, including any credentials you entered.

Request headers
Tip: drop a file here24 chars · 24 bytes · 1 line
Body (not sent for GET / HEAD)
Tip: drop a file here0 chars · 0 bytes · 0 lines

Idle

Make an HTTP request

Enter an absolute URL, choose a method and add one header per line. Review the endpoint and payload, then choose Send request. GET and HEAD do not send a body. Cookies are omitted unless you enable browser credentials. Response headers include only headers the browser exposes; servers can expose additional headers with Access-Control-Expose-Headers.

Import cURL and continue working

Use Import cURL or send a command from the cURL converter. Importing fills the request without sending it. Local file uploads, multipart forms, proxies, TLS bypasses and browser-controlled headers are not supported. Imports with parser warnings are rejected with the reason shown; replace file references with their contents and resolve ignored options before importing. Request exports include the headers and body, so treat files containing credentials as sensitive. JSON responses can be opened in the formatter, type generators or database lab.

WebSocket and SSE

WebSockets accept a URL and optional subprotocols. Browser WebSockets cannot set arbitrary request headers, and servers may validate the Origin header. SSE uses a streaming fetch with custom headers, parses multiline data, event names, IDs and retry hints, and reconnects only when you choose. Disconnect before switching endpoints; active connections are closed when the component is removed.

CORS and privacy

Browsers enforce CORS, TLS and mixed-content rules. A request that works in a terminal can fail here if the server does not allow this origin. This client does not bypass those protections or send data through a server. Requests, authentication headers, URLs, bodies and event logs are not automatically saved. Exporting copies the chosen data into a local file.

Limits

HTTP requests time out after 30 seconds and response previews stop at 2 MB. WebSocket connection attempts stop after 10 seconds. Logs retain the latest 200 events and up to 2 million characters; individual messages and SSE events are limited to 256,000 characters. The interface can be cached offline, but endpoints require their normal network connection.

When diagnosing request metadata, use User-Agent Parser to inspect a supplied browser string. User-Agent text can be modified by the sender and is not proof of a client’s identity.