Requests with every method and parameter
Pick GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS, or type any custom verb your API uses. The request builder keeps query parameters and the URL in sync, supports path variables written as :id, and lets you disable individual rows or add a description to them instead of deleting them. Variables in double braces, such as {{baseUrl}}/users/{{userId}}, are highlighted and autocompleted, and a missing variable is flagged before you send.
Every body type
The body editor covers the modes real APIs use:
- none for GET and DELETE calls
- form-data with text fields and file fields, each with an optional content type
- x-www-form-urlencoded for classic form posts
- raw with JSON, XML, HTML, JavaScript or plain text, and syntax highlighting
- binary to send a file as the whole body
- GraphQL with a query and variables (see the GraphQL client)
Authentication helpers
Choose an auth type per request, or let it inherit from its folder or collection. Supported types are API key (header or query), Bearer token, JWT, Basic, Digest, OAuth 1.0, OAuth 2.0 (authorization code with or without PKCE, implicit, password and client credentials, with refresh), Hawk, AWS Signature v4, NTLM, Akamai EdgeGrid and ASAP. The details are on the authorization page.
A response viewer built for debugging
Every response shows the status, total time, size and a timing breakdown (DNS lookup, TCP connect, TLS handshake, time to first byte and download). The body can be viewed pretty-printed, raw or as a rendered preview, and you can search it. Headers and cookies get their own tabs, and the network details include the TLS protocol, cipher and the server certificate (subject, issuer, validity, SANs and fingerprint). Save any response as an example: examples feed mock servers and published documentation.
Request settings when you need them
Per request you can turn SSL certificate verification off for a test server, choose whether redirects are followed (with a limit, and whether the original method is kept), set a timeout, and adjust TLS options such as disabled protocol versions and cipher order. A cookie jar stores cookies per domain and a cookie manager lets you inspect, edit and delete them.
How it works
- Open swastik.codes/app. You can build and organise requests straight away in a local workspace stored in your browser.
- Create a free account to send. The web app cannot make arbitrary cross-origin calls itself, so it sends each request through the Swastik Codes server, which runs the same Rust HTTP engine used everywhere in the product.
- Save the request to a collection, add tests, and generate a snippet in one of 30 code generation targets.
Because requests leave from our server, the target must be reachable on the public internet. For safety the server refuses private, loopback, link-local and other reserved addresses, so localhost and LAN IPs will not work through it. To reach them from the web app, run swc bridge on your computer and switch on Local bridge in the status bar; requests then leave from your machine. The desktop app for Windows and Linux does the same on its own.
A quick example: a JSON POST using environment variables.
POST {{baseUrl}}/v1/orders
Content-Type: application/json
Authorization: Bearer {{accessToken}}
{
"sku": "{{$guid}}",
"quantity": {{$randomInt}},
"createdAt": "{{$isoTimestamp}}"
}Dynamic variables such as {{$guid}}, {{$timestamp}} and {{$randomInt}} are generated fresh on every send.
History and the console
Every request you send is recorded in history (the newest 500 per user and workspace are kept for signed-in users), so you can reopen and resend it. The console panel shows the exact request that went out, script logs and script errors, which is usually where a confusing bug becomes obvious.
Frequently asked questions
Do I need an account to use the REST client?
In the browser, yes: a free account, because the web app sends requests through the Swastik Codes server. Sign up with GitHub or email. The desktop app works without an account.
Can I call an API running on localhost?
Yes, with the local bridge. The cloud proxy refuses private and loopback addresses to protect itself and other users, so run swc bridge on your computer and switch on Local bridge in the app's status bar: requests and collection runs then run on your machine. No browser extension or CORS settings are needed. The desktop app for Windows and Linux also runs requests locally.
Is there a size limit on responses?
Yes. Responses sent through the server are capped at 50 MB and request timeouts at 300 seconds, which covers normal API testing.
Can I bring my existing Postman requests?
Yes. Import Postman collections (v2.0, v2.1 and v3), environments and globals. See importing a Postman collection.