Free Online API Response Viewer
Inspect JSON API responses, status, headers, and timing.
The body is not valid JSON, so it is shown as plain text.
| Header | Value |
|---|
No readable headers were exposed. Cross-origin responses only reveal a small allowlisted set unless the server opts in.
Browsers hide response headers and bodies from origins that do not send an
Access-Control-Allow-Origin header. If a request fails while the same URL works in a terminal or
a REST client, CORS is the most likely reason.
About the API Response Viewer
When an integration misbehaves, the fastest way to find out why is often to look at the raw response. This viewer sends a GET request from your browser, then shows the status code, elapsed time, response headers, and body. JSON is automatically pretty-printed, while other content types are displayed as plain text. It is a convenient scratchpad for checking a public endpoint, inspecting a paginated list, or confirming that an API returns the field names you expect.
Why a request might fail
Browser JavaScript is constrained by the same-origin policy. A page can read a response from another origin
only when that server explicitly allows it through CORS headers such as
Access-Control-Allow-Origin. Many APIs permit the whole world, some permit only selected domains,
and some permit none because they expect to be called from a server. When permission is missing, the browser
rejects the request and JavaScript receives a generic network error. It cannot reveal the status code or body,
even if the server actually answered.
- No status shown: the request never reached a readable response, usually because of CORS or a network failure.
- Mixed content: an HTTPS page cannot call an HTTP endpoint; the browser blocks it before the request leaves the tab.
- Private addresses: requests to localhost or a private network may be blocked by the browser's private network rules.
- Authentication: this tool does not send cookies or custom tokens, so endpoints that require a login will return 401 or 403.
The timing figure measures how long the browser waited for the response body, not server processing alone. DNS lookup, connection setup, TLS negotiation, redirects, and transfer time are all included. A large JSON document can therefore appear slow even when the server is quick. Body size is measured from the decoded text, so it may differ from the compressed transfer size reported by developer tools.
Pretty printing re-serializes valid JSON with two-space indentation. Key order is preserved as the parser saw it, but comments, duplicate keys, and exotic number formats are normalized. If the body is HTML, XML, plain text, or an error page, the raw view is the honest representation. The copy and download actions operate on the currently visible representation so you can attach a response to a bug report without editing it first.
Only GET is supported on purpose. A public tool should not make it easy to trigger state changes on a third party service, and cross-origin preflight requirements make most write requests unreliable anyway. If you need to test POST, PUT, or DELETE, use a local client such as curl, HTTPie, or your framework's test harness. No request data is stored by this page beyond the current session in memory.
How to use this tool
- Paste an HTTPS URL that returns JSON or text.
- Click Send request and wait for the status, timing, and body.
- Switch between pretty, raw, and header views.
- Copy the visible body or download it as a file.
Frequently asked questions
Can this tool bypass CORS?
No. CORS is enforced by the browser and cannot be disabled from page JavaScript. A proxy service would be required, and this tool deliberately does not use one, so your request goes only to the URL you entered.
Why does the status show 0 or nothing?
A zero status is not an HTTP response. It usually indicates a network error, a blocked mixed-content request, a DNS failure, or a CORS rejection. Check the browser console for the underlying message.
Are my request URL and response stored on a server?
No. The request is made directly by your browser to the target API. This page does not relay it and does not log the URL or body.