Network

HTTP Request Builder

This HTTP request builder lets you compose a full HTTP call — method, URL, headers, query parameters, and body — through a visual UI, then instantly generates the equivalent code as a cURL command, browser fetch(), axios, Python requests, and Node fetch. You can also fire the request live from your browser to inspect the status, response headers, and body (subject to CORS). It's ideal for drafting API calls, reproducing bug reports, sharing reproducible curl snippets with teammates, and bootstrapping HTTP client code in multiple languages without leaving the tab.

Last updated: March 2026

Headers

Query Parameters


      
CORS note: The browser only allows in-page requests when the target API sets permissive Access-Control-Allow-Origin headers. Internal or auth-protected APIs will usually fail with a CORS error — copy the generated cURL or Python code and run it from a terminal instead.
Copied!

Frequently Asked Questions

What is an HTTP request builder?
An HTTP request builder is a visual tool for constructing HTTP requests — pick a method, type a URL, add headers and query params, paste a body — and see the equivalent code in multiple languages. It's the lightweight cousin of Postman or Insomnia: handy when you just need a quick curl snippet, want to show a colleague exactly what request you sent, or need to turn a working browser DevTools request into production code without hand-editing escape sequences.
What code formats does this tool generate?
Five outputs are generated live on every keystroke: cURL with proper single-quote escaping and \ line continuations for readability, browser fetch(), axios, Python requests (using json= when Content-Type is JSON, data= otherwise), and Node fetch. Each tab has its own copy button, so moving code into a script, notebook, or CI job takes a single click.
Why does sending the request fail with a CORS error?
Browsers enforce the Same-Origin Policy: cross-origin fetch() calls only succeed when the target server responds with a permissive Access-Control-Allow-Origin header (and handles the CORS pre-flight for non-simple requests). Most internal or authenticated APIs don't, so the browser blocks the response — not because the server is down, but because the browser refuses to expose it. CORS only restricts browser JavaScript. Copy the generated cURL, Python, or Node snippet and run it from a terminal to bypass CORS entirely.
Does this tool store or log my requests?
No. The entire builder runs in your browser — code generation is local JavaScript, and when you click Send request the call goes directly from your browser to the target URL. Nothing is proxied through this site. That said, use caution: anything you paste into the tool stays in your browser tab's memory until you close it, so avoid pasting long-lived production API keys or customer-specific bearer tokens into any online builder (including this one).
How do I send a JSON body?
Switch the method to POST, PUT, or PATCH, click the Content-Type: application/json quick-add button, and paste your JSON into the body textarea. Enable Validate JSON to confirm the syntax before sending — the label will turn green when the body parses cleanly. The generated cURL output will quote the body safely with single quotes and escape any internal single quotes using the '\'' pattern. Python output automatically switches to json= so requests serializes the payload and sets Content-Type for you.
Why do GET and HEAD requests not show a body field?
Per RFC 9110, GET, HEAD, DELETE (usually), and OPTIONS requests should not carry a message body — their semantics are defined by the URL and headers alone. Some servers technically accept a body on GET, but browsers, proxies, and caches may strip it, so it's unreliable. The tool hides the body field for GET/HEAD to match common practice; if you need to send a payload with DELETE for a specific API (Elasticsearch uses this pattern), paste it while on POST or PUT first, then switch the method — the body persists.
How are query parameters encoded?
Query params are assembled using URLSearchParams semantics (the same rules the built-in URL object applies), so spaces become +, reserved characters are percent-encoded, and duplicate keys produce repeated parameters (?tag=a&tag=b) — the standard way most APIs expect array-valued params. If your URL already contains a query string, the new params are appended with & instead of ?.