API Debug Workspace — Guide

Import a cURL command, send the request through a transient edge relay, assert status codes, JSON fields, headers and response time with a built-in test runner, run your whole saved collection as a regression suite, organize variables into Global / Collection / Environment scopes with secret masking, then inspect the response or hand it to the JSON workspace — all in your browser.

What it is and when to use it

Most browser API clients stop at the response body, which is exactly where the real work starts: pulling a token out of a login response, reshaping a payload, comparing two environments. This workspace keeps the whole chain in one page — cURL in, request out, response into the JSON pipeline — and keeps the safety boundary explicit: the relay validates every hop against private networks, caps body sizes, logs nothing and stores nothing, and sharing a request never includes your credentials by default.

Debug an API request end to end in the browser: import a cURL command, send it through a transient edge relay, read status, timing, headers and body, then hand the response straight to the JSON workspace or extract values into variables for the next request.

How to use it

  1. Paste a cURL command and parse it (or build method, URL, headers and body by hand), then Send and inspect the response without leaving the page.

A worked example

Fill in sample cURL

curl https://httpbin.org/get -H 'Accept: application/json'

Copy this into the tool, or open API Debug Workspace

Things that trip people up

  • The relay reuses the same SSRF validation chain as the site status checker: private and reserved IPs, internal hostnames and redirects into private networks are rejected; request bodies are capped at 256 KiB and response bodies at 1 MiB.
  • Credentials (Authorization, Cookie, API keys, URL passwords) are stripped from shared cURL by default, but the request body is NOT sanitized — review it before sharing. History and saved collections keep raw headers in localStorage so requests can be replayed: a known functional trade-off, not secure storage (no protection against XSS or browser-profile leaks). Credentials leave your browser only when you explicitly send or export a request.
  • Variables use {{name}} placeholders in URL, headers and body; "Extract → variable" pulls a JSONPath value from the response so a login token can feed the next request.

Next steps

Open the API Debug Workspace tool

Spotted something wrong on this page? Tell us via Contact Us