TestingAPIs is still being built. If something breaks, email support@testingapis.com.

API reference

testingapis.com is a free API for testing HTTP clients. It has 360 endpoints in 53 groups: realistic resources such as products, books and countries, plus endpoints for status codes, redirects, cookies, caching, authentication schemes, file formats, streaming and failure injection. Echo, HTTP methods, status codes, and the products, posts and todos resources need no account. The rest need a free account: send its API key in the X-TestingApis-Key header.

Base URL
https://api.testingapis.com
Quick start
fetch('https://api.testingapis.com/api/Products?limit=3')
  .then(res => res.json())
  .then(data => console.log(data))
Sign in to download the OpenAPI specSign in to open Swagger UI

Discovery

WhatWhere
OpenAPI 3.0 documenthttps://api.testingapis.com/openapi/v1.jsonSign in to see
Swagger UIhttps://api.testingapis.com/swagger/index.htmlSign in to see
Live route catalogGET https://api.testingapis.com/apiSign in to see
Health checks
GET https://api.testingapis.com/api/healthGET https://api.testingapis.com/api/health/liveGET https://api.testingapis.com/api/health/ready
GraphQL
POST https://api.testingapis.com/graphql
Sign in to see
Queries and mutations
WebSockets
wss://api.testingapis.com/ws/echowss://api.testingapis.com/ws/ticker
Sign in to see

Authentication

Endpoints without an authentication note are public. The endpoints that test authentication accept the fixed test credentials below. They are not secret.

SchemeHow to send itTest valuesUsed by
HTTP BasicAuthorization: Basic base64(user:pass)apibee / password123 · Admin / Admin@1234 (original API)/api/auth/basic*, /api/AuthTest/secure-data
Bearer (static)Authorization: Bearer <token>apibee-token-123 · admin-token · user-token · readonly-token/api/auth/bearer, /api/auth/roles/*
JWTAuthorization: Bearer <jwt>POST /api/auth/jwt/login with admin / admin123 or user / user123 · POST /api/User/Login with Michael / Thompson/api/auth/jwt/me, /api/auth/jwt/admin, /api/Admin/authorize
API keyX-API-Key header, ?api_key= or api_key cookieapibee-key-123/api/auth/api-key/*
OAuth 2.0Authorization: Bearer <access_token>Clients apibee-client / apibee-secret and apibee-public (PKCE) · users apibee / password123, jane / jane123/api/auth/oauth/protected, /userinfo
OAuth 1.0aAuthorization: OAuth oauth_consumer_key="…", oauth_signature="…", …Consumer apibee-consumer-key / apibee-consumer-secret · token apibee-access-token / apibee-token-secret (never expires) · HMAC-SHA1, HMAC-SHA256, HMAC-SHA512 or PLAINTEXT/api/auth/oauth1, /api/auth/oauth1/*
DigestRFC 7616 challenge and responseapibee / password123/api/auth/digest
HMAC signatureX-Timestamp and X-Signature headersSecret apibee-hmac-secret/api/auth/hmac
Session cookieCookie apibee_sessionPOST /api/cookies/login with test / test123 or admin / admin123/api/cookies/me
CSRFXSRF-TOKEN cookie and X-CSRF-Token headerToken from GET /api/auth/csrf/token/api/auth/csrf/submit

A 401 means credentials are missing or invalid. A 403 means they are valid but not allowed, for example user-token on /api/auth/roles/admin.

Examples use these placeholders for values that change per run:

PlaceholderWhere to get it
{{userJwt}} / {{adminJwt}}accessToken from POST /api/auth/jwt/login with user / user123 or admin / admin123.
{{refreshToken}}refreshToken from POST /api/auth/jwt/login.
{{legacyJwt}}token from POST /api/User/Login with Michael / Thompson (role Admin).
{{oauthAccessToken}}access_token from POST /api/auth/oauth/token.
{{oauth1RequestToken}} / {{oauth1RequestSecret}} / {{oauth1Verifier}}oauth_token and oauth_token_secret from POST /api/auth/oauth1/request_token with oauth_callback=oob, then oauth_verifier from GET /api/auth/oauth1/authorize.
{{csrfToken}}token from GET /api/auth/csrf/token. The same value is set as the XSRF-TOKEN cookie.
{{sessionId}}apibee_session cookie set by POST /api/cookies/login (test / test123).
{{unixTimestamp}} / {{hmacSignature}}The current Unix time in seconds, and the hex HMAC-SHA256 of "{timestamp}.{raw body}" with key apibee-hmac-secret.
{{uuid}}Any new UUID, used as an Idempotency-Key.

