Debug an HTTP client with a temporary echo endpoint
See the method, query, headers and body your HTTP client actually sends, with a private temporary echo URL and a readable request preview.
Compare the request you intended with the request received
An HTTP client can look correct in application code while sending something different on the wire. A missing content type may turn a JSON object into plain text. A wrapper may omit a custom header. Query parameters may be encoded twice, or a request body may disappear because the selected method does not support it. A temporary echo endpoint makes those differences visible without writing and deploying a debugging server.
An echo endpoint answers with a description of the request it received. It does not call your real API, look up a database record or validate your application’s business rules. Its job is narrower: give you evidence of the method, path, query, headers and body that reached this service. That makes it a useful first stop when a client and a real backend disagree about a request.
Start with private access and a small payload
Create an HTTP echo endpoint and keep the returned resource ID and management credential. The default is private sharing. A caller uses the separate access token in an X-Access-Token header, or authorized workspace access. The base URL contains the resource ID only, so copying it does not also copy a private credential into browser history or a chat preview.
Begin with a tiny synthetic event: an event name, a test ID and a boolean flag. Add the fields you are trying to debug one at a time. An echo service receives the request body even though it does not retain request history, so it should not be used as a destination for real customer records or production authentication secrets.
Read a structured result instead of scanning a wall of JSON
The request lab has a method selector, a relative path and query field, custom headers, and a JSON or plain-text body editor. Press Send request to make one real HTTP request. Nothing runs on page load. The result places the observed method, byte count and round-trip measurement first, then separates query parameters, headers and the body into readable sections.
A POST with JSON should show a JSON body and the expected content type. A GET should not carry the draft body still present in the editor. Repeated query keys are returned as arrays so you can check whether your client preserves all values. The relative observed path excludes the platform’s /mock/{id} prefix; it represents the route you appended to the endpoint.
Understand header and credential handling
The service reflects the headers visible to its HTTP server. Browsers and proxies can add or normalize headers, and CORS can prevent a browser from sending headers that curl permits. Compare actual observations rather than assuming a browser has the same permissions as a command-line client. Cross-origin private access requires an explicit caller header and a successful preflight.
Credential-like header, query and JSON field names are replaced with a redaction marker. Known supplied authorization values are also removed from reflected text. This reduces accidental exposure in a copied result, but cannot identify every secret hidden in arbitrary text or an encoded binary payload. The workbench limits custom headers to Accept and non-credential X-* names and attaches the caller token separately.
Check the body format without pretending every payload is JSON
Valid JSON is parsed for inspection with protections against unsafe numeric conversion. If a body claims to be JSON but cannot be safely parsed, the endpoint returns text with a notice instead of silently changing its meaning. Plain-text content remains a string. Invalid UTF-8 binary data is described by its byte count and content type; raw bytes are not reflected.
The endpoint accepts request bodies up to the platform’s 100 KiB limit, while the browser editor is bounded to 64 KiB. The resource has the standard mock request-rate limit and expires according to its lease. These bounds keep the tool suitable for debugging a small integration payload. Large file transport and persistent application storage belong to different tools.
Reproduce the result in a script
The same endpoint can be called directly with curl, through the TypeScript SDK request method, with socket-help api in the CLI or SSH gateway, or using MCP call_mock_api. For a private endpoint, provide the caller token separately. Management operations continue to use the /api/mocks/{id} lifecycle with management authority.
Once the basic request looks right, move the real integration test to an endpoint you control. Use API test scenarios for a repeatable sequence with explicit checks and separate secret inputs. Use a webhook inbox if the sender is asynchronous and you need to inspect retained deliveries later. An echo response describes one request; it does not establish that an external system delivered a callback or that a business operation succeeded.