APIForge

Test a REST API online from its OpenAPI spec

Paste a spec URL and send real requests to any operation from your browser. If CORS blocks the call, APIForge retries it through its proxy. Each JSON response is checked against the schema in the spec.

No spec handy?
  • Browser · proxy · auto
  • Bearer · Basic · API key
  • Schema check
  • No sign-up

How a test request runs

  • The spec is parsed and its operations are listed. Server URLs, parameters and request body shapes come from the file.
  • You set path and query values, headers, a body and auth, then send. Auto mode calls the API from your tab first.
  • On a CORS or network failure, the same request is retried from the APIForge server.
  • The response is shown with status, headers and timing, and a JSON body is compared with the response schema.

For what to assert beyond status codes, read API testing best practices. To turn a spec into a test matrix, see generating test cases from an OpenAPI spec.

Related tools and guides

Frequently asked questions

Paste the spec URL above. APIForge lists every operation. Pick one, fill in the parameters, body and auth, and press Send. The response status, headers, body and timing appear next to the request, and the body is checked against the response schema from the spec.

Yes, for requests that follow from a spec. There is nothing to install and no account. Requests are built from the operations in the OpenAPI file, and you can export them as cURL, JavaScript fetch, JSON or a Postman collection. It does not replace a full client with scripting and shared team collections.

Browsers only let a page read a response if the API sends CORS headers that allow the page's origin. If the API does not, the browser blocks the call before you see anything. In Auto mode APIForge detects this and retries the request from its server, which is not subject to CORS.

Use Browser mode. The request then leaves your own machine, so localhost is your localhost, though the API must send CORS headers that allow APIForge. The proxy connects from the APIForge server, where localhost means the server itself, so it cannot reach your dev machine. A deployment can also block loopback and private ranges.

Browser sends the request straight from your tab. Proxy sends it through the APIForge server. Auto tries the browser first and switches to the proxy when the browser call fails with a CORS or network error. A timeout does not trigger the fallback.

Only http and https, and no TRACE or CONNECT. Metadata and link-local addresses such as 169.254.169.254 are always refused, as are ports used by SSH, SMTP and common databases. The timeout defaults to 10 seconds and caps at 30, bodies are limited to 2 MB, responses to 5 MB, and redirects to 3, each one re-checked. Each IP gets 60 proxy requests per minute.

For JSON responses, APIForge compares the body with the response schema for that status code. It reports wrong types, missing required properties, and fields the schema does not declare. It is a best-effort check on the first few items of an array and nested objects up to 8 levels deep, not a full JSON Schema validator. If the spec has no schema for that status, the check is skipped and says so.

Bearer token, Basic auth and API key, sent as a header or a query parameter. Credentials go in the request you send, and on a cross-origin redirect through the proxy they are removed from the next hop.