REST API Request Builder
Build and send HTTP requests directly from your browser with headers, body, and query params.
关于此工具
A lightweight in-browser REST client. Enter a URL, choose an HTTP method, add query parameters, set request headers, and craft a request body (raw text, JSON, or form-encoded). Hit Send to execute the request via the browser's Fetch API. The response panel shows status code, latency, response headers, and a formatted body. Save and reload frequently used requests from localStorage.
使用方法
- 1 Enter the target URL in the URL field.
- 2 Select an HTTP method from the dropdown.
- 3 Optionally add query parameters, request headers, or a request body.
- 4 Click Send to execute the request.
- 5 Review the status code, response time, headers, and formatted body in the response panel.
- 6 Click Save Request to store the current configuration for later use.
What an API request really is
Every time an app loads your profile or a weather widget shows the forecast, an HTTP request travels to a server and a response comes back. This tool lets you build and send those requests by hand so you can see exactly what an endpoint returns before you write a single line of code. You assemble four parts — a method, a URL, headers, and an optional body — press Send, and the tool fires a real fetch() straight from your browser and shows you the raw response, its status, timing, and size.
The four pieces of a request
Method
The HTTP method states your intent. GET retrieves data and should never change anything. POST creates a new resource. PUT replaces an existing resource and PATCH updates part of one. DELETE removes a resource. HEAD fetches only the response headers (no body), and OPTIONS asks the server which methods it permits. The tool automatically omits a request body for GET, HEAD, and OPTIONS, because those methods are not supposed to carry one.
Query parameters
Parameters in the Params tab are appended to the URL as a query string. Add page = 2 and limit = 10 and the tool builds ?page=2&limit=10, correctly URL-encoding each key and value and using & to join them (or appending with & if the URL already contains a ?). This is where filtering, pagination, and search terms usually go.
Headers
Headers carry metadata about the request. The two you will use most are Authorization (commonly Bearer your-token) to prove who you are, and Content-Type to declare the body format. This tool is smart about the latter: if you choose a JSON body it sets Content-Type: application/json for you, and for a form body it sets application/x-www-form-urlencoded — unless you have already specified that header yourself.
Body
The body carries the data you are sending, and only applies to methods like POST, PUT, and PATCH. You can write raw text, paste JSON, or use the form-field builder, which encodes key/value pairs into a URL-encoded form string.
A worked example
The tool loads pre-filled with a working request: GET https://jsonplaceholder.typicode.com/todos/1. Press Send and within a few hundred milliseconds you will see a green 200 OK status, the round-trip time in milliseconds, the response size in bytes, and a pretty-printed JSON body like:
{ "userId": 1, "id": 1, "title": "delectus aut autem", "completed": false }
The tool automatically detects valid JSON and reformats it with two-space indentation so it is readable; if the response is not JSON it shows the raw text untouched. Switch to the Headers tab of the response to inspect what the server sent back, such as content-type and caching directives.
Understanding CORS — the most common failure
Because the request runs inside your browser, it obeys the same security rules a website's JavaScript does. The single most frequent error here is CORS (Cross-Origin Resource Sharing). When you call an API on a different domain, the browser only hands you the response if that server explicitly sends an Access-Control-Allow-Origin header permitting it. Many APIs do not, so a perfectly valid request fails with a generic "Request failed" message even though the server actually responded. This is a browser policy, not a bug in your request — the same call would succeed from a command-line tool like curl or from a backend server, neither of which enforces CORS. APIs that publish public, browser-friendly endpoints (like the demo URL above) work fine.
Saving requests for reuse
Give a request a name and press Save and the tool stores the whole configuration — method, URL, params, headers, and body — in your browser's localStorage. Saved requests appear in the Load dropdown so you can rebuild a complex call instantly. Because this is local storage, the requests stay on this device and this browser only; they are never sent to a server and will not follow you to another machine.
Common mistakes
- Sending a body with GET. It is meaningless and many servers reject it; the tool strips it for you, but design your request accordingly.
- Forgetting the Content-Type for raw JSON. If you paste JSON into the raw body instead of the JSON body type, the auto-header is not added and the server may misread it. Either use the JSON body type or set the header yourself.
- Pasting secrets carelessly. An API token in the Authorization header is a password. Saved requests store it in plain text in your browser, so clear them on shared computers.
- Blaming the tool for CORS. A CORS block means the target server did not opt in to browser access — try a server-side tool for those endpoints.