HTTP Request Builder

About this tool

HTTP Request Builder is a Postman-lite tool for testing APIs and HTTP endpoints from your browser. Choose a method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS), enter a URL, add request headers as key/value rows, and type a body in the json, form or raw tab. The body is sent exactly as typed and no Content-Type is added for you, so include that header yourself. The request is sent through the UtilityKit backend with SSRF protections, so private IPs and localhost are blocked. The response panel shows a color-coded status code, elapsed time, response length in characters, the response headers, and the body, pretty-printed when it is JSON. A Copy as cURL button generates an equivalent curl command for your terminal. The method and URL of the last 10 requests are saved in localStorage for quick recall.

Why use it

• No install — test any public API directly in the browser without Postman or Insomnia.

• Server-side proxy lets you bypass browser CORS restrictions on third-party APIs.

• Pretty-print JSON responses automatically for easy readability.

• Copy as cURL makes it easy to share or reproduce requests in a terminal.

• Recent requests list recalls the method and URL of your last 10 sends.

• SSRF protections block private IP ranges to prevent internal network misuse.

How to use

1. Select an HTTP method from the dropdown (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS).
2. Enter the full URL including https:// in the URL bar.
3. Add request headers using the headers table — click '+ Add Header' for each key/value pair.
4. Choose a body tab: none, json, form or raw, type the body, and add a Content-Type header if the API needs one.
5. Click Send. The response panel shows status code, timing, response headers, and body.
6. Use the Body / Response Headers tabs to switch views.
7. Click 'Copy as cURL' to get the equivalent curl command for use in a terminal.

When it helps

• Quickly testing a REST API endpoint without setting up a local client.
• Debugging HTTP responses when you need to see exact headers and status codes.
• Generating curl commands from a GUI without memorizing flags.
• Testing webhooks or callback URLs during development.
• Checking API authentication headers and error responses in real time.
• Quickly testing a REST API endpoint without setting up a local Postman or Insomnia workspace

Examples

GET https://jsonplaceholder.typicode.com/todos/1
Accept: application/json

200 OK
Content-Type: application/json

{
  "userId": 1,
  "id": 1,
  "title": "delectus aut autem",
  "completed": false
}

POST https://api.example.com/posts
Authorization: Bearer eyJhbGc...
Content-Type: application/json

{"title":"Hello","body":"World"}

201 Created
Location: /posts/42

{
  "id": 42,
  "title": "Hello",
  "body": "World"
}

GET https://api.github.com/users/octocat
Accept: application/vnd.github+json

curl -X GET 'https://api.github.com/users/octocat' \
  -H 'Accept: application/vnd.github+json'

Tips

• Bearer tokens go in an Authorization header with value 'Bearer YOUR_TOKEN' — the proxy forwards all custom headers verbatim.
• The form tab does not URL-encode anything — it sends the text as typed. For a form post, type key=value&key2=value2 and add a Content-Type: application/x-www-form-urlencoded header.
• The json tab sends your text as-is and sets no Content-Type, so add Content-Type: application/json when the API expects JSON.
• Set Accept: application/json explicitly when an API returns multiple representations to ensure JSON output.
• HEAD requests fetch headers without the body — useful for checking if a URL exists or inspecting Content-Length.
• OPTIONS reveals which methods and headers a CORS-enabled API allows — handy for debugging preflight failures.
• Copy as cURL puts each header and the body on its own line with backslash continuations — paste into a terminal and add -v for verbose connection debugging.

Frequently Asked Questions

Glossary

HTTP method

The verb at the start of a request line — GET (read), POST (create), PUT (replace), PATCH (modify), DELETE (remove), HEAD (metadata only), OPTIONS (capabilities).

Status code 1xx (Informational)

Provisional responses — 100 Continue, 101 Switching Protocols. Rarely seen in everyday API work.

Status code 2xx (Success)

The request succeeded — 200 OK, 201 Created, 204 No Content. The server completed the operation.

Status code 3xx (Redirection)

Further action needed — 301 Moved Permanently, 302 Found, 304 Not Modified. The client should fetch a different URL.

Status code 4xx (Client error)

The request was malformed or unauthorized — 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests.

Status code 5xx (Server error)

The server failed to handle the request — 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout.

CORS (Cross-Origin Resource Sharing)

A browser security policy that blocks cross-origin requests unless the server returns explicit Access-Control-Allow-Origin headers. Bypassed here by routing through a server-side proxy.

multipart/form-data

A Content-Type used for HTML form submissions and file uploads, encoding fields as a sequence of parts separated by a boundary string.

REST

Representational State Transfer — an architectural style using HTTP methods on resource URLs (GET /users/123) with JSON or XML bodies.

GraphQL

An API query language using a single POST endpoint with a JSON body specifying the desired fields and operations — testable here by setting method=POST and body=JSON.

SSRF (Server-Side Request Forgery)

An attack where a server is tricked into making requests to internal services on behalf of an attacker; mitigated by blocking private IP ranges at the proxy.

Bearer token

An access token sent in the Authorization header as 'Bearer <token>' — the most common authentication scheme for modern REST APIs.