Send GET, POST, PUT, PATCH and DELETE requests straight from your browser, add headers and a body, then inspect the status code, timing, response headers and pretty-printed JSON.
This page is a quick way to try an HTTP API without installing a desktop client. Use it to check that an endpoint answers, see the JSON it returns, test a POST payload, or confirm that an Authorization header is accepted. After each request you get the status code and text, the time the request took, the size of the response body, the response headers the browser lets the page read, and the body itself. JSON bodies are pretty-printed with two-space indentation; anything else is shown as plain text.
https:// is added for you. Press Enter in the URL box or click Send.Content-Type: application/json row, or click + Add Header for others such as Authorization: Bearer … or Accept. Rows with an empty name are skipped, and × removes a row.application/x-www-form-urlencoded only when no Content-Type header exists, so change or delete the default JSON row first.Each request is made with the browser's fetch() API, directly from your device to the URL you entered. It does not pass through a ToolHub server, which also means the browser's security rules apply in full:
Access-Control-Allow-Origin header that allows this site. Many public APIs do; many internal or server-to-server APIs do not. When a request is blocked, you see a yellow “CORS or network error” box instead of a status code, because the browser hides the real response from scripts.OPTIONS request first. The default application/json row triggers this even for GET, so delete it if an API rejects preflights.Access-Control-Expose-Headers. Set-Cookie never appears.http:// URLs are blocked on this https page as mixed content, and headers such as Host, Origin, Cookie, Referer and Content-Length are set by the browser and cannot be overridden.The time shown runs from just before the request until the whole body has been read, so it includes DNS lookup, connection setup, server processing and download. The size is the byte length of the decoded body text, not the compressed transfer size. HTTP/2 servers send no reason phrase, so the badge may show only the number.
Command-line and desktop clients are not browsers, so they ignore CORS. A web page can only read a cross-origin response when the server explicitly allows it. If you control the API, add the appropriate CORS headers; otherwise use a desktop client for that endpoint.
Only to the server you are calling. ToolHub does not receive or log them. That server sees your IP address, an Origin: https://webhut.top header and whatever headers and body you entered. The history list stores just the method, URL, status, duration and time in your browser's localStorage under api_tester_history; tokens and bodies are not saved. Avoid pasting production secrets on a shared computer.
Usually not. Requests use the browser's default credentials mode, so cookies belonging to other sites are not attached and cookie-based sessions will come back as 401 or 403. Send a token in a header instead.
No. A body is sent only with POST, PUT and PATCH, and only as text you type in. Multipart file uploads are not supported.