odmin.biz
Menu

Free network tool

Online HTTP client & API tester

Send a public HTTP request online, import browser cURL or fetch, set safe headers and a text body, then inspect status, response headers, redirects, body, and timing.

Bounded HTTP client

Inspect a public URL

Browser or protected server
Import a browser requestPaste Copy as cURL or Copy as fetch; parsed locally without running it

Browser mode sends HTTP or HTTPS GET/HEAD directly with credentials omitted and requires the destination to allow CORS. Protected server mode accepts default-port HTTP and HTTPS, is mandatory for other methods, and always requires fresh Turnstile. Every server redirect is DNS-validated and pinned; HTTPS uses public certificate and hostname verification with no fallback.

Request headersUp to 32 bounded text headers

No custom headers. Protected server mode can set Origin, Referer, and User-Agent; credential, framing, routing, proxy, forwarding, and reserved browser headers remain blocked.

Generated request previewPage-authored browser request fields
GET (enter a target URL)

The browser may add, remove, normalize, or withhold transport and security headers at send time; JavaScript cannot expose their final wire form.

Why is Turnstile required?

Protected HTTP requests contact the selected system from the odmin.biz Kubernetes gateway, not directly from your device's IP address. Every protected request needs a fresh challenge. Cloudflare processes the verification traffic; this application keeps no request history.

Response details will appear here

GET and HEAD can run directly. Enable Server request—or choose another method—to use the Turnstile-protected gateway.

◎ No request history or browser storageOnly your Send action initiates a request

About this tool

What online http client & api tester does

Use this online HTTP client and lightweight API tester to inspect one public HTTP or HTTPS response without installing Postman or cURL. Paste a browser Copy as cURL command or Copy as fetch call, review the safely imported URL, method, headers, body, and redirect choice, then inspect response status, headers, bounded body, and browser-observed round-trip time.

How it works

The importer parses a static cURL command or fetch call entirely in current-tab memory and never evaluates shell or JavaScript. It removes credentials, cookies, proxy, forwarding, framing, and reserved browser headers; files and expressions are rejected. Imported requests use protected Server request mode but never send automatically. GET and HEAD can otherwise run as direct browser fetches with credentials omitted. Server request—and POST, PUT, PATCH, DELETE, or OPTIONS—requires fresh Turnstile at https://http-client.odmin.biz/. The gateway validates and pins every public default-port destination; HTTPS verifies public trust and hostname with no bypass or fallback. Bounded Referer and User-Agent values plus one valid HTTP(S) Origin are supported in server mode. The complete request line, generated and custom headers, separators, and UTF-8 text body share a 16 KiB limit. Copy cURL and Copy fetch generate text locally without another request.

Common uses

When to use it

  • Paste a request copied as cURL or fetch from browser DevTools and safely reproduce its non-credential fields
  • Send a small GET, HEAD, POST, PUT, PATCH, DELETE, or OPTIONS request to a public API
  • Inspect response status, headers, body size, content, and browser-observed round-trip time
  • Test a bounded JSON or form-encoded text API request without installing a desktop REST client
  • Set a server-side Origin, Referer, or User-Agent value while keeping cookies and authorization blocked
  • Inspect the first redirect or follow a bounded public GET/HEAD redirect chain
  • Copy the reviewed request back out as cURL, fetch, or reconstructed HTTP text

Scope

Limits to know

  • Direct GET/HEAD responses must allow browser CORS; protected Server request requires fresh Turnstile
  • Both modes accept public HTTP/HTTPS hostname URLs only on default ports
  • The importer accepts one static cURL or fetch request; it never runs JavaScript or shell syntax and does not support variables, expressions, files, multipart forms, or command chains
  • Authorization, cookies, URL credentials, proxy, forwarding, framing, Sec-*, and similar sensitive or reserved browser fields are blocked and removed from imports
  • A custom Origin is server-only and must be one absolute HTTP or HTTPS origin without credentials, a path, query, or fragment
  • Protected HTTPS reports verification success but the HTTP response does not include peer-chain, validity, protocol, or cipher details
  • Redirect following is GET/HEAD-only and capped at five hops; custom headers are removed on a cross-origin hop
  • Responses are normalized and bounded and may be truncated at 512 KiB; round-trip time is measured by the browser and includes gateway transit in Server request mode
  • There is no request history, account, collection, environment, automated replay, file upload, or arbitrary-port support

Worked example

Example input and result

Paste one browser cURL or fetch request—or enter a public URL manually—review the imported fields, then choose direct GET/HEAD or a Turnstile-protected Server request.

Input
curl 'https://www.iana.org/' -H 'accept: text/html'
Result
200 OK · GET https://www.iana.org/ · text/html · response headers, timing, and bounded body

Quick answers

Online HTTP client & API tester FAQ

Can I paste a cURL command or fetch call from browser DevTools?

Yes. Paste one Copy as cURL command or Copy as fetch call and press Apply to client. Parsing happens locally without eval or shell execution, nothing sends automatically, and the original pasted text is cleared after a successful import. Credential, cookie, proxy, forwarding, framing, and reserved browser headers are dropped with visible warnings; files and expressions are rejected. A valid Origin is retained for Server request mode.

Can this online HTTP client test an API without CORS?

For a public default-port URL, select Server request and complete fresh Turnstile. The protected gateway makes one bounded request from odmin.biz infrastructure, so browser CORS does not hide the response. It is not a general proxy: private destinations, credentials, files, arbitrary ports, large requests, and automated replay remain unavailable.

Can a server request set Origin, Referer, or User-Agent?

Yes. Protected Server request mode writes its own HTTP request and accepts bounded Referer and User-Agent values plus one syntactically valid HTTP(S) Origin. Direct browser mode remains subject to browser control, so Origin and Referer are server-only and a browser may normalize or withhold User-Agent.

Does the API tester support Authorization headers or cookies?

No. Authorization, Cookie, URL credentials, and related credential-bearing options are deliberately blocked. If a copied cURL or fetch request contains them, the importer removes them and shows a warning rather than retaining or sending them.

What data leaves my browser?

Import and cURL/fetch export are local and initiate no request. Direct GET/HEAD sends the URL and allowed headers to the destination from your browser. Server request sends the URL, method, allowed headers, text body, redirect choice, and one-time token to https://http-client.odmin.biz/. The application does not persist or intentionally log either flow.

How are redirects handled?

Redirects are returned as-is by default. For GET or HEAD, follow redirects permits up to five HTTP or HTTPS 301, 302, 303, 307, or 308 locations. The gateway repeats all public-destination checks, verifies HTTPS identity, and strips custom headers when the origin changes.

What can I send?

GET, HEAD, POST, PUT, PATCH, DELETE, and OPTIONS are supported. Up to 32 safe custom headers—including server-side Origin, Referer, and User-Agent—and a text body may be used, but the full request is capped at 16 KiB. Files, multipart uploads, cookies, authorization, URL credentials, forwarding fields, and transport-sensitive headers are blocked.

When is Turnstile required?

It is required for every Server request and automatically for every method other than GET or HEAD. Direct browser GET/HEAD skips Turnstile because the request uses your own network context and remains subject to CORS.

Keep working

View every tool →
URL parserBreak a URL into protocol, host, path, query parameters, and fragment.DNS record lookupLook up selected DNS record types through a disclosed, fixed Cloudflare resolver path.Code formatter & beautifierFormat and syntax-color JavaScript, TypeScript, JSON, CSS, HTML, Markdown, and PHP locally.