Tutorial

How to Build and Send API Requests Without Leaving the Browser

Build HTTP method, URL, headers, and body in the browser, inspect status and timing, then copy cURL or fetch when CORS blocks the call.

By Haivix Team 9 min read
Abstract HTTP request and response panels on a dark Haivix-style background

Debugging an API from the browser is faster when you can change method, headers, and body without opening a separate desktop client. The catch is CORS: the browser will refuse some cross-origin calls that curl can still make.

Haivix API Request Studio composes GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS against a full URL, sends with fetch (credentials: "omit"), and shows status, elapsed time, body size, and pretty-printed JSON when the response parses. It also generates cURL, JavaScript fetch, and Python requests snippets. Requests go from your browser to the API—Haivix does not proxy or store them.

Compose the request

Enable query params and headers as key/value rows. A default Accept: application/json header is present. Auth options are none, Bearer token, or Basic (UTF-8 credentials encoded to Base64). Auth is not written to storage across reloads.

Bodies apply to POST, PUT, PATCH, and DELETE: JSON, plain text, or form URL-encoded (key=value per line). If you omit Content-Type, the tool sets a sensible default for the body mode. Timeouts are 10, 30, or 60 seconds. Load example fills GET https://jsonplaceholder.typicode.com/todos/1.

Read the response honestly

You see status text, timing, size, the body (pretty JSON when applicable), and headers the browser exposes to JavaScript—not necessarily every header the server sent. Copy body saves the text for notes or the JSON Formatter.

If the call fails with a CORS error, use the live codegen panel: copy cURL or Python and run it outside the browser. That is expected, not a Haivix outage.

What this studio will not do

It cannot bypass CORS, set forbidden browser headers, send cookies or multipart file uploads, or keep collections and environment variables. Non-HTTP(S) URLs are out of scope. JSON body validation is parse-only before send—not an OpenAPI contract check.

Bearer tokens often come from JWTs—inspect them in JWT Studio before pasting. Awkward query strings can be built with the URL Encoder.

Checklist before you trust a status code

Open API Request Studio, load the example or paste your URL, send, and export the snippet you need. Nothing is stored on Haivix servers.

  • URL is the exact environment you meant (staging vs production).
  • Method and Content-Type match the API docs.
  • Auth header is present and not logged in a screenshot.
  • You read timing and body, not only the status number.
  • CORS failures were retried via the exported cURL snippet.
  • Secrets were cleared from the form when you finished.