Free tool for product managers
API request builder
Choose a method, enter a URL, add authentication and a JSON body, and see exactly what gets sent — as a raw HTTP request, a curl command you can give an engineer, and the fetch() code an AI agent would write. Common mistakes are flagged as you type. Nothing is sent anywhere.
The parts of an API request
| Part |
Example |
What it does |
| Method |
POST |
The action: read (GET), create (POST), update (PUT/PATCH), delete (DELETE) |
| URL |
https://api.example.com/v1/tasks |
Which server and which resource |
| Query parameters |
?status=open&limit=20 |
Filters, sorting and paging for reads |
| Headers |
Authorization: Bearer … |
Metadata: who you are, what format you send and accept |
| Body |
{ "title": "Write release notes" } |
The data you send when creating or updating |
The response comes back with a status code, headers and usually a JSON body. Use the HTTP status codes tool to decode the status and the JSON explainer to read the body.
Three ways to write the same request
- Raw HTTP is what actually travels over the network. It is the clearest way to see every part.
- curl is a command-line tool almost every engineer has. A curl command in a ticket lets anyone reproduce a problem in seconds — much better than a screenshot.
- fetch() is how JavaScript code in a browser or server calls an API. It is what an AI coding agent will usually write.
Sending requests from a web page runs into browser security rules (CORS) and would mean typing real keys into a website. Copy the curl command into a terminal, use an API client such as Postman, Insomnia or Bruno, or ask your AI agent to run it from your own project — with keys stored in environment variables.
- Secrets in the URL. Keys in query strings end up in logs, browser history and analytics.
- A body on GET. Many servers and tools ignore it; use query parameters for reads.
- Secret keys in frontend code. A key beginning with
sk_ or similar belongs on the server, never in code that runs in the browser.
- Plain HTTP. Credentials and personal data must only travel over HTTPS.
- Invalid JSON in the body.
Using this with an AI coding agent
Give the agent the exact request and one real example response: "Call POST /v1/tasks as shown in this curl command from a server function. Read the API key from the TASKS_API_KEY environment variable. On 201 add the task to the list; on 422 show the error message next to the form." The more concrete the request, the less the agent has to guess.
Learn more in APIs for product managers.