What's inside
Everything a real backend's API surface has, minus the backend.
Pure mock, nothing stored
Reads return fixed sample data. Writes look real (status + body) but nothing is saved, so there's no shared state to break and no reason to send real data.
Simulated JWT auth
Register, log in, refresh, and a protected /me route with genuine
signed JWTs. Any non-empty username/password logs in — no account is stored.
Five response formats
JSON, XML, HTML, CSV and plain text from the same endpoint — pick with
?format= or an Accept header.
Placeholder images
Real SVG images at any size for avatars, skeletons and <img> testing.
Rate limited
Per-IP request caps, stricter on auth routes, keep the service usable for everyone.
Filterable & sortable
Pagination, sorting and field filters work the same way across every resource.
Browser Workspace
A browser-based tool that goes beyond the read-only mock API — no signup, nothing leaves your device.
Browser Workspace
Design custom endpoints, simulate errors, delays and flaky networks, mock WebSocket/SSE channels, and import/export OpenAPI — all locally.
Open Workspace →OpenAPI Viewer
Browse an OpenAPI/Swagger document's endpoints and schemas in your browser — no signup, nothing leaves your device.
OpenAPI Viewer
Browse every endpoint, schema and example in a readable viewer — paste, import or export JSON, YAML or XML, entirely offline.
Open Viewer →Resources
Every resource below supports the same CRUD shape. Replace :id with a
record id. Writes are simulated — they return a realistic response but change nothing.
/api/<resource> — list
(paginated, filterable, sortable)
/api/<resource>/:id — single
record
/api/<resource> — create
(simulated, 201)
/api/<resource>/:id — replace
(simulated)
/api/<resource>/:id —
partial update (simulated)
/api/<resource>/:id —
delete (simulated)
Available resources
List query params
Total row count (before pagination) is returned in the
X-Total-Count response header.
Advanced features
Opt-in query parameters that work on every resource above — useful for testing error handling, loading states, and realistic data volumes without any setup.
Pick fields with ?fields=, drop them with ?exclude=, or
attach relations with ?include=.
?require_api_key=true gates on an X-API-Key header — 401
missing, 403 wrong, 200 correct.
POST /api/schema/mock returns fake data matching a JSON Schema —
fully offline.
Reproduce timeouts, offline, 5xx, empty and truncated bodies with
?timeout, ?offline, ?malformed and more.
Mock real-time channels: GET /api/sse/:channel or
wss://…/api/ws/:channel — generated events, no setup.
Simulated auth (register/login/refresh/me/logout, GET /api/profile) and
webhooks already exist under Auth and
Webhooks
below. For designing whole custom endpoints, scenario presets, and OpenAPI export, see
the
Browser Workspace.
Auth
JWT access + refresh tokens, plus HTTP Basic auth for login. Stateless — no session store, tokens are self-contained and verified by signature.
/api/auth/register —
{ username, password, email? }
/api/auth/login — JSON body
{ username, password } or Authorization: Basic
/api/auth/refresh —
{ refreshToken }
/api/auth/me — requires
Authorization: Bearer <accessToken>
/api/auth/logout
curl -X POST https://tools.example.com/api/auth/register \
-H "Content-Type: application/json" \
-d '{"username":"ada","password":"secret123","email":"ada@example.com"}'
Placeholder images
Real, renderable images at any size — served as SVG so there's no native image library dependency. Great for <img> src testing, skeleton screens, avatars.
/api/images/:width/:height — e.g.
/api/images/300/200
/api/images — list of sample sizes
Optional query params: bg, fg (hex, no #),
text, seed.
Webhooks
Grab a signed sample payload for events like payment.succeeded or
order.shipped, or POST your own sender's payload to
/api/webhooks/receive and get an instant delivery receipt back. Nothing
is stored and no outbound request is ever made.
/api/webhooks — catalogue of
supported event types
/api/webhooks/:event — a signed
sample payload for that event
/api/webhooks/receive — echoes
back what it received, plus a delivery receipt
Every sample response includes X-Webhook-Id,
X-Webhook-Timestamp and X-Webhook-Signature headers
(HMAC-SHA256, t=<timestamp>,v1=<signature>) so you can test
signature verification the same way a real provider would.
Example — fetch a sample and verify it:
curl -i https://tools.example.com/api/webhooks/payment.succeeded
# → 200 OK
# X-Webhook-Id: evt_9f2a1c...
# X-Webhook-Timestamp: 1767225600
# X-Webhook-Signature: t=1767225600,v1=6c1e4f...
# {
# "id": "evt_9f2a1c...",
# "type": "payment.succeeded",
# "data": { "payment": { "id": 1, "amount": 4999, "status": "succeeded" } }
# }
curl -X POST https://tools.example.com/api/webhooks/receive \
-H "Content-Type: application/json" \
-d '{"id":"evt_9f2a1c...","type":"payment.succeeded"}'
# → 200 OK { "received": true, "deliveryId": "whd_...", "echo": