API Request Builder
Build, send, and inspect API requests directly from your browser.
Sent directly from your browser via fetch() — nothing passes through our servers, unless a CORS-blocked request falls back to a public proxy (Auto mode, on by default; shown next to the response when it happens). History/saved requests stay in local storage.
Nothing here yet — enter a URL above, or start from one of these examples (all point at public APIs that allow browser requests):
What Is an API Request Builder?
An API request builder lets you construct and send an HTTP request — choosing a method (GET, POST, PUT, PATCH, DELETE, and more), setting query parameters and headers, adding a request body, and attaching authentication — then inspect exactly what the server sends back. It's the same exchange your application code makes every time it calls that same endpoint, just visible and editable by hand instead of hidden inside your code. For a full walkthrough of each piece, read How to Test an API.
Test REST APIs Directly in Your Browser
This tool runs entirely in your browser and sends requests with the standard fetch() API — no install, no account. Because it's browser-based, it runs into the same constraint any frontend app does: a request only succeeds against a target API that explicitly allows cross-origin browser requests, or through a proxy you opt into. See CORS and browser-based testing below for the details.
Features
Request building
- GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
- Query parameters and custom headers
- Bearer, Basic, and API key authentication
- JSON, form URL-encoded, multipart, and raw bodies
Response inspection
- Status code and timing
- Full response headers
- Pretty-printed JSON, XML, and text
- Image and binary response preview
Developer workflow
- Environments and variables
- Collections, folders, and saved requests
- Local request history
- cURL, OpenAPI, and Postman import
- Code generation and shareable links
How to Test an API
- Enter the API URL.
- Choose the HTTP method.
- Add query parameters or headers.
- Configure authentication, if the API needs it.
- Add a request body, if the method takes one.
- Pick an environment, if the request uses variables.
- Send the request.
- Inspect the status, headers, and body in the response.
CORS and Browser-Based API Testing
Browsers enforce a same-origin security rule: JavaScript on one origin can't read a response from a different origin unless that server explicitly allows it via an Access-Control-Allow-Origin header. That applies to any browser-based tool, this one included — a request that works from curl or a desktop app can still fail here, because those tools aren't subject to the restriction at all. Credentials sent as cookies are also still governed by your browser's own cookie and CORS policy on top of this, regardless of what's set in the Auth tab.
If a direct request is blocked, this tool can automatically retry it through a small pool of public CORS proxies in — the default — or through a proxy URL you configure yourself. A proxy fetches the response on a server, where CORS doesn't apply, and adds the missing header back; this tool doesn't and can't bypass CORS on its own.
Routing through any proxy is a real trust boundary: whichever server handles the request can see its URL, headers, and body, including auth tokens. Use your own proxy — or self-host one of the open-source options in CORS Proxy settings — for anything with real credentials.
Generate Code From Any Request
Once a request works, generate the equivalent code instead of retyping it — cURL, JavaScript (Fetch), Axios, Node.js, Python (Requests) — from the Code button in the toolbar. Test the call here first, then paste the working implementation into your codebase.
fetch("https://api.example.com/users", {
method: "GET",
headers: { "Authorization": "Bearer <token>" }
})Bring In Existing API Definitions
- cURL — paste a curl command (in the URL bar, or via Import cURL) to reconstruct the method, headers, body, and auth.
- OpenAPI 3.0/3.1 — import a spec (JSON or YAML) and every operation becomes a saved, organized request.
- Postman Collection — import a v2.1 collection, folders and all.
- Collection JSON — export or import this tool's own collections as a portable file, for backup or moving between browsers.
Existing definition → import → organize into folders → pick an environment → send and inspect → copy the generated code.
FAQ
What is an API Request Builder?
A browser-based tool for constructing, sending, and inspecting HTTP requests to REST APIs — methods, headers, query parameters, request bodies, and authentication — without installing a desktop app.
Can I test REST APIs in my browser?
Yes, for any API that allows cross-origin requests from a browser (it sends the right CORS headers). Requests go out with the standard fetch() API, the same way any frontend application would call the same endpoint.
Does the API Request Builder require a backend?
No — request state (params, headers, body, auth) lives in your browser, and requests are sent directly with fetch(). The exception is the CORS proxy: if a direct request is blocked and the automatic fallback kicks in, or you configure a custom proxy, that request is routed through a server you don't control (or one you choose).
Why does CORS block some APIs?
CORS is a browser security rule, not something this tool controls. The target API's server has to explicitly allow your origin via an Access-Control-Allow-Origin header — if it doesn't, the browser blocks the response no matter what sent the request.
Can I send authenticated requests?
Yes — Bearer tokens, Basic auth (username/password), and API keys (as a header or query parameter) are all supported from the Auth tab.
Can I use environment variables?
Yes — define variables like {{baseUrl}} or {{token}} in an environment, then reference them anywhere in the URL, params, headers, or body. Switch environments (e.g. staging vs. production) without editing the request itself.
Can I import Postman collections?
Yes — import a Postman Collection (v2.1) to bring in its requests, folders, and any collection or environment variables as a new collection here.
Can I import OpenAPI files?
Yes — import an OpenAPI 3.0 or 3.1 document (JSON or YAML) and each operation is converted into a saved request, organized by tag into folders.
Can I generate cURL or code from a request?
Yes — any request can be copied as a cURL command, or generated as JavaScript (Fetch), Axios, Node.js, or Python (Requests) code, so you can test a call here first and paste the working version into your codebase.
Are my API credentials uploaded to a server?
Saved requests, history, environments, and collections are stored in your browser's local storage only. Direct requests — the default, whenever the target API allows it — go straight from your browser to the target API. If a request routes through the CORS proxy fallback or a custom proxy, that request (including any headers or tokens in it) does pass through that proxy server, since that's how a proxy works.