How to Test a REST API Request

Understand the parts of a request

A request typically includes a URL, HTTP method, optional query parameters, headers and sometimes a body. GET is commonly used to retrieve data; POST submits data; PUT and PATCH update resources; DELETE requests removal. The server defines the actual contract.

Prepare a safe test

Use a development or sandbox endpoint when possible. Avoid sending production credentials or personal information to an unknown destination.

1. Confirm you have permission to call the endpoint.
2. Enter the full URL and choose the documented HTTP method.
3. Add only the query parameters and headers required by the API.
4. For methods that accept a body, select the correct content type and provide valid JSON or form data.
5. Send the request and inspect status, response headers, duration and body.

Common HTTP status codes

200 commonly indicates success; 201 indicates a resource was created; 204 indicates success with no response body. 400 usually means a malformed or invalid request; 401 means authentication is required or invalid; 403 means the server refuses the request; 404 means the resource was not found; 429 indicates rate limiting; and 5xx indicates a server-side failure. Interpret codes using the API documentation.

Understand CORS

When a browser calls another origin, the destination server must permit the browser origin through Cross-Origin Resource Sharing (CORS) headers. A browser CORS error does not necessarily mean the API is down; the same endpoint may work from a server-side client. Do not try to bypass access controls.

Troubleshooting

Check the URL, method, authentication, content type, required fields, rate limits and API documentation. A timeout can reflect network or server delays. Never publish a screenshot containing API keys, bearer tokens, cookies or private response data.