// requests & responses

Requests & Responses

Everything around an HTTP request: what you can send, how to read and query what comes back, and how to find it again later.

Request Bodies

Pick a type in the Body tab’s mode selector. A body is sent for every method except GET and HEAD.

  • JSON — editor with highlighting, sent as application/json. {{variables}} are substituted first; invalid JSON stops the send with an error. Leave it empty to send no body
  • Form Data — multipart fields. Add Field adds a row; set its type to Text or File. File fields take a path (or a {{variable}}) or Browse, plus an optional content type. The file is read when you send, and the multipart boundary is generated for you
  • URL Encoded — key/value rows sent as application/x-www-form-urlencoded, keeping row order and duplicate keys
  • Text — plain text, text/plain unless you set a Content-Type header
  • Binary File — send a file unchanged. Choose it with Browse or a path, and optionally set its content type (default application/octet-stream)

In JSON mode, Format (or Shift+Alt+F in the editor) re-indents the body with two spaces. It only changes whitespace and tolerates unquoted {{variable}} placeholders. GraphQL has its own editor — see GraphQL.

The Response Panel

The header shows the status (colour-coded), time to first byte, and size. Below it are the Body, Headers, Cookies, Performance, and Scripts tabs (gRPC shows Body, Metadata, and Trailers). Error responses (4xx/5xx) are shown in full, like successful ones.

  • Code — the raw body with highlighting. The language (JSON, XML, HTML, Plain Text) is detected from Content-Type and can be overridden
  • Preview — JSON and XML as a collapsible tree, HTML rendered in a sandbox with scripts and images blocked. Very large bodies stay in the code view
  • Results — query the body with JSONPath or XPath (see below)
  • Copy copies the body; Save writes it to a file, suggesting a name from the URL and Content-Type. Binary responses (images, PDFs, archives) are not shown as text — save them to get the exact bytes
  • Cookies lists the cookies the response set, with domain, path, expiry, and flags
  • Scripts shows the console output of the request’s scripts

Performance

The Performance tab breaks the total time into DNS lookup, connect (TCP + TLS), waiting (TTFB), and content download, with response size, transfer speed, and a waterfall. Phases that did not happen — for example connecting, when an open connection was reused — show n/a.

JSONPath & XPath Inspection

Pull the parts you need out of a large response without leaving the app.

  1. Send the request, then click Results in the body toolbar
  2. Type an expression — JSONPath for JSON (e.g. $.items[*].name), XPath 1.0 for XML (e.g. //ns:item)
  3. Press Apply or Enter. Matches appear with a count; use Copy Results or Save Results to take them with you
  4. Clear returns to the code or preview view
  • The format follows the response, not the highlighting: JSON responses use JSONPath (RFC 9535) and return a JSON array; XML responses (*/xml, *+xml) use XPath 1.0 and return XML fragments, text, or a number/boolean/string result
  • XML namespaces declared on the root element are bound automatically; a default namespace gets the prefix ns. Add or override prefixes under Namespace overrides, one prefix=URI per line
  • An applied expression re-runs on every new response, and is remembered per tab separately for JSON and XML
  • Queries run natively in the background, on bodies up to 5 MB; results are capped at 1,000 matches or 1 MB, with a note when they are partial
  • HTML, binary, and streaming responses (WebSocket, SSE, MQTT, gRPC streams) cannot be inspected

Response Schema Validation

Check every successful response against a JSON Schema automatically.

  1. Open the request’s Schema tab. Requests imported from OpenAPI or Swagger are pre-filled from the spec’s JSON response schema (200, 201, 202, or default)
  2. Paste or edit a schema, or click Infer from Response to generate one from the last response — then tighten it by hand
  3. Send the request: a Schema Valid or Schema Invalid (n) badge appears in the response header. Hover it to see each failing path and message
  • Validation runs for 2xx HTTP responses that have a schema; error responses and GraphQL requests are not validated
  • Supports JSON Schema drafts 4, 6, 7, 2019-09, and 2020-12 (the default), plus OpenAPI 3.0 conventions such as nullable. format is checked
  • $ref must point inside the schema — nothing is fetched from the network

Request History

Click History at the top of the sidebar, or press Ctrl/Cmd+H. Every HTTP, GraphQL, and gRPC request you send is listed — including those sent by the collection runner — with method, status, time, URL, and environment.

  • Search history… filters by URL, method, or status code
  • Click an entry to reopen it in a new tab of the right protocol; it is not sent until you press Send
  • Delete single entries with the trash icon, or everything with Clear All History
  • The number of entries kept is set by History Limit in Settings (default 100)

History never stores credentials: Authorization, Proxy-Authorization, Cookie, Set-Cookie, and any header or parameter added by an auth setting are saved as [redacted], and authorization is not restored on reopening. Replace those values before re-sending. Large bodies are truncated in history; WebSocket, SSE, MQTT, and GraphQL subscriptions are not recorded.

Layout & Status Bar

Side-by-side layout

Show the response to the right of the request instead of below it — handy on wide screens. Toggle it with Ctrl/Cmd+\, Side-by-side layout in the main menu, or Layout in Settings. Drag the divider to resize; each layout remembers its own split. When the window is too narrow for two panes, it falls back to stacked until there is room again.

Status bar

The bar at the bottom of the window shows only what is relevant right now:

  • The HTTP version in use — click to change it in Settings
  • An elapsed-time counter while a request is running
  • Mock :port while the mock server is running — click to open it
  • The active proxy — click to open the proxy settings
  • The number of live connections (WebSocket, SSE, MQTT, gRPC streams, GraphQL subscriptions) — click to jump to one
  • Secrets unencrypted when no OS keychain is available
  • The app version

Next Steps