API Request Builder

Server assisted API Testing

Build requests visually, send them through a safe relay (or directly from the browser when CORS allows), view status, timing, headers and formatted body, and export the request as cURL or code. Sensitive headers are never stored.

Privacy: Processing happens in your browser where possible. Network checks are relayed through the Mutqan backend and are not stored.

What are the parts of an HTTP request?

An HTTP request is a method (GET, POST, PUT, PATCH, DELETE …) and a target URL — path plus query parameters — followed by headers and, for methods that carry data, a body whose format the Content-Type header names. RFC 9110 defines the methods and their semantics: GET and HEAD are safe, PUT and DELETE are idempotent, POST is neither, which is what decides whether a request may be retried. A cURL command line is the same request written out, and is the lingua franca for reproducing an API call in a bug report.

Read the guide: What is API Testing? How to Test a REST API

How to use API Request Builder

  1. Choose the method and enter the URL (query parameters can be added in the Params tab).
  2. Add headers, pick an auth type or paste a JSON body in the Body tab.
  3. Press Send. The response appears with status, time, size, formatted body and headers.
  4. Open the Export panel to copy the request as cURL or code for your test suite.
  5. Turn on "Direct browser request" in Settings when calling a local server that allows CORS.
By default the relay calls the API for you, so CORS does not matter but local and private addresses are refused; a direct request reaches localhost only if the target allows CORS.

  • Relay (default)

    • Your browser this page
    • Mutqan relay
    • Target API
    1. 1 From Your browser To Mutqan relay: Your request Method, URL, headers, body, timeout, follow redirects
    2. 2 Mutqan relay internally: Checks the target Private, loopback and link-local addresses, internal host names and unusual ports are refused before anything is sent
    3. 3 From Mutqan relay To Target API: Method, body and allowlisted headers Cookie, Host and other headers are not forwarded; adds X-Mutqan-Relay: 1
    4. 4 From Target API To Mutqan relay: Response reply Redirects followed when asked, every hop re-checked
    5. 5 From Mutqan relay To Your browser: Status, headers, body, size, timing reply Larger responses are truncated by the relay and marked

    Outcome: No CORS needed; the relay never stores your request or response.

  • "Direct browser request" on, in Settings

    • Your browser this page
    • Target API e.g. localhost
    1. 1 From Your browser To Target API: CORS preflight, when needed For example for a Content-Type such as application/json, an Authorization header or a method other than GET, HEAD or POST OPTIONS
    2. 2 From Target API To Your browser: The target must answer it reply
    3. 3 From Your browser To Target API: Your request, sent with fetch
    4. 4 From Target API To Your browser: Response reply Headers visible to the page are limited by Access-Control-Expose-Headers

    Outcome: Reaches localhost and intranet APIs, as long as they send CORS headers.

API Request Builder features

  • Method, URL, query params, headers, body and auth (Bearer, Basic, API key) in a tabbed request editor
  • Sends through a CORS-free relay by default, or directly from the browser for localhost and intranet APIs
  • Response panel with status badge, timing, size, pretty/raw/tree body views and a sortable header table
  • Export the request as cURL, fetch, axios, Python, Java, C#, Go, PHP, Ruby or raw HTTP
  • JSON body formatter, request persistence across refresh, Ctrl/⌘+Enter to send
  • Sensitive headers and credentials are never stored

API Request Builder example

POST an order to a test endpoint

Input:

POST https://httpbin.org/anything/orders
Content-Type: application/json

{ "customer": "cust_1029", "items": [{ "sku": "ABC-1234", "qty": 2 }] }

Output:

200 OK · 412 ms · 1.1 KB · application/json
{
  "json": { "customer": "cust_1029", "items": [ { "sku": "ABC-1234", "qty": 2 } ] },
  "method": "POST",
  …
}

Frequently asked questions about API Request Builder

Does my request go through Mutqan servers?

By default, yes: the request is sent through a relay so that CORS restrictions do not block it, and the relay never stores your request or response. Switch on "Direct browser request" in Settings to call the endpoint straight from your browser — useful for localhost and intranet APIs that allow CORS.

Are my tokens or passwords saved?

No. Auth values and sensitive headers (Authorization, Cookie, API keys) are kept only in memory for the current page. The URL, params and body are remembered in your browser session so a refresh does not lose your work.

Why do I get a network error for http://localhost?

The relay refuses private, loopback and link-local addresses for security. Enable "Direct browser request" — your browser can reach localhost as long as the local server sends CORS headers.

Can I export the request to code?

Yes. After sending, the Export panel offers cURL (bash, PowerShell, cmd), JavaScript fetch/axios, Python, Java, C#, Go, PHP, Ruby and raw HTTP.

Is there a size limit?

Request bodies up to 1 MB are relayed; larger responses are truncated by the relay and marked as such.

Technical notes

The relay endpoint forwards the method, the body and an allowlist of request headers: Accept, Accept-Language, Accept-Encoding, Authorization, Content-Type, Cache-Control, If-None-Match, If-Modified-Since, Origin, Referer, User-Agent, SOAPAction, Access-Control-Request-* and X-* headers other than X-Forwarded-*. Other headers (for example Cookie, Host, Idempotency-Key or Prefer) are not forwarded; the relay adds X-Mutqan-Relay: 1, and its own User-Agent when you set none. It follows redirects when asked, re-checking every hop, and returns status, headers, body (up to the relay limit), size and timing (total and time-to-first-byte). Private, loopback and link-local addresses, internal host names and unusual ports are refused before any request is sent.

In direct mode the browser fetch API is used; the target must answer the CORS preflight that the browser sends for a method other than GET, HEAD or POST, a Content-Type other than form, multipart or text/plain (such as application/json), or any header that is not CORS-safelisted, such as Authorization. Response headers visible to JavaScript are limited by the target's Access-Control-Expose-Headers.

References