API Request Studio

What API Request Studio helps you do

Move through the full HTTP debugging loop in one workspace: configure a method and URL, add query parameters, authorization, headers, and a request body, send the request directly from your browser, inspect the response, and export equivalent code for your application or terminal. It is built for the case where you need to see the real status, headers and body rather than guess from a log line.

Requests are sent directly from your browser to the URL you enter. Haivix does not proxy, store or log the request content, including headers, tokens and bodies.

How it works

The page builds a fetch request from the method, URL, headers and body you configure and sends it directly from the browser. The response is read as text and, when it parses as JSON, formatted for inspection. Status, duration and size come from the browser's fetch timing. CORS is enforced by the browser, so a response can be opaque or unreadable even when the API itself is healthy.

How to use API Request Studio

1. Choose an HTTP method, enter the endpoint, and configure query parameters, authorization, headers, and an optional body.
2. Send the request, then inspect the returned status, duration, size, exposed headers, and formatted response body.
3. Open the Code tab and copy the matching cURL, JavaScript fetch, or Python requests snippet for your project or terminal.
4. If the browser blocks the response, run the generated snippet outside the browser and compare the result.

When to use it

• Reproducing an API failure outside the application UI.
• Checking the exact status, headers and body returned by an endpoint.
• Testing a bearer token or Basic authentication header.
• Comparing a JSON payload with the contract before wiring a client.
• Handing a failing request to a teammate as runnable code.
• Trying a public API before installing a desktop client.

When not to use it

• APIs that do not allow your origin through CORS; use the generated terminal code instead.
• Production secrets on a shared or borrowed device.
• Load or performance testing; one browser request is not a benchmark.
• Requests that require a client certificate, a custom TLS stack or a private network tunnel.

Example

A checkout request returns 422 in the app but no useful message. The same method, URL, bearer token and JSON body are sent from the studio; the response body names the missing field and the status confirms it is a validation error rather than an auth failure. The cURL snippet is copied into the ticket with the token redacted.

What you can do with API Request Studio

• Compose GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS requests.
• Add query parameters, request headers, bearer tokens, or Basic authentication without manually rewriting the URL.
• Send JSON, plain-text, or form-encoded request bodies with a configurable timeout.
• Inspect response status, duration, size, exposed headers, and a formatted JSON or text body.
• Generate matching cURL, JavaScript fetch, and Python requests snippets.
• Copy the request configuration into a test or a bug report.

Example: reproduce and hand off a failing API call

Start with the endpoint and method, then add the exact query parameters, authorization, headers, and body used by the application. Send the request and compare the returned status, headers, and formatted response body with the expected contract.

When the request behaves correctly, open the Code tab and copy the cURL, fetch, or Python version into a terminal, test, issue, or code review. If the browser blocks the response because of CORS, use the generated terminal code to run the same request outside browser cross-origin restrictions.

For a bug report, include the method, path, status and the smallest request body that reproduces the problem. Redact tokens and personal data before pasting the generated snippet anywhere shared.

What to know before you start

• Requests go directly from your browser to the destination API; Haivix does not proxy or store them.
• The destination API must allow browser access through CORS for this page to read the response.
• Avoid pasting production secrets into any shared or untrusted device, and review generated code before committing it.
• Request duration is measured in the browser and includes local network conditions.
• Some headers and response details are hidden by the browser's security model.

Common mistakes

• Assuming a browser CORS error means the API is down.
• Pasting a production token into a screenshot or a shared machine.
• Forgetting that query parameters and body fields are different inputs.
• Sending a JSON body without the matching Content-Type header.
• Reading a successful status without checking the response body's own error field.
• Committing the generated snippet with a real secret still inside it.

Troubleshooting

If the browser reports a CORS error, the request may have reached the API but the response was blocked. Run the generated cURL command in a terminal to see the actual response.

If the status is 401 or 403, check the Authorization header and whether the token has expired. The JWT Studio can confirm the exp claim.

If the body is empty, the server may have returned 204 or the response may not expose a readable body. Check the status and headers first.

If a custom header is missing, the browser may forbid it or the server may not allow it through CORS preflight. Compare the generated code with the actual request.

If the request times out, raise the timeout for a slow endpoint or check whether the API is reachable from your network at all.

Related standards and documentation

• RFC 9110 defines HTTP methods, status codes and headers.
• The Fetch standard and CORS protocol govern browser cross-origin requests.