How to use the REST API Tester
1. Select an HTTP method (GET, POST, PUT, PATCH, DELETE) and enter the API URL.
2. Add query parameters in the Params tab — they are appended to the URL automatically.
3. Set request headers in the Headers tab (e.g. Authorization, Content-Type).
4. For POST / PUT / PATCH, write your JSON payload in the Body tab.
5. Click Send. The response body, status code, timing, and headers all appear below.
What is it?
REST APIs communicate over HTTP using standard methods: GET (read), POST (create), PUT (replace), PATCH (partial update), and DELETE (remove). This tester lets you send real HTTP requests and inspect the raw response directly in your browser.
Because this runs client-side, CORS applies — the target server must send an Access-Control-Allow-Origin header. Public APIs like JSONPlaceholder, PokéAPI, and Open-Meteo all have CORS enabled and work great here. For private or internal APIs, use curl or a desktop client.
Benefits
Test API endpoints in the browser without installing Postman
Send GET, POST, PUT, PATCH, and DELETE requests with custom headers, query parameters, and JSON bodies — no installation, no account.
Debug authentication by testing with real Bearer tokens and API keys
Send requests with your actual credentials to verify they are accepted by the server before writing integration code.
Inspect raw response bodies, status codes, and response headers
See exactly what the server returns — formatted response body, every response header, and the HTTP status code.
Prototype API integration before writing any client code
Verify the endpoint works and the response matches your expectations before building any application logic around it.
Frequently asked questions
Why do I get a CORS error?
CORS is a browser security policy that blocks cross-origin requests unless the server explicitly allows them. Most internal or enterprise APIs block CORS. Use a CORS-enabled public API here, or use curl in your terminal for private endpoints.
Which APIs work well for testing?
JSONPlaceholder (jsonplaceholder.typicode.com), PokéAPI (pokeapi.co), Open-Meteo weather (api.open-meteo.com), GitHub public API (api.github.com), and any API you control that returns Access-Control-Allow-Origin headers.
Does Devy Tools see my requests or API keys?
No. Requests go directly from your browser to the target server. Nothing passes through Devy Tools servers. Your headers, body, and API keys stay in your browser only.
Can I test GraphQL APIs?
Yes — GraphQL APIs are just POST requests with a JSON body. Set method to POST, Content-Type to application/json, and put your query in the body: {"query": "{ ... }"}.