API Request Builder

Server assisted API Testing

Build requests visually, send them through a safe relay (or directly from the browser when CORS allows), view status, timing, headers and formatted body, and export the request as cURL or code. Sensitive headers are never stored.

Privacy: Processing happens in your browser where possible. Network checks are relayed through the Mutqan backend and are not stored.

How to use API Request Builder

  1. Choose the method and enter the URL (query parameters can be added in the Params tab).
  2. Add headers, pick an auth type or paste a JSON body in the Body tab.
  3. Press Send. The response appears with status, time, size, formatted body and headers.
  4. Open the Export panel to copy the request as cURL or code for your test suite.
  5. Turn on "Direct browser request" in Settings when calling a local server that allows CORS.

API Request Builder features

  • Method, URL, query params, headers, body and auth (Bearer, Basic, API key) in a tabbed request editor
  • Sends through a CORS-free relay by default, or directly from the browser for localhost and intranet APIs
  • Response panel with status badge, timing, size, pretty/raw/tree body views and a sortable header table
  • Export the request as cURL, fetch, axios, Python, Java, C#, Go, PHP, Ruby or raw HTTP
  • JSON body formatter, request persistence across refresh, Ctrl/⌘+Enter to send
  • Sensitive headers and credentials are never stored

API Request Builder example

POST an order to a test endpoint

Input:

POST https://httpbin.org/anything/orders
Content-Type: application/json

{ "customer": "cust_1029", "items": [{ "sku": "ABC-1234", "qty": 2 }] }

Output:

200 OK · 412 ms · 1.1 KB · application/json
{
  "json": { "customer": "cust_1029", "items": [ { "sku": "ABC-1234", "qty": 2 } ] },
  "method": "POST",
  …
}

Frequently asked questions about API Request Builder

Does my request go through Mutqan servers?

By default, yes: the request is sent through a relay so that CORS restrictions do not block it, and the relay never stores your request or response. Switch on "Direct browser request" in Settings to call the endpoint straight from your browser — useful for localhost and intranet APIs that allow CORS.

Are my tokens or passwords saved?

No. Auth values and sensitive headers (Authorization, Cookie, API keys) are kept only in memory for the current page. The URL, params and body are remembered in your browser session so a refresh does not lose your work.

Why do I get a network error for http://localhost?

The relay refuses private, loopback and link-local addresses for security. Enable "Direct browser request" — your browser can reach localhost as long as the local server sends CORS headers.

Can I export the request to code?

Yes. After sending, the Export panel offers cURL (bash, PowerShell, cmd), JavaScript fetch/axios, Python, Java, C#, Go, PHP, Ruby and raw HTTP.

Is there a size limit?

Request bodies up to 1 MB are relayed; larger responses are truncated by the relay and marked as such.

Technical notes

The relay endpoint forwards the exact method, headers and body, follows redirects when asked, and returns status, headers, body (up to the relay limit), size and timing (total and time-to-first-byte). Private, loopback and link-local addresses are refused by design.

In direct mode the browser fetch API is used; the target must answer the CORS preflight for custom headers. Response headers visible to JavaScript are limited by the target's Access-Control-Expose-Headers.