Request
Convert
Code
Changes
GET
This leaves your browser. It goes to api.github.com. Envía la petición que has escrito al servidor que has puesto en la URL.
How to use
What it is and what it is NOT
A workbench for HTTP APIs that runs entirely in your browser: no server, no account, no extension. It does four things: it sends requests and explains why they fail, converts collections between Postman, Bruno, Insomnia, OpenAPI, HAR and curl, generates code in eleven languages, and compares two versions of an API to tell you what breaks.
What it is NOT: a replacement for Postman or Bruno. A web page cannot call localhost nor any API that does not publish CORS headers — that is not a limitation of this tool, it is how browsers work. For your local API, a desktop client. Here, in exchange, you get what they cannot give you: knowing what the browser actually did.
The CORS forensics — what can only be done from here
When a request to another domain fails, the browser says TypeError: Failed to fetch and nothing else. That message cannot tell apart "my server is down" from "my server answered and the browser hid the response from me" — two problems with opposite fixes.
This tool separates them: on failure it sends a second, opaque request to the same address. That one the browser does send, and it does not reject it over CORS. If it completes, your server answered and what is missing are headers. If it does not, the server was never reached and CORS has nothing to do with it.
Postman and Bruno cannot do this: they are desktop programs and CORS does not apply to them.
The preflight, flagged before you send
With methods such as PUT, PATCH or DELETE, with a Content-Type that is not a form one, or with any custom header, the browser first sends an OPTIONS request asking permission. If your server does not answer it, the real request never leaves even though your API works perfectly.
The tool tells you before you send, and points at which of the three things causes it, because the fix is different in each case.
Why you do not see every response header
The browser only lets you read seven headers (content-type, cache-control…). The rest are there —you can see them in the Network tab— but JavaScript cannot touch them unless the server publishes them with Access-Control-Expose-Headers.
If your X-RateLimit-Remaining is missing, that is not a bug: that is why. The tool warns you when only the seven arrive.
The same when sending: there are headers the browser will not let you set (Host, Origin, Cookie, User-Agent…). They are dropped and you are told which, rather than pretending they were sent.
Converting collections (and why offline matters)
Paste or drop a Postman or Insomnia export, a browser HAR, an OpenAPI specification (JSON or YAML), a Bruno .bru file or a handful of curl commands: the format is detected for you. It comes out as a Bruno collection (a .zip with its folder tree), as a Postman collection or as curl commands.
Why here and not in any web converter: an exported collection has your tokens inside it. It is exactly the file you should not upload to someone else's server in order to convert it. Here it never leaves the browser — and the tool lists the credentials it finds, masked, so you know what you are about to share.
What cannot be converted is said out loud, not hidden
Postman's scripts (pm.test, pm.environment) and Bruno's are code against a runtime that does not exist here: they are not translated. File fields store the disk path of whoever exported them, not the contents. Insomnia templates only mean anything inside Insomnia.
All of that shows up as a warning on import. A migration that eats your scripts without mentioning it is the kind you find out about in production.
Generate code
Whatever request you have set up, ready to paste into eleven targets: cURL, fetch, axios, Python (requests), HTTPie, Go, Java, C#, PHP, PowerShell and Rust.
These are not illustrative snippets: they come with their import lines, with each language's escaping —an apostrophe in the body will not split your command— and with the details that are habitually got wrong (in C# the Content-Type belongs to the content and not to the headers; in Go an unused import does not compile).
What breaks between two versions of your API
Paste two OpenAPI specifications and it tells you what changed and which of those changes break a client that already exists. That is the real question before you deploy, and it is the one a colour diff does not answer.
Pairs that look identical in a diff and mean the opposite: adding an optional parameter breaks nothing, adding a required one does; adding a value to a list breaks nothing, removing one does; removing a query parameter is ignored, removing a path one changes the URL.
Every finding says why, not just what: a verdict without the reason forces you to take its word, and with it you can argue. The report comes out in Markdown so you can paste it into a pull request.
What leaves your browser, and when
Converting, generating code and comparing specifications send nothing anywhere: they happen entirely inside your browser.
Sending a request does leave, obviously: it goes to whichever server you type, with your headers and your body. The first time, you are shown exactly what will be sent —method, address, every header and the body— with credentials masked but counted. After that, the notice next to the button keeps telling you which machine each request goes to.
And in order to diagnose a failure, a second request is sent to that same address, with no headers and without reading the response, purely to find out whether the server is alive.
