Guides
HTTP Methods
GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, TRACE and CONNECT — what each one means, which are safe, idempotent or cacheable, and when to use PUT instead of PATCH.
HTTP Headers
Request and response headers that matter: Content-Type, Accept, Authorization, Cache-Control, CORS headers and rate-limit headers.
REST API Testing
A practical guide to what to test on an API — status codes, schema, auth, error handling, edge cases and performance — plus a checklist you can work through.
HTTP Status Codes
A reference page for each status code you are likely to meet, covering what it means, who caused it and how to fix it.
What Is a REST API?
Resources, representations, statelessness and the constraints that make an API RESTful — written for people who need to use one today.
REST vs GraphQL
Over- and under-fetching, caching, error handling and the N+1 problem — an even-handed comparison rather than a verdict.
PUT vs PATCH
Full replacement versus partial update, why PATCH is not guaranteed idempotent, and the two standardised patch body formats.
CORS Explained
Why a CORS error is enforced by your browser rather than returned by the server, what triggers a preflight, and how to actually fix it.
Bearer Tokens
What Authorization: Bearer means, why possession alone grants access, and how to debug a token that keeps returning 401.
API Authentication Methods
API keys, Basic auth, bearer tokens, OAuth 2.0 and mTLS — how each works and which to reach for.
OAuth vs JWT
These are not alternatives: OAuth is an authorisation framework, JWT is a token format. Untangling a common confusion.
API Rate Limiting
Token bucket versus sliding window, reading Retry-After, and why backoff needs jitter.
Where to start
If you are new to working with APIs directly, read the guides in order. HTTP
methods establishes the vocabulary — what it means for a request to be safe or idempotent, and why that
distinction decides whether a client may retry after a timeout. HTTP headers
then covers the metadata that travels with every request and response, which is where most surprising
behaviour comes from: a wrong Content-Type, a cache that is too aggressive, a CORS preflight
that never gets a matching Access-Control-Allow-Headers.
Once the protocol makes sense, REST API testing is about method: what you should actually check on each endpoint, how to build a suite that catches regressions, and where manual exploration still beats automation. The status code reference is the thing you will come back to most — bookmark it.
Try things as you read
Reading about OPTIONS preflights is much less useful than sending one. Every concept in these
guides can be reproduced in the browser: open the free online API tester, point it at a public
endpoint like https://api.github.com/users/octocat, and change one thing at a time. Swap the
method, drop a header, send a malformed body, and watch what the status code and response headers do.
Tools referenced in these guides
REST API Tester
Send requests to REST endpoints with full control over method, headers, auth and body.
JWT Decoder
Inspect a bearer token's claims and expiry when authentication is failing.
JSON Formatter
Format and validate a request or response body before you send or read it.
Base64 Encoder
Build or decode the credential string used by HTTP Basic authentication.
URL Encoder
Percent-encode query parameter values so they survive the trip intact.
All tools
The full set of small utilities for working with HTTP, JSON and tokens.
About these guides
Everything here follows the current HTTP specifications — primarily RFC 9110 (HTTP Semantics), which replaced the older RFC 7231 family, along with RFC 9111 for caching and RFC 6749 for OAuth 2.0 bearer usage. Where real-world practice diverges from the spec, that is called out rather than glossed over, because the API you are testing was probably built against the practice, not the RFC.
These pages are free, have no paywall and set no cookies. See about this site for who builds it and privacy for exactly what happens to a request you send through the tester.