Online cURL Client

About Online cURL Client

How to use the Online cURL Client

1. Enter the method and URL, then add headers and a body if needed.
2. Send, and read the status, headers and body.
3. If it fails with a CORS or network error, check whether the API sends Access-Control-Allow-Origin - it usually means the response was blocked rather than the request failing.
4. Copy the equivalent curl command for anything the browser will not let you test here.

Examples

• POST JSON body

  {"hello":"world"}

  Copy example

Online cURL Client in code

The same operation this tool performs, in the languages you are most likely to need it.

# Verbose: request headers, response headers, TLS handshake
curl -sv https://api.example.com/health

# Status code only, for a script
curl -s -o /dev/null -w '%{http_code}\n' https://api.example.com/health

# Timing breakdown - where the latency actually is
curl -s -o /dev/null -w 'dns:%{time_namelookup} tls:%{time_appconnect} ttfb:%{time_starttransfer} total:%{time_total}\n' https://api.example.com

# POST JSON
curl -X POST https://api.example.com/items \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name":"widget"}'

# From a file, so quoting cannot corrupt the body
curl -X POST https://api.example.com/items \
  -H 'Content-Type: application/json' --data-binary @body.json

# Let curl URL-encode a query parameter for you
curl -G https://api.example.com/search --data-urlencode 'q=a&b=c d'

# Follow redirects, and see each hop
curl -sIL https://example.com

# Is it DNS, TCP, TLS or the application?
curl -sv https://api.example.com 2>&1 | head -30

# TLS certificate details
openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject

# Does the API allow cross-origin reads? Send a preflight.
curl -X OPTIONS https://api.example.com/items -i \
  -H 'Origin: https://uuidstudio.com' \
  -H 'Access-Control-Request-Method: POST'
# Look for access-control-allow-origin in the response. If it is
# absent, a browser cannot read this endpoint - and that is why a
# request that works here fails in a web page.

# Force HTTP/1.1 to rule out an HTTP/2 issue
curl --http1.1 -sv https://api.example.com

When you need this

• Checking that an endpoint is up and what it returns.
• Inspecting the response headers a service actually sends.
• Testing an API request with a bearer token during development.
• Confirming whether a failure is CORS, DNS, TLS or the application.

Common problems and what causes them

CORS blocking the response, not the request

Without Access-Control-Allow-Origin, the browser sends the request but refuses to let JavaScript read the reply. The server may well have processed it - including a POST that changed data. Use terminal curl for APIs without CORS headers.

Headers the browser will not let you set

Host, Origin, Referer, Connection, Content-Length and User-Agent are controlled by the browser and cannot be overridden by script. Any test that depends on one of those has to run outside a browser.

A preflight request you did not expect

Any request that is not a simple GET or POST with a basic content type triggers an OPTIONS preflight first. If the server does not handle OPTIONS, the real request is never sent - and the error mentions CORS rather than the missing OPTIONS handler.

Cookies not included

Cross-origin requests omit cookies unless credentials are explicitly requested and the server permits them with Access-Control-Allow-Credentials and a specific origin. A session that works in your app will not automatically work here.

Shell quoting corrupting a JSON body

In terminal curl, single quotes inside a single-quoted -d argument break the body, and $ inside double quotes gets expanded by the shell. Use --data-binary @file.json for anything non-trivial.

Pasting a real production token

The request goes only to the URL you enter, but a token in a browser field is a token in your clipboard and possibly your history. Use a scoped or short-lived credential for testing.

FAQ

Why does my request fail here but work in the terminal?

Almost certainly CORS. A browser will not let JavaScript read a cross-origin response unless the server sends Access-Control-Allow-Origin. Terminal curl has no such restriction. The request usually reached the server - you just cannot read the reply.

Why can't I set the User-Agent or Origin header?

The browser reserves those, along with Host, Referer, Connection and Content-Length, and forbids scripts from overriding them. There is no way around it from a web page; use curl locally.

What is a CORS preflight?

An automatic OPTIONS request the browser sends before any non-simple cross-origin request, asking whether the real request is allowed. If the server does not respond to OPTIONS correctly, the real request never happens - and the reported error blames CORS rather than the missing handler.

Are my requests proxied through this site?

No. They go directly from your browser to the URL you enter, which is also why the browser's CORS rules apply. Nothing you type is sent to uuidstudio.com.

How do I test an API that has no CORS headers?

From outside a browser: terminal curl, a desktop HTTP client, or a small server-side script. There is no way for a web page to read a response the browser has decided not to expose.

Why CORS errors?

Browsers block cross-origin responses unless the API sends Access-Control-Allow-Origin.

Related reading

• HTTP header parser
• HTTP status lookup
• API signature tester