Inspect a JSON API Response
Make one GET request from your browser and inspect the response without installing an API client. JSON is pretty-printed, plain text is shown unchanged, and the status, content type, and byte size are visible. The request sends no credentials and no custom authorization header, requires the endpoint to allow browser CORS, and limits the response body to 2 MB.
Use this without the search next time. Prathom Workbench puts Prathom's tools in your toolbar.
Add to Chrome — freeWhat it does
- Make a browser-side GET request
- Pretty-print valid JSON responses
- Show HTTP status, content type, and size
- Keep credentials and custom auth headers off
- Limit response bodies to 2 MB
How to use API Response Viewer
- 1
Enter an endpoint URL
Paste an HTTP or HTTPS URL for a GET endpoint that permits browser CORS requests. Do not put secrets or bearer tokens in the URL.
- 2
Inspect the response
Press Inspect GET response. The request runs directly from this tab with credentials omitted and a small Accept header for JSON or text.
- 3
Review metadata and body
Check the HTTP status, content type, byte size, and formatted body. Error responses remain visible for debugging and are marked with a warning.
- 4
Copy or download
Copy the response or download a local text snapshot after removing sensitive data if it will be shared.
How it works
Inspecting a response safely
Start with a response that does not contain production secrets, access tokens, private customer data, or full authorization headers. Use the status line to separate transport success from application success, then inspect headers and the parsed body independently. Large or malformed payloads may be valid HTTP while still being unusable to the client. Keep a redacted sample when documenting an issue and compare the response against the API contract rather than assuming a familiar field name has the expected type.
The viewer uses the browser Fetch API with GET, credentials: omit, and a small Accept header. It accepts both HTTP and HTTPS URLs, checks the declared and measured response size, and then tries strict JSON parsing. Valid JSON is formatted with two-space indentation; all other response bodies are shown as text. The HTTP status is preserved, so a 404 or 500 body can be inspected without being mistaken for a successful response.
This design intentionally does not provide a server proxy, arbitrary methods, cookies, request bodies, or custom headers. Those features are useful in a full API client but carry a different security and privacy risk. They also cannot bypass browser CORS. A direct browser request is honest about what a public API supports and keeps credentials out of the workflow.
CORS and errors
If the endpoint does not return an appropriate Access-Control-Allow-Origin header, the browser will expose a network error instead of the body. That is a browser security boundary, not a problem this page should work around. For an authenticated or internal API, use a trusted client with an explicit environment and secret-management policy. Never put a bearer token or API key in a query string just to make a GET request work.
Review before sharing
The page can copy or download the body, which makes sharing convenient and also creates another copy of potentially sensitive data. Remove secrets and personal records before attaching a response to an issue. The local viewer is a debugging aid, not a logging or storage service, and it does not guarantee that the remote endpoint, browser history, extensions, or downloads retain nothing.
Examples
Inspect a public status endpoint
The endpoint must include an Access-Control-Allow-Origin policy that permits your browser origin.
Debug an error response
Non-2xx responses are not hidden; the status warning tells you that the body is an error response.
Frequently asked questions
Why does the request fail with a CORS error?
Browsers block cross-origin responses unless the API opts into browser access with CORS headers. This tool does not proxy the request around that policy, so use an endpoint you control or an API client designed for server-side requests.
Can I send an API key or Authorization header?
Not in this minimal viewer. It deliberately sends no credentials and no custom authorization header, reducing the chance of exposing a secret to an unfamiliar endpoint. Use a trusted API client with explicit secret handling for authenticated requests.
Is the response uploaded or stored?
No. The GET request goes directly from your browser to the URL, and the response is kept in this tab until you clear it or leave the page. The browser, endpoint, extensions, and downloaded copies still have their own privacy considerations.
Why is the response limited to 2 MB?
The limit prevents accidentally loading a large export into the page and keeps the viewer responsive. Use a streaming or command-line client for large responses rather than truncating them silently here, because complete data matters for debugging.