API Debug Workspace
Debug an API request end to end in the browser: import a cURL command, send it through a transient edge relay, read status, timing, headers and body, then hand the response straight to the JSON workspace or extract values into variables for the next request.
Import a cURL command, send the request through a transient edge relay, assert status codes, JSON fields, headers and response time with a built-in test runner, run your whole saved collection as a regression suite, organize variables into Global / Collection / Environment scopes with secret masking, then inspect the response or hand it to the JSON workspace — all in your browser.
Steps and notes
What is API Debug Workspace — cURL, Test Assertions & Response Pipeline?
Most browser API clients stop at the response body, which is exactly where the real work starts: pulling a token out of a login response, reshaping a payload, comparing two environments. This workspace keeps the whole chain in one page — cURL in, request out, response into the JSON pipeline — and keeps the safety boundary explicit: the relay validates every hop against private networks, caps body sizes, logs nothing and stores nothing, and sharing a request never includes your credentials by default.
- Paste a cURL command and parse it (or build method, URL, headers and body by hand), then Send and inspect the response without leaving the page.
- The relay reuses the same SSRF validation chain as the site status checker: private and reserved IPs, internal hostnames and redirects into private networks are rejected; request bodies are capped at 256 KiB and response bodies at 1 MiB.
- Credentials (Authorization, Cookie, API keys, URL passwords) are stripped from shared cURL by default, but the request body is NOT sanitized — review it before sharing. History and saved collections keep raw headers in localStorage so requests can be replayed: a known functional trade-off, not secure storage (no protection against XSS or browser-profile leaks). Credentials leave your browser only when you explicitly send or export a request.
- Variables use {{name}} placeholders in URL, headers and body; "Extract → variable" pulls a JSONPath value from the response so a login token can feed the next request.
Category: Development
HTTP tools workflow
HTTP status codes → HTTP status checker → API Debug Workspace — cURL, Test Assertions & Response Pipeline → HTTP headers & request methods → User-agent parser → Device information → MIME types → Basic auth generator