Skip to main content

Free Online API Tester

Test APIs online by sending HTTP requests, viewing responses, checking headers, and debugging endpoints directly from your browser.

Export your collection before leaving or reloading. Request edits and collections are not automatically saved.

Requests time out after 30 seconds. Use Cancel to stop a hanging call.

Query Parameters
Request Headers

Select a body type and enter request payload.

Quick auth helper (adds Authorization header).

Environment Variables

Use variables as {{name}} in URL, headers, params, auth, and body.

Response
Image response preview

Preview uses a blob URL in your browser. HTML is sandboxed (scripts disabled); treat remote HTML like untrusted content.

{}

Requests are sent directly from your browser (CORS applies). Do not send secrets on untrusted networks.

What this API tester is built for

Test REST APIs directly in the browser
Inspect JSON and HTTP responses
Debug endpoints without Postman
Validate headers, params, and auth flows
Share request setups with export or pasted JSON

Test an API in four steps

URL and method

Pick the verb, paste the endpoint, and keep secrets out of shared screens.

Params, headers, body

Add query rows, header presets or JSON import, then raw JSON or form modes as needed.

Send and inspect

Review status, response body, and response headers; format JSON when the API returns it. Cancel or wait for the 30-second timeout if a call hangs.

Copy, export, or reuse

Copy the body, download a snapshot, or export the collection before you leave—edits are not auto-saved.

When to use this tool

When this API tester is ideal

  • Quick checks on a single endpoint or variant.
  • Frontend debugging when CORS allows the call from this origin.
  • Validating JSON shape, headers, and status codes on real responses.
  • Smoke tests without installing a desktop API client.

When a full API client is better

  • Large collections, folders, and shared environments.
  • Team collaboration, comments, and history across workspaces.
  • Automated test suites, runners, and CI pipelines.
  • Complex OAuth flows, chained requests, or mock servers.

Continue your workflow

JSON → CSV

Export API responses into spreadsheet-friendly rows.

JSON → SQL

Stage response objects as INSERT-ready SQL text.

JSON → XML

Hand payloads to partners that expect XML trees.

CSV → JSON

Build JSON bodies from grid edits before you send.

JSON → HTML

Preview structured data as an HTML table fragment.

XML → JSON

Normalize XML feeds for JSON-first clients.

Overview & guides

This workspace is a lightweight, browser-based client: one active request tab, collections on the left, and a response panel below. Nothing runs on ConversionTab servers—your URL, headers, and body leave directly from the browser (subject to CORS).

Use it when you need a fast loop: tweak URL or JSON, send, read the body, repeat. Export the collection before you reload or leave—drafts are not auto-saved.

These public JSONPlaceholder endpoints allow browser CORS, so you can verify the tool without your own API.

Example 1 — GET JSON

  1. Method: GET
  2. URL: https://jsonplaceholder.typicode.com/todos/1
  3. Leave body on none. Select Send.

Expected result: status 200, JSON with fields such as userId, id, title, and completed. Timing appears next to the status.

Example 2 — POST JSON

  1. Method: POST
  2. URL: https://jsonplaceholder.typicode.com/posts
  3. Body mode: raw, type json.
  4. Body: 
    {
  "title": "ConversionTab check",
  "body": "Browser API tester POST",
  "userId": 1
}
  5. Select Send.

Expected result: status 201 (or 200), JSON echoing your fields plus a generated id. If Send stays busy, use Cancel or wait for the 30-second timeout.

CORS troubleshooting

  • A failed fetch with no useful status often means the API did not allow this page’s origin. Confirm Access-Control-Allow-Origin on the API (or use a desktop client / same-origin proxy).
  • Preflight failures happen when you add custom headers or non-simple methods—the API must answer OPTIONS with the right allow headers.
  • Mixed content: an HTTPS ConversionTab page cannot call plain http:// APIs. Use HTTPS endpoints.
  • Local APIs: calling http://127.0.0.1 from the live HTTPS site is often blocked or hangs (mixed content and private-network rules)—even when CORS allows the origin. Open the tester on localhost, use HTTPS, or expose the API with a tunnel.

The request builder merges method, URL, query rows, enabled headers, auth helper output, and body into one fetch. In-flight calls can be cancelled; otherwise they abort after 30 seconds. The response panel shows HTTP status, elapsed time, response headers as JSON, and the raw body—use Format response when the body is JSON.

If the browser blocks the call, the error is usually CORS: the target API must allow this origin, or test from an extension-backed client instead.

  • Sending production tokens in a shared screen—use short-lived test keys.
  • Forgetting Content-Type: application/json on JSON POST bodies.
  • Assuming CORS errors mean the API is down—they often mean the API did not allow browser origins.
  • Leaving without exporting—reload clears unsaved request edits and collections.
  • Pasting huge payloads without trimming—start small, then scale.

Are requests logged on your servers? They are issued from your browser; we do not proxy them through our backend.

Can I import Postman collections? Yes, for a subset of Collection v2 JSON. Supported: top-level folders (one nesting level as modules), request method, URL, query, headers, and raw / form-data / urlencoded bodies. Not imported: authentication values (bearer/basic type may be noted but tokens are left blank), Postman environment or collection variables, scripts, and deeply nested folders beyond one level. Prefer Export collection for a full round-trip in this tool’s native format.

Are my requests saved automatically? No. Export the collection before reloading or leaving. Preferences are not a cloud project.

What if Send stays on “Sending…”? Use Cancel, or wait for the 30-second timeout. Common causes are a hung API, network filter, a CORS preflight that never completes, or a localhost/private URL opened from the live HTTPS site (the browser may never reach your machine).

Why is Send disabled? Enter a valid URL first; the button enables when the field looks like a real HTTP(S) endpoint.

Built for real API workflows

Live response preview with status and timing.
Response headers and body in separate tabs.
Runs locally in the browser—no server-side proxy.
JSON-friendly format and copy for payloads and responses.
Cancel in-flight requests; 30-second timeout.
Export collections before you leave—drafts are not auto-saved.