Build and send HTTP requests. Test REST APIs directly from your browser.
HTTP (HyperText Transfer Protocol) is the foundation of data exchange on the web. Every time you load a page, submit a form, or call an API, your browser sends an HTTP request to a server and receives a response. A request consists of a method (GET, POST, etc.), a URL, headers (metadata), and optionally a body (data payload).
The most common methods are GET (retrieve data), POST (create), PUT (replace), PATCH (partial update), and DELETE (remove). Response status codes tell you the outcome: 2xx means success, 3xx means redirect, 4xx means client error (like 404 Not Found), and 5xx means server error.
This tool sends real HTTP requests from your browser using the Fetch API. Note that CORS (Cross-Origin Resource Sharing) restrictions may block requests to APIs that don't allow browser-based access. Public APIs like JSONPlaceholder, httpbin.org, and most REST APIs with CORS headers enabled will work perfectly. For APIs behind CORS restrictions, you'd need a backend proxy or a tool like Postman.
This tool in other languages:
Français:
Constructeur de requêtes API
Español:
Constructor de solicitudes API
Deutsch:
API-Anfrage-Builder
Português:
Construtor de requisições API
日本語:
APIリクエストビルダー
中文:
API 请求构建工具
한국어:
API 요청 빌더
العربية:
منشئ طلبات API
Enter the URL, pick a method (GET, POST, PUT, DELETE, PATCH), optionally add headers, auth, or a JSON body, then click Send. You get the full response: status code, headers, and body. No install, no account, no import/export of collections.
GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS. For each method, you can add custom headers, an Authorization header (Bearer, Basic, API key), and a request body in JSON, form-urlencoded, or plain text.
Click the Auth tab and paste your Bearer token. The tool sets the Authorization: Bearer <token> header automatically. For API keys in custom headers, add them via the Headers tab instead.
Browsers block cross-origin requests unless the API allows your origin in its CORS headers. If the API doesn't set Access-Control-Allow-Origin, requests from this tool (or any browser-based tool) will fail. Use a desktop tool like curl, Postman, or your backend to call CORS-restricted APIs.
Requests are sent directly from your browser to the target API — nothing passes through DeskTools' servers. Tokens aren't logged or stored. That said, for production credentials, prefer a tool you control (Postman desktop, curl, your own scripts).
Select POST, click the Body tab, choose application/json as Content-Type, and paste your JSON. The Content-Type header is set automatically. Click Send and you'll see the response in the panel below.