HTTP request client

Choose a method, enter a URL, and press Send (or Cmd/Ctrl + Enter). Examples… loads working requests against httpbin.org, JSONPlaceholder, the GitHub API, and dummyjson.com.

Building a request

Query — edit parameters as a table; it stays in sync with the URL.
Headers — tick to enable or disable each one. The auth helper adds a Bearer or Basic Authorization header.
Body — none, JSON (with a formatter), text, URL-encoded form, or multipart form.
Options — timeout, redirect handling, and whether to include credentials (cookies).
Import curl — paste a curl command (from your terminal or a browser’s "Copy as cURL") to load it. Code shows the current request as curl, JavaScript fetch, or Python requests.

Collections, environments, and variables

Collections (left) hold saved requests in folders. Save (Cmd/Ctrl + S) updates the open request; Save as… picks a collection or folder. Each item’s ⋯ menu renames, duplicates, moves, deletes, runs, or exports it. A dot beside the name means unsaved changes.
Write {{name}} in the URL, headers, body, or form fields. Values come from the collection’s Variables… and from the active environment (top right), which overrides them — for example one environment each for local, staging, and production. The resolved URL appears under the address bar, with any undefined names. Built-in values: {{$guid}}, {{$timestamp}}, {{$isoTimestamp}}, {{$randomInt}}.
History keeps the last 30 requests with their responses; export it as a HAR file or turn it into a collection.

Tests and the collection runner

The Tests tab adds assertions checked after every send: status (equals, class such as 2xx, less or greater than), response time, a header (exists, equals, contains, matches), the body text, or a JSON path such as $.data[0].id (exists, equals, contains, less or greater than, type, length, matches). “Equals” compares as JSON when the expected value parses, so 1, true, "a", and [1,2] work. Save to variable copies a value from the response into the active environment (or the collection’s variables when no environment is active), so a login request can capture {{token}} for the requests after it.

Run all requests on a collection or folder sends each request in order and shows status, time, and test results for each — a quick smoke test of an API.

Import and export

Postman collections (v2.0 and v2.1) import with folders, headers, bodies (raw, form, multipart, GraphQL), collection variables, :path variables, and bearer, basic, and API key auth. Postman scripts do not run here. Collections export as Postman v2.1, with each test written as a pm.test(…) line that Postman runs and this tool reads back exactly. Postman environments import and export too.
OpenAPI 3 / Swagger 2 (file or URL) becomes a collection with a folder per tag, example bodies, and {{baseUrl}}. The OpenAPI explorer can also hand a single operation over.
HAR files (from any browser’s network panel) become a collection; headers the browser sets itself are dropped.
Export everything writes a backup of all collections and environments to restore later.

The response

Status, total time, time to headers, body time, and size; a DNS / connect / TLS / waiting / download timeline when the server allows it (Timing-Allow-Origin); the headers the browser lets the page see; and the body — pretty-printed JSON with highlighting, indented XML, an image or sandboxed HTML preview, or a hex dump for binary data. Copy or download it.

What browsers allow

Requests are made by your browser with fetch(), so the target server must allow cross-origin requests (CORS) from this site. When it does not, the browser hides the response and reports a bare "Failed to fetch"; the tool explains the likely reasons — CORS, a rejected preflight, mixed content, or the network. Any request with a custom header, a JSON body, or a method other than GET, HEAD, or POST triggers a preflight OPTIONS request first; the tool tells you when and why. Browsers silently drop "forbidden" headers such as Host, Cookie, User-Agent, and Origin, and cross-origin responses only expose a few headers unless the server lists more in Access-Control-Expose-Headers. For anything the browser refuses, copy the request as curl and run it in a terminal.

Requests go only to the URLs you enter. Collections, environments, and history are kept in this browser’s local storage — export a backup to move them to another machine, and avoid storing long-lived secrets on shared computers.

Share link copies a URL that opens this tool exactly as configured. The request in the editor: ?method= and ?url= when that is all there is, otherwise packed into ?s= with headers, body, form, and tests. Credentials are never included: Authorization, cookie, token and key headers, query parameters, form fields, and JSON body fields are blanked unless they only refer to a {{variable}}, and environments and collections stay in your browser. Opening a link fills the editor; it never sends. For example: http/?method=GET&url=https%3A%2F%2Fhttpbin.org%2Fget.

Works with