HTTP echo
See exactly what your HTTP client sends.
Checking this session…
See what reaches your server
Send a request from your app, curl, or this workbench. The response shows what the server received, with credential fields redacted.
Open an existing mock API
About HTTP echo
Create an expiring echo endpoint that reflects the method, path, query, headers and body observed by this server.
When to use it
Create an expiring echo endpoint that reflects the method, path, query, headers and body observed by this server.
POST /check?source=demo → method, path, query, redacted headers and parsed JSON bodyHow to use it
- Configure the endpoint and choose private or public access.
- Create it and send requests from your client.
- Inspect test output, update or delete the resource when finished.
Inspect what actually arrives
Create a temporary endpoint and call it from your application or this request lab. The response separates method, relative path, query parameters, headers and request body. Repeated query parameters remain visible as arrays. JSON bodies are parsed for inspection, plain text stays text, and binary data returns its byte count without reflecting its contents.
The workbench lets you choose a method, relative path, query, custom headers and JSON or text body. Send is explicit; opening the page never sends a request. The preview shows the observed fields, request byte count and the browser-measured round trip. That timing is one request measurement, not uptime monitoring.
Private access and short-lived resources
New endpoints are private. Supply the separate caller token in X-Access-Token or use authorized workspace access. A management token controls configuration and lifecycle; it does not grant private caller access. Public sharing lets anyone who knows the endpoint use it. Header, query and JSON fields whose names resemble credentials are redacted, as are known supplied authorization values.
Use synthetic test data. A field-name rule cannot recognize every secret hidden in a free-form message. Requests pass through this deployment but are not saved as history. The resource stores its configuration and usage count, with the same expiry, ownership, renewal and deletion as mock APIs. This endpoint does not forward requests elsewhere or expose a client-IP field.
A useful companion to API integration tests
Use the echoed result to check whether your HTTP client sent the intended content type, body and custom headers. For example, send the same JSON from curl and your application, then compare the observed fields. Private CORS access uses an explicit token header; cookies are not required for shared callers.
The endpoint works through HTTP, the SDK request method, the CLI api command, the SSH command gateway and MCP call_mock_api. Caller tokens stay separate from endpoint URLs. Use a webhook inbox when you need retained capture history, and an API test scenario when you want assertions across a sequence of requests.
Limits & privacy
Uses an expiring mock resource, private by default, with separate management and access credentials. Public access is optional. Standard resource quotas, ownership, renewal and deletion apply. Private access tokens are sent in headers, never in share URLs. Requests are processed but not retained. Credential-like fields are redacted; use synthetic data because arbitrary text can still contain secrets. Bodies are limited to 100 KiB; binary content returns byte metadata, not the raw bytes. This does not forward requests or expose client IP addresses. Standard mock quotas, ownership, renewal and expiry apply.
Use this tool from the API reference or connect through the SDK, CLI, SSH, or MCP. Hosted calls share your plan allowances.