Analyze the HTTP status code and headers of a response and get an explanation of whether it is correct for the situation.
Validation
Response Validation Tools
A response can be 200 OK and still be wrong. These analyzers look at the parts of a response that quietly break clients and security reviews: cookie flags, caching directives, security headers such as CSP and HSTS, and the status code itself.
The contract tools compare what an API actually returns with what it promised — a schema or an earlier response — and flag removed fields, changed types and other breaking changes before consumers find them.
Tools in this category
Parse Set-Cookie headers and check Secure, HttpOnly, SameSite, Domain, Path, expiry and size best practices.
Validation
Analyze Cache-Control, Expires, ETag, Last-Modified, Vary and Age headers and explain how browsers and CDNs will cache the response.
Validation
Grade HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/CORP) from pasted headers or a public URL.
Validation
Validate that an API request/response pair conforms to its OpenAPI contract: path, method, parameters, body and response schema.
Validation
Compare an actual API response against an expected contract (example or schema) and report breaking vs non-breaking differences.
Validation
Check an AI agent's tool calls against the expected ones: tool, arguments, order, extra, repeated and forbidden calls, with precision, recall and a verdict.
Validation New
Check HTML for common accessibility problems — missing alt text, unlabeled fields, nameless buttons and links, ARIA errors, headings, contrast — mapped to WCAG 2.2.
Validation New
Guides
More guides Learn more
API Testing
What is API Testing? How to Test a REST API
API testing explained: what it is, what to check in every request and response, a step-by-step method for a REST API, common failures and free browser tools.
API TestingAPI Testing Approaches Compared
Five ways to test an API — exploratory, scripted, contract, mocking and load — compared on what each catches, and how REST, GraphQL, SOAP and webhooks differ.