REST API Checker
Articles, guides, and in-depth tips for the REST API Checker — everything you need to get the most out of it.
✦ AI-powered — understands natural language
The 200 Response Is the Least Useful Thing You Can Test
GraphQL's Introspection Query Is an Attacker's Best Friend — Batching, Nested Query DoS, and Persisted Queries
GraphQL's introspection query exposes your complete schema — every type, field, and relationship — to anyone who can reach the endpoint, making it the most powerful reconnaissance tool an attacker can use against a GraphQL API. Here's batching attacks that bypass rate limiting, deeply nested queries causing 100^5 database lookups, persisted queries as a security pattern, and how to test GraphQL endpoints with a REST API checker.
The Most Revealing API Tests Aren't Successful Requests — A Systematic Error-Path Testing Guide
The most revealing API tests aren't successful requests — they're deliberately malformed, missing, or boundary-case inputs that expose implementation quality and security posture. Here's the systematic error-path testing discipline: what good vs weak APIs do with missing fields, why type coercion masks bugs, what oversized inputs reveal about injection surface and length validation, and how the alg:none JWT attack tests a fundamental authentication vulnerability.
API Versioning: URL Paths, Headers, Query Strings, and Why "Just Change the Endpoint" Always Comes Back to Haunt You
The moment you release a public API, you've made an implicit promise to every client that depends on it: "this won't break." Versioning is how you keep that promise while still being able to evolve. Here's how URL path, Accept-header, and query-string versioning actually differ in practice, when each fits, and why the deprecation plan matters more than the versioning scheme itself.
API Rate Limiting: How It Works, How to Read Rate Limit Headers, and Exponential Backoff Strategies
Token bucket, sliding window, fixed window — each rate limiting algorithm has different burst characteristics. Here's how each works, how to read rate limit response headers from GitHub/Discord/Stripe, exponential backoff with jitter, and proactive client-side rate limiting to stay under limits without hitting 429s.
HTTP Status Codes Explained: A Complete Debugging Guide for API Work
HTTP status codes have precise meanings that most developers only half-know. Here's the complete guide — every important 2xx, 3xx, 4xx, and 5xx code explained with debugging guidance for each.
API Authentication Methods Compared: Keys, Bearer Tokens, OAuth 2.0, and HMAC
API keys, Bearer tokens, Basic Auth, OAuth 2.0, and HMAC signatures each fit different authentication scenarios. Here's how each method works, when it's the right choice, and how to test each one in an API checker — with the specific header formats.
REST API Checker — Test Any REST API Instantly in Your Browser
Learn how to test REST APIs directly in your browser — send GET, POST, PUT, and DELETE requests, add auth headers, inspect responses, and debug API issues without installing any tools.
