API Client Workspace NEW

Full-featured browser workspace for REST, GraphQL, and gRPC-Web / Connect. Manage collections, environments with {{variables}}, pre-request & test scripts (pm.*), and sequential collection runs locally in your browser.

Private by architecture: All processing is 100% client-side memory. Your data never leaves this browser tab.

Browser Execution Notes: Requests run directly via your browser's native fetch() with no proxy server. Target servers must allow cross-origin requests via Access-Control-Allow-Origin (CORS), restricted headers like Cookie or Host are controlled by the browser, and gRPC requests use browser-compatible gRPC-Web, grpc-web-text, or Connect framing rather than raw HTTP/2 sockets.

Query Parameters

Response

Ready to send

Hit Send to execute the active request and inspect the response.

About This Tool

The API Client is a complete local-first workspace for testing REST, GraphQL, and gRPC (gRPC-Web, grpc-web-text, and Connect) APIs directly in your browser. Organize requests into folders and collections, define environment and global {{variables}}, write pre-request and test scripts using the familiar pm.* API, and run entire collections sequentially.

Because every request is sent directly from your browser via fetch() without a proxy server, your API keys, bearer tokens, and payloads never touch a third-party relay. Local APIs and public CORS-enabled endpoints work out of the box.

Key Features

Multi-Protocol Request Builder: Switch seamlessly between REST (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS), GraphQL (query formatter, operation detector, live schema introspection explorer), and gRPC (inline .proto parser, binary wire encoder/decoder, gRPC-Web, grpc-web-text, and Connect).
Collections, Environments & Variables: Organize requests into nested folders, switch active environments, and interpolate {{variables}} across URLs, query parameters, authentication, headers, bodies, and metadata.
Sandboxed Pre-request & Test Scripts: Execute Postman-compatible pm.environment, pm.globals, pm.variables, pm.test(), and pm.expect() assertions in a browser-shadowed execution sandbox with console output capture.
Sequential Collection Runner: Run an entire collection or folder in order with variable propagation between steps, per-request timing, HTTP/gRPC status badges, and aggregated assertion pass/fail counts.
Import, Export & Code Generation: Import Postman v2.1 collections, OpenAPI 3 specs, HAR captures, and cURL commands. Export collections to Postman v2.1 JSON or generate ready-to-run code snippets in Fetch, Axios, Python, Go, Rust, and PHP.

Frequently Asked Questions

Why do some cross-origin requests fail with a CORS or network error?

Because this client executes requests directly from your browser using fetch(), the target server must include Access-Control-Allow-Origin headers allowing this origin. APIs that do not send CORS headers are blocked by the browser security sandbox.

How does gRPC work inside a web browser?

Browsers do not expose raw HTTP/2 framing or trailers to JavaScript. This client supports gRPC-Web (application/grpc-web+proto), grpc-web-text (base64 framed), and the Connect protocol (Connect JSON and Connect Protobuf), which are the standard browser-compatible gRPC transports.

Where are my collections, environments, and history stored?

Everything is persisted locally in your browser localStorage under yourstand_api_client_workspace_v1. No requests, credentials, environment variables, or collections are ever uploaded to a backend server.

How do pre-request and test scripts work?

Scripts run in a shadowed JavaScript sandbox with access to a Postman-compatible pm.* object. You can read and mutate environment or global variables via pm.environment.set() and write Chai-style response assertions with pm.test() and pm.expect().

Can I import existing Postman collections, OpenAPI specs, HAR files, or cURL commands?

Yes. Click Import / Export in the sidebar to import Postman Collection v2.1 JSON, OpenAPI 3.x JSON or YAML specifications, HTTP Archive (HAR) logs, or raw cURL commands, and export any collection as Postman Collection v2.1 JSON.

Is it safe to import a collection from someone else?

Treat an imported collection like you would a script you did not write yourself: its pre-request and test scripts run automatically the moment you send that request, with the same trust level as code pasted into your browser console. The sandbox shadows common globals but is not a real isolation boundary (unlike the JS/TypeScript Playground, which runs in a Worker): only import collections from sources you trust.