Sign in to see the details

The parameters, request and response examples and the live Try it panel for the authentication endpoints are for signed-in members. Accounts are free and take a few seconds to create.

Sign inCreate a free account

Delays and simulated errors

Two query parameters work on every endpoint:

ParameterEffectExample
delayWaits N seconds before responding. Maximum 10./api/Products?delay=2
errorReturns a simulated error instead of the real response: 400, 401, 403, 404, 408, 429, 500, 502 or 503. Adds the header X-Simulated: true./api/Products?error=503

Combined, as in ?delay=2&error=503, the request waits and then fails. A simulated error looks like this:

Simulated error
{
  "status": 503,
  "error": "Service Unavailable",
  "message": "Simulated error. Use ?error={code} to test different status codes.",
  "simulated": true
}

Filtering, sorting and pagination

Every resource list endpoint, such as GET /api/Products, accepts these query parameters:

ParameterMeaningExample
limitPage size, 1 to 100. Without it, all records are returned.?limit=10
page1-based page number. Requires limit.?limit=10&page=2
offsetSkip N records, as an alternative to page.?limit=10&offset=20
sort, orderSort by any field. order is asc (default) or desc.?sort=price&order=desc
qCase-insensitive search in title, name, body, description and text fields.?q=keyboard
any fieldExact, case-insensitive filter on that property.?category=books&inStock=true

Lists return a plain JSON array. Totals are in the X-Total-Count, X-Page, X-Per-Page and X-Total-Pages headers. Cursor, Link header, keyset and HAL pagination are shown in Pagination.

Responses and errors

SituationStatusBody
Get one record200The record
List records200Array of records, plus pagination headers
Create201{ message, data }
Bulk create201{ message, data: [ … ] }
Replace or update200{ message, data }
Partial update (PATCH)200{ message, changed, ignored, data }
Delete200{ message }
Bulk delete200{ message, deleted, notFound }
Error4xx or 5xx{ status, error, message }
Model validation error400application/problem+json with errors per field
Business validation422application/problem+json (RFC 7807) with errors per field
Error
{
  "status": 404,
  "error": "Not Found",
  "message": "Book with ID 999 does not exist."
}

Every response allows any origin (Access-Control-Allow-Origin: *, without credentials) and exposes the pagination, caching, rate limit and versioning headers to browser code. The X-RateLimit-* headers are informational; real limiting only happens on Rate limit.

All data lives in memory. Creates, updates and deletes work, but everything returns to the seed data when the server restarts.

Calling from a browser

  • Cookies. Browsers do not let JavaScript set the Cookie header, and cross-origin requests carry no credentials. Cookie-based endpoints only work from the same origin or through the proxy.
  • Redirects. fetch() follows redirects and hides the 3xx response. To see the real status and Location header, use the proxy.
  • Proxy. POST /api/Proxy/call forwards a request from the server and returns its status and body. It avoids CORS, cookie and redirect limits, but does not relay response headers.
  • Streams. /api/stream/sse is Server-Sent Events. The NDJSON, chunked, drip and JSON array streams arrive incrementally; read them with a streaming reader.
  • WebSockets. /ws/echo and /ws/ticker need the WebSocket API, not fetch.
  • Digest auth. Browsers only perform the challenge and response through their own login prompt.
  • Failure injection. /api/chaos/abort and /api/chaos/partial drop the connection on purpose. /api/chaos/timeout and /api/chaos/slow can take up to 60 seconds.
  • Forbidden headers. Browsers refuse to set Host, Content-Length, Accept-Encoding, Cookie and a few others.

Sign in to see the details

The parameters, request and response examples and the live Try it panel for these notes are for signed-in members. Accounts are free and take a few seconds to create.

Sign inCreate a free account

Endpoints

360 endpoints in 53 groups. Each group opens its reference, with parameters and example requests and responses.

Start here

4 endpoints

A live catalog of every endpoint, plus health checks.