About REST API Tester

Test REST APIs with method, URL, headers, and body simulation. Part of the DevTools Surf developer suite. Browse more tools in the API / Config collection.

Use Cases

• Test a new API endpoint during development without writing client code.
• Verify that an external API's authentication flow works before integrating it.
• Debug intermittent API failures by inspecting raw request/response headers and timing.
• Document API behavior by capturing actual request/response pairs for team reference.

Tips

• Always test with realistic payload sizes — APIs that handle 1KB payloads fine often fail or time out with 1MB payloads due to body parsing limits.
• Include the Content-Type header explicitly — many APIs reject requests that omit it even when the body format is correct.
• Test error paths deliberately: send invalid auth tokens, malformed JSON, and missing required fields to verify error response formats.

Fun Facts

• REST (Representational State Transfer) was defined by Roy Fielding in his 2000 doctoral dissertation at UC Irvine — not as a protocol, but as an architectural style. Most APIs called 'REST' violate several of Fielding's constraints.
• The 418 I'm a teapot HTTP status code was defined in RFC 2324 as an April Fools' joke in 1998 but is implemented in several real web frameworks and returns real responses from some Google endpoints.
• Postman, the most popular REST API testing tool, was started as a side project in 2012 by Abhinav Asthana and grew to a $5.6 billion valuation by 2021 — one of the fastest unicorn ascents in developer tooling.

FAQ

What's the difference between REST and SOAP?

REST uses HTTP verbs and JSON (or XML) with stateless URLs. SOAP is a protocol with strict XML message envelopes, WSDL contracts, and built-in error handling. REST is simpler; SOAP has stronger typing and WS-Security standards.

How do I test APIs that require OAuth2?

Obtain a bearer token using your OAuth2 client credentials or authorization code flow, then set it as Authorization: Bearer <token> in the request headers. Token expiry is a common source of test failures.