API Request Tester

Send HTTP requests with custom method, headers and body directly from your browser and inspect the response.

Why use this tool?

Send HTTP requests (GET, POST, PUT, PATCH, DELETE) with custom headers and body to test APIs, and inspect the status, headers and response. Requests go straight from your browser, so the API must allow cross-origin requests (CORS).

How to use it

1. Choose the method and enter the URL.
2. Add headers as JSON and a body if needed.
3. Click Send and inspect the response.

Sending a request

Choose a method, enter the URL, optionally add headers (as JSON) and a body, and send. The response shows the status code, how long the request took, the response headers and the body, pretty-printed when it's JSON. Typical uses are checking an endpoint during development, reproducing a bug report, or confirming an API key works.

GET reads data, POST creates, PUT replaces, PATCH updates part of a resource and DELETE removes it. For JSON bodies, set the header Content-Type: application/json; for authenticated APIs, add the header the API documents, usually Authorization: Bearer <token>.

Why some requests fail with a network error (CORS)

Requests are sent directly from your browser to the API, not through KitLoop's server. That keeps your tokens private, but it means the browser enforces CORS (cross-origin resource sharing): the API must explicitly allow requests from other websites by returning an Access-Control-Allow-Origin header. Many public APIs do; many private and internal ones don't.

When CORS blocks a request, the browser hides the real response, so you'll see a generic network error even though the server may have answered. If that happens, the API isn't the problem; test it with a command-line tool like curl, or from your own backend, instead.

Reading status codes

2xx means success (200 OK, 201 Created, 204 No Content). 3xx is a redirect. 4xx means the request was wrong: 400 for malformed data, 401 when authentication is missing or invalid, 403 when you're authenticated but not allowed, 404 when the URL doesn't exist, 429 when you've hit a rate limit. 5xx means the server failed: 500 is a generic error and 502, 503 and 504 usually point to an overloaded or unreachable backend.

Be careful with real credentials: anything you paste is sent to the URL you entered, and requests like DELETE act on live data.

Frequently asked questions

Does KitLoop see my requests or tokens?

No. Requests go straight from your browser to the API you enter.

Why do I get a network error when the API works in Postman or curl?

Browsers enforce CORS and those tools don't. The API isn't allowing requests from web pages on other sites.

What's the difference between 401 and 403?

401 means you're not (validly) authenticated; 403 means you are, but you don't have permission for that resource.