Where is the request sent from?

From your browser via fetch(). trydevtools does not proxy or log it. CORS rules apply, since the request originates from a web page.

Why does my request fail with a CORS error?

The target server didn't return Access-Control-Allow-Origin matching trydevtools.com. For private APIs that don't allow browser origins, use a desktop REST client instead.

Are my requests stored?

No. Requests are sent live and the responses are shown only on your screen. Refreshing the page clears them unless you've explicitly saved the request.

Can I send custom Authorization headers?

Yes, including Bearer tokens. They are sent only to the target you specify; trydevtools doesn't read or store them.

http · rest · fetch · postman-like · browser

Build and send HTTP requests

A visual REST client in your browser. Set method, headers, and body, then inspect the response with status, timing, and pretty-printed JSON.

HTTP Request Builder

Status

—

Time

—

rtt

Method

GET

verb

Type

—

content-type

input · headers + body

Request headers (one per line)

Browser CORS rules apply. For testing arbitrary endpoints, use desktop Postman or curl.

output · response

Click Send to make a request.

Quick Start

How to send an HTTP request

This is a thin wrapper around the browser's fetch() API. CORS rules still apply — many APIs only respond to requests from their own origin.

01
Pick verb + URL
GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
requestIANAregistryofflinelive
verb · queryGET · IANA
```
GET https://api...
```
loaded · IANA bundlespec · ready
02
Headers + body
One header per line. Body fields appear for non-GET/HEAD verbs.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
headersRFC 9110canonicalspec-compliantlive
hdrs · optionsmany · live
```
Accept: application/json
```
options applied · livecanonical
03
Inspect status + timing
Response status, RTT, and content-type appear in the stats bar.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
statusvalidationlintpitfallslive
code · looked up200 · ready
```
200 OK · 142ms
```
result · livevalidated
04
Read body
JSON responses are pretty-printed. Headers shown in full.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
readclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
{...}
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to send raw HTTP

API smoke tests, debugging, payload inspection.

API smoke test

Quick check before writing real client code. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Headers debugging

Inspect what a server actually returns. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

JSON payload inspection

See pretty-printed JSON without saving the file. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Auth flow tests

Hit a refresh-token endpoint and read the new cookie. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Latency feel

Get a ballpark RTT from your browser. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Public API exploration

Try endpoints before reading the full docs. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Why do I see a CORS error?

Browsers refuse cross-origin requests unless the server returns Access-Control-Allow-Origin. Switch to a server-side tool like curl for protected APIs.

Can I send cookies?

Same-origin cookies are sent automatically. For cross-origin, the API must allow credentials and you'd need a credentials: 'include' option (not exposed in this UI).

Are large responses handled?

Yes, up to your browser's memory. The body preview caps at the visible scroll area.

Is anything logged?

No. The request goes directly from your browser to the target server.

Does it run locally?

Yes — there's no backend involved.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!