APIAPI 테스트 도구
HTTP 요청 테스트, 헤더·바디·메서드 커스터마이징 (Postman 라이트)
REST API Tester Complete Guide
REST API Tester is a free online tool for sending HTTP requests and inspecting responses directly from the browser — no installation required. It supports GET/POST/PUT/PATCH/DELETE methods, custom headers, and JSON request bodies. Essential for API development, debugging, and documentation validation.
HTTP Methods Reference
Each HTTP method in REST carries specific semantics. Choosing the correct method is the core of RESTful design.
GET / DELETE
GET retrieves a resource — no body, data passed via URL and query strings. DELETE removes a resource. Both are idempotent — sending the same request multiple times produces the same result.
POST / PUT / PATCH
POST creates a new resource. PUT fully replaces a resource (all fields required). PATCH partially updates a resource (only changed fields). PUT is idempotent; POST is not.
| Method | Purpose | Body | Idempotent |
|---|---|---|---|
| GET | Read | No | Yes |
| POST | Create | Yes | No |
| PUT | Full update | Yes | Yes |
| PATCH | Partial update | Yes | Conditional |
| DELETE | Delete | No | Yes |
Authorization Header Setup
Bearer Token (JWT)
The most common authentication method. Header key: Authorization, value: Bearer eyJhbGciOiJIUzI1NiIs...
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Basic Auth
Base64-encode username:password. Value: Basic dXNlcjpwYXNz
Authorization: Basic dXNlcjpwYXNzd29yZA==
API Key Header
Varies by service, but typically uses X-API-Key or api-key headers.
X-API-Key: your-api-key-here
Understanding and Fixing CORS Errors
CORS (Cross-Origin Resource Sharing) is a browser security policy that blocks direct calls to APIs on different domains unless the server explicitly allows it. Solutions:
- Add
Access-Control-Allow-Origin: *header on the server side - Route API calls through a backend proxy
- Use a CORS proxy service during development (cors-anywhere)
- Browser extensions (development only — never in production)
Frequently Asked Questions
- How does this compare to Postman? — This is a lightweight, zero-install client. Postman excels at team collaboration, environment variables, and test scripts.
- Can I test HTTP (non-HTTPS) APIs? — Yes, but browser security may block HTTP API calls from an HTTPS page (mixed content).
- Is the response time (ms) accurate? — It measures round-trip time using browser performance.now(). Actual server processing time may differ slightly.
- Does it support file uploads (multipart)? — Currently only JSON body is supported; multipart/form-data is not available.
Tip: Sample APIs like JSONPlaceholder allow CORS, so you can test tool features immediately without any setup.