REST API Tester — OneFreePlace

Request

Direct Browser transport · secrets stay local

Direct Browser

Query parameters are appended after {{variable}} resolution. Duplicate keys are preserved.

Authentication

Header / query name

Username

Token / password / API key

Reveal secrets in request inspector

No request body.

Variables are local to this page. Mark secrets so inspectors/history never reveal them. Use {{name}} in URL, params, headers and text bodies.

Extract from last JSON response

Assertions are deterministic and local—no arbitrary JavaScript is executed.

Transport

Timeout

Redirects

Browser credentials

Browser cache

Maximum response body

Allow localhost/private-network targets

Direct Browser mode obeys Fetch/CORS restrictions. The production OneFreePlace Relay is optional and must be configured server-side; it must block private/reserved destinations and re-check redirects to prevent SSRF.

Recent run history · URL/status/timing only

Request audit

Response

Nothing sent yet

Idle

Ready when your API is.

Send a request to inspect status, timings, headers, body, assertions and diagnostics.

Status—

TTFB—

Download—

Total—

Body—

Save a baseline, send again, then compare.

Run Probe ×3 or ×5 to measure repeated latency.