REST and GraphQL API Tools
API Tools are for developers building or consuming HTTP APIs. The REST API Tester sends a real request from your browser, shows the status, timing, headers and body, and converts requests to and from cURL. The rest of the group is about GraphQL: running operations, learning how queries are structured, keeping SDL tidy and valid, generating TypeScript types and estimating how expensive a query is.
7 free tools · no sign-up · no ads
All API Tools (7)
API Tester
Send real HTTP requests and copy them as cURLGraphQL Playground
Test and explore GraphQL APIsGraphQL Query Builder
Build GraphQL queries visuallyGraphQL Schema Formatter
Format and beautify GraphQL schemasGraphQL Schema Validator
Validate GraphQL schema syntax and structureGraphQL TypeScript Generator
Generate TypeScript types from GraphQL schemasGraphQL Complexity Analyzer
Analyze GraphQL query complexity and performance
Which tool do I need?
Replay an API call from DevTools and tweak it
Use Copy as cURL in Chrome or Firefox and paste it into the REST API Tester to fill the form, then change headers or the body and send it again.
Run a GraphQL query with a bearer token
Put the operation in the GraphQL Playground, variables in the Variables tab and Authorization in the Headers tab, then press Run.
Find out why a GraphQL server rejects my schema at startup
Format the SDL to spot syntax errors, then run the validator for spec errors with line numbers, such as an input type used as a field type.
Get TypeScript types for a GraphQL schema
The GraphQL TypeScript Generator writes interfaces, enums and Args types, mapping nullable fields to T | null and custom scalars to unknown.
Check whether a nested query is too expensive to run
The Complexity Analyzer multiplies page sizes through nested lists to estimate field resolutions and flags page sizes above 100.
Learn how GraphQL selection sets and variables are written
Click fields on the sample schema in the GraphQL Query Builder and watch it write a correctly indented operation with arguments and variables.
About API Tools
The GraphQL tools fit a schema-first workflow. Format the SDL with the GraphQL Schema Formatter, then run the GraphQL Schema Validator to catch unknown types, broken interfaces and a missing query root, the same checks a server performs at startup. The GraphQL TypeScript Generator turns the schema into interfaces, enums, unions and argument types whose nullability matches the schema exactly. On the client side, write an operation in the GraphQL Playground and send it, and check its depth and estimated cost with the GraphQL Complexity Analyzer before pointing it at production. The GraphQL Query Builder uses a fixed sample schema to teach selection sets, arguments and variables; it does not load your API.
The two tools that send requests, the REST API Tester and the GraphQL Playground, go straight from your browser to the endpoint, so browser rules apply: the API must allow CORS from this site, an HTTPS page cannot call a plain http:// URL, and headers such as Cookie, Host and Origin cannot be set. When the browser blocks a call, the copied cURL command gets around it. The schema tools run locally. The Complexity Analyzer works without your schema, so it cannot see unpaginated list fields and its cost is a lower bound.
Guides
- Testing REST APIs from the Browser: Methods, cURL and CORSWhy an API call works in curl and fails in the browser, what a CORS preflight is, which headers a page can never set, and how to move requests between DevTools and a terminal.
- GraphQL Schemas and Queries: Validation, Types and Query CostHow SDL is checked, why nullability trips up TypeScript types, what a selection set needs, and how nested pagination turns a short query into a very expensive one.
Frequently asked questions
What is CORS and why does it block browser API clients?
CORS is the browser rule that lets a server decide which other websites may call it from JavaScript. A browser-based client such as the REST API Tester or GraphQL Playground can only read a response if the API sends Access-Control-Allow-Origin for this site. curl and server-side code are not browsers, so the rule does not apply to them.
Should I test APIs in the browser or with a command-line client?
Use the browser for quick checks of APIs that allow CORS and for turning DevTools requests into cURL. Use curl or a desktop client when you need cookies, custom Host or Origin headers, plain http:// endpoints, or to see redirects as they happen, because browsers control all of those.
When is GraphQL a better choice than REST?
GraphQL helps when different clients need different shapes of related data from one endpoint and you are ready to manage query cost and depth. REST is simpler when resources map cleanly to URLs and you want standard HTTP caching. Many teams run both.
Do the GraphQL tools need introspection access to my server?
No. The formatter, validator, TypeScript generator and complexity analyzer work on SDL or queries you paste, and the Playground sends operations without introspecting the schema. Keep your schema file or API docs open alongside them.
How do I protect a GraphQL API from expensive queries?
Limit both depth and cost on the server. Cap page sizes on list arguments, reject queries above a maximum depth, and calculate a cost by multiplying page sizes through nested lists, which is the model the Complexity Analyzer uses. Persisted queries go further by only accepting operations you have approved.