All tools

API client

Send requests to a REST API from your browser, with collections, environments, OAuth and cURL, and a plain word on why one fails. Free, with no account or uploads.

Send a request

Type an API's address, or paste a cURL command, and send it from your browser.

What do you want to do?
Send a requestType an addressTry an example APIReady to sendBring in requestsPostman, OpenAPI…

Requests go straight from your browser to the API: nothing passes through KeepSimp. So, as for any web page, the API must let other sites read its answers (CORS); when it does not, the client says why and what it would have to send.

How it works and help

A little help along the way

Follow these steps. Every option is explained underneath. Requests go straight from your browser to the API, never through KeepSimp.

  1. Type the addressType the API's address, such as api.example.com/v1/items, and press Send. On the client's own page, Try an example API offers ready requests, and Bring in requests opens a Postman, Insomnia, OpenAPI or HAR file. A name on your computer or network, such as localhost:3000, is sent over http, anything else over https.
  2. Or paste a cURL commandPaste a cURL command into the address, such as one copied from your browser's developer tools, and it becomes the request. Anything a browser cannot do, such as a proxy or a client certificate, is named in a note.
  3. Choose the methodType or pick GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS, or a method of your own. GET and HEAD cannot carry a body in a browser.
  4. Add the query and headersUnder Query, each row is written into the address as typed; switch a row off to keep it without sending it. Under Headers, add a name and a value; a header the browser sets itself, such as Cookie, is marked and not sent. Edit as text takes many rows at once.
  5. Write the bodyUnder Body, choose JSON, text, XML or HTML and type it, with Tidy it to lay it out; or form fields, multipart parts with files, or one whole file. Its Content-Type is sent for you unless a header row says another.
  6. Sign inUnder Auth, choose a user and password (Basic), a bearer token or an API key, sent as a header or in the query.
  7. Send it and read the answerPress Send. The answer shows its status in words, its time and size, then its body (tidied, as it came, or previewed), its headers, its timing and exactly what was sent. Copy the body or save it as a file.
  8. When it is blockedWhen the browser keeps an answer from the page, the client says why: the API does not allow this site (CORS), it could not be reached, an http address was sent from this https page, or the time ran out. For CORS it lists the headers the API would have to send.
  9. Keep requests in collectionsPress Save (Ctrl or ⌘ + S) to put the request in a collection or a folder. Collections and History are on the left (on a phone, under the panel button): open a saved request in a tab of its own, rename, copy, move or delete it from its menu, and open a request you sent before.
  10. Use variables and environmentsWrite {{name}} anywhere in a request. Under Environments, make one for each place you send to, such as Local and Live, with its variables, and choose it at the top; a collection has variables of its own, and the globals hold for all. Typing {{ offers the names. Mark a token as a secret and its value is never kept.
  11. Open Postman, Insomnia and OpenAPI filesUnder Open, choose or paste a Postman collection or environment, an Insomnia export, an OpenAPI or Swagger description in JSON or YAML, a HAR file or a cURL command. A collection's menu saves it as a Postman collection or a KeepSimp file.
  12. Sign in with OAuth, AWS or a JWTUnder Auth, OAuth 2.0 gets a token by signing in at the provider (with PKCE), with client credentials or with a user and password; add the callback address shown to your app. AWS Signature signs the request on this device; JWT made here signs a token with your secret or private key each time. A request can take its folder's or collection's sign-in.
  13. Check the answer, and chain requestsUnder Checks, add rows such as Status equals 200 or JSON at $.items[0].id exists; they run after every answer. Under Take values into variables, take $.access_token into token, and the next request can send {{token}}. The answer's Tests tab shows what passed.
  14. Write scriptsUnder Scripts, write JavaScript to run before sending (set variables, add headers) and after the answer (pm.test, pm.expect, keep values), with Postman's pm. Snippets start you off. Scripts run sealed off from this site and the network.
