REST API Checker

Test any REST API endpoint. Send GET, POST, PUT, DELETE, PATCH, HEAD or OPTIONS requests with custom headers and JSON, raw or multipart body. View status, headers, timing and response body in one screen.

Method: GET
Request Headers

Frequently Asked Questions

REST (Representational State Transfer) is an architectural style for APIs that uses standard HTTP methods (GET, POST, PUT, DELETE, PATCH) to operate on resources identified by URLs. Most modern web APIs follow REST principles, returning JSON over HTTPS. REST is stateless — each request must carry all the context the server needs to process it.
GET fetches a resource (idempotent, no body). POST creates a new resource. PUT replaces a resource entirely. PATCH updates part of a resource. DELETE removes it. Idempotent methods (GET, PUT, DELETE, HEAD, OPTIONS) can be safely retried; POST and PATCH typically cannot because retrying may create duplicates.
Browsers enforce CORS (Cross-Origin Resource Sharing), which blocks JavaScript from calling APIs on different domains unless the server explicitly allows your origin via Access-Control-Allow-Origin. This tool makes the request from our server, which is not subject to CORS — so you can test any public API regardless of its CORS configuration.
2xx = success (200 OK, 201 Created, 204 No Content). 3xx = redirect (301 Moved, 302 Found, 304 Not Modified). 4xx = client error (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests). 5xx = server error (500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout).
Add a header named Authorization with the value Bearer YOUR_TOKEN (for OAuth/JWT), Basic base64(user:pass) (for HTTP Basic), or your API's custom scheme like ApiKey abc123. Some APIs use a different header name like X-API-Key or X-Auth-Token — always check the API docs for the exact name and prefix.
Use JSON for almost every modern REST API and GraphQL endpoint. Use raw when sending XML (SOAP, RSS), plain text, or a custom format — set the Content-Type accordingly. Use multipart form-data when uploading files, sending binary data, or posting classic HTML form data with file fields.
The API received your request but rejected your credentials. The token may be missing, expired, malformed, or the account doesn't have permission. 401 means "who are you?", whereas 403 means "I know who you are, but you can't do this". Check that the Authorization header is exactly what the API expects — correct prefix, no extra spaces.
The server understood the request but rejected the body. Common causes: invalid JSON syntax (missing comma, unquoted key), wrong Content-Type, missing required fields, or values outside the expected types. Try copying the exact example from the API docs first to confirm the endpoint works, then modify one field at a time.
Requests are made from our server, but we do not store request bodies, headers or responses. Still, for production secrets, prefer scoped test keys or short-lived tokens. For high-sensitivity production credentials, use a desktop client like Postman or Insomnia that runs entirely on your machine.
If your frontend JavaScript calls an API directly, the API's server must include Access-Control-Allow-Origin matching your origin. If it doesn't, you need to either ask the API provider to allow your domain, or proxy the call through your own backend (which is what this tool does internally for testing). Server-to-server calls never trigger CORS — it's a browser-only restriction.

About This REST API Checker

This server-side REST API checker sends HTTP requests from our server to any URL, returning the status code, response headers, response body, and latency. Because the request is proxied server-side, CORS restrictions do not apply.

When to use this tool

  • Testing API endpoints without setting up a local HTTP client
  • Debugging CORS or authentication header issues
  • Inspecting redirect chains and raw response headers
  • Verifying webhook endpoints and health-check URLs

Related Developer Tools

JSON Formatter JWT Decoder HTTP Headers Base64 Encoder

Related Articles

In-depth guides and technical articles.

View all →
The 200 Response Is the Least Useful Thing You Can Test
Developer Oct 12, 2026
The 200 Response Is the Least Useful Thing You Can Test
The successful request is the least informative test. Response headers, error paths and duplicate-request behaviour are where API integrations actually break.
GraphQL's Introspection Query Is an Attacker's Best Friend — Batching, Nested Query DoS, and Persisted Queries
Developer Jul 19, 2026
GraphQL's Introspection Query Is an Attacker's Best Friend — Batching, Nested Query DoS, and Persisted Queries
GraphQL's introspection query exposes your complete schema — every type, field, and relationship — to anyone who can reach the endpoint, making it the most powerful reconnaissance tool an attacker can use against a GraphQL API. Here's batching attacks that bypass rate limiting, deeply nested queries causing 100^5 database lookups, persisted queries as a security pattern, and how to test GraphQL endpoints with a REST API checker.
The Most Revealing API Tests Aren't Successful Requests — A Systematic Error-Path Testing Guide
Developer Jun 24, 2026
The Most Revealing API Tests Aren't Successful Requests — A Systematic Error-Path Testing Guide
The most revealing API tests aren't successful requests — they're deliberately malformed, missing, or boundary-case inputs that expose implementation quality and security posture. Here's the systematic error-path testing discipline: what good vs weak APIs do with missing fields, why type coercion masks bugs, what oversized inputs reveal about injection surface and length validation, and how the alg:none JWT attack tests a fundamental authentication vulnerability.
API Versioning: URL Paths, Headers, Query Strings, and Why "Just Change the Endpoint" Always Comes Back to Haunt You
Developer Jun 16, 2026
API Versioning: URL Paths, Headers, Query Strings, and Why "Just Change the Endpoint" Always Comes Back to Haunt You
The moment you release a public API, you've made an implicit promise to every client that depends on it: "this won't break." Versioning is how you keep that promise while still being able to evolve. Here's how URL path, Accept-header, and query-string versioning actually differ in practice, when each fits, and why the deprecation plan matters more than the versioning scheme itself.
API Rate Limiting: How It Works, How to Read Rate Limit Headers, and Exponential Backoff Strategies
Developer Jun 16, 2026
API Rate Limiting: How It Works, How to Read Rate Limit Headers, and Exponential Backoff Strategies
Token bucket, sliding window, fixed window — each rate limiting algorithm has different burst characteristics. Here's how each works, how to read rate limit response headers from GitHub/Discord/Stripe, exponential backoff with jitter, and proactive client-side rate limiting to stay under limits without hitting 429s.