API Request Builder
Build, send and debug HTTP requests with cURL import and export
Network disclosure: Sends the request you build from your browser directly to the URL you enter. DevToolkit Hub never proxies or stores it.
About API Request Builder
How API Request Builder Works
The builder keeps the request in memory: query rows are merged into the URL with the WHATWG URL API, the body is validated (JSON is parsed before sending), and cURL import reuses the same shell-style tokenizer as the cURL converter. Export writes a quoted, copy-pasteable cURL command without any network access. Only when you press Send does the browser call fetch() directly against your target with credentials omitted and no Referer, so the response you see is exactly what that API returns to a browser, including CORS restrictions.
The API Request Builder is a lightweight HTTP client that runs in your browser tab. Pick a method, type the endpoint, add query parameters and headers as editable rows, and attach a JSON, form-encoded or plain-text body. Paste a cURL command copied from documentation, browser DevTools (Copy as cURL) or a teammate, and it is split into editable parts; edit anything and the cURL export updates instantly, ready to paste into a terminal or a bug report. When you want to see the live response, press Send: your browser calls the API directly and shows status, timing, size, the response headers the server exposes, and a pretty-printed body you can copy or download. Validation catches the common mistakes before a request goes out, such as malformed JSON bodies, invalid header names, bodies on GET requests, or non-HTTP URLs.
Frequently asked questions
Does DevToolkit Hub see my requests or tokens?+
No. There is no proxy: requests go from your browser straight to the URL you enter, and nothing is stored, logged, or put in the page URL. The target server does receive what you send, including your IP address and any tokens in your headers.
Why do I get a network or CORS error when the API works in cURL?+
Browsers only let a page read a cross-origin response when the server sends Access-Control-Allow-Origin. Many private APIs don't, so the browser blocks the call. Use the cURL export in a terminal, which isn't subject to CORS.
Can I send cookies or set the User-Agent?+
No. Browsers forbid web pages from setting headers such as Cookie, Host or User-Agent, and this tool always omits credentials. Those headers are still kept in the cURL export.
Limitations
Requests are subject to CORS and the browser's forbidden-header rules, so some APIs can only be tested via the cURL export. Multipart file uploads, WebSockets and streaming responses are not supported, and only response headers the server exposes via CORS are visible.