  15. Run a collectionFrom the window's menu or a collection's menu, Run a collection sends its requests in order with their scripts and checks, once or once for each row of a CSV or JSON data file, and saves a report as JSON or JUnit XML.
  16. GraphQLChoose GraphQL beside the method, type the API's address, and press Ask for the schema: fields are then offered as you type the query, it is checked, and Docs lists every type. Put variables in as JSON, and choose which operation to run when the query has several.
  17. WebSockets and event streamsChoose WebSocket beside the method to connect to a ws:// or wss:// address with subprotocols, send text or JSON, and read every message in the log. An answer that is an event stream (text/event-stream) shows its events as they arrive; Stop closes it.
  18. Get the request as codeCopy as, Other languages (Alt or ⌥ + K) writes the request in cURL, Wget, HTTPie, PowerShell, JavaScript, Node, axios, Python, Go, Rust, Java, C#, PHP, Ruby, Swift, Kotlin or Dart, with its variables filled in.
  19. KeysCtrl or ⌘ + Enter sends, Ctrl or ⌘ + . stops, Ctrl or ⌘ + S saves, Ctrl or ⌘ + L goes to the address, Alt or ⌥ + T opens a tab and Alt or ⌥ + W closes it, Alt or ⌥ + B shows collections and history, Alt or ⌥ + E edits environments, Alt or ⌥ + 1 to 8 go to the query, headers, body, sign-in, settings, answer, checks and scripts, Alt or ⌥ + K shows the request as code, Alt or ⌥ + R runs a collection, Alt or ⌥ + C copies the request as cURL, and Ctrl or ⌘ + / lists the keys.
Every option explained
CORS
A page may read another site's answer only when that site sends Access-Control-Allow-Origin naming the page's site, or *. This is the browser protecting the API's users, and holds for every web page. Public APIs made for browsers send it; many others do not, and then only a terminal or a server can call them.
Preflight
Before a request that is not simple (a method other than GET, HEAD and POST, a header other than a few plain ones, or a body that is not form data or text), the browser asks the server with OPTIONS. The line under the address says whether this request will need one, and why.
How the cause is found
A browser tells a page only that a request failed. The client then sends one HEAD request that needs no leave from the API; it tells only whether the server answered, which is enough to tell CORS from a server that cannot be reached.
Headers you cannot send
Cookie, Host, Origin, Referer, Content-Length and others are set by the browser and never by a page. Chrome also sends its own User-Agent. They are kept in the cURL copy, where they can be sent.
Headers you cannot see
A page sees an answer's Content-Type, Cache-Control and a few more, and the headers the API lists in Access-Control-Expose-Headers; never Set-Cookie.
Exact numbers
JSON is tidied without being read into numbers, so a long id such as 12345678901234567890 shows every digit as the API sent it.
Timing
The time until the headers and until the last byte is always shown. How long finding the server, connecting, securing and waiting took is shown when the API sends Timing-Allow-Origin.
Cookies
Under Settings, sending this browser's cookies for the API can be switched on. The API must then name this site and allow credentials, and a browser that blocks third-party cookies may still leave them out.
Your server, on your computer
localhost and addresses on your network work when the server allows this site. Chrome may ask to let the page reach your local network: allow it.
Scripts
They run in a sealed frame on this device with no reach into this site, your storage or the network, and offer Postman's pm.test, pm.expect, pm.response, pm.request, pm.environment, pm.collectionVariables, pm.globals, pm.variables, pm.iterationData and pm.execution.setNextRequest. pm.sendRequest, require and cookies are not offered.
Kept on this device
Nothing is kept unless you switch on Keep collections and history on this device, in the window's menu: then collections, environments, globals and the last 100 requests are kept in this browser until you switch it off. A secret variable's value is never kept.
Share links
Share the request as a link, in the window's menu, puts the request in the link after the #, which is never sent to a server. Its sign-in goes in only if you say so. Opening the link shows the request and sends nothing.
Private
Requests go from your browser to the API and nowhere else. Files you choose stay in the window and are gone when it closes.
Read the step-by-step guide

Guides

Same tool, other jobs

Tools nearby