Compose HTTP requests, organize collections, inspect responses, and assert API behavior in one private, browser-based studio.
Requests run directly from your browser. Servers must allow your origin through CORS.
Enter an HTTP URL and choose Send. You'll see the response status, timing, headers, body, and automated test results here.
Only the first 2 MiB of the response were captured. Tests may not represent the full body; download is disabled for truncated content.
The tool uses direct fetch(). Cross-origin servers must grant CORS access. Requests using custom authorization headers may trigger preflights. No bypass proxy is included. Redirects are blocked by default to avoid forwarding request bodies to unexpected destinations.
Bearer tokens, passwords and secret environment values are excluded from persistent workspace storage and exports. Query strings, nonsecret headers and request bodies can be persisted, so keep credentials out of those fields.
Assertions use a deliberately limited, non-executable text language: status checks, response time, headers, body text, and simple JSON paths. Test scripts can't execute arbitrary JavaScript.
status == 200 time < 1500 size < 100000 header content-type contains json json $.data[0].id exists json $.success == true body contains "hello"
WebSocket, GraphQL schema exploration, multipart file uploads, arbitrary JavaScript test execution, browser-forbidden headers, raw TCP, and bypassing server CORS policies are outside this release. Postman v2.0/v2.1 importer accepts requests and compatible bodies, but does not run Postman scripts or load secrets. Redirects follow the browser's default behavior.
Compose REST requests, import a safe subset of Postman workspaces, inspect bounded responses and run declarative assertions against a user-selected endpoint.
Send a simple GET request to an endpoint you control, inspect status and selected headers, then add a status assertion and export a workspace with credentials excluded.
Requests go directly to the configured endpoint under browser CORS and mixed-content rules; credentials are omitted and redirects are blocked by default. Optional redirect following can forward request bodies. The sample endpoint is not sent automatically. Saved workspaces redact recognized sensitive fields, but unrecognized secrets in URLs, bodies or ordinary fields may persist or export. Response capture is capped at 2 MiB and text preview at 256 KiB. Postman import is a subset; scripts are not executed and multipart, OAuth exchange and WebSockets are unsupported.
No. Requests go directly from the browser to the endpoint and remain subject to browser network rules.
No. Recognized sensitive fields are redacted, but arbitrary secrets in paths, bodies or ordinary fields can remain. Review workspaces before saving or sharing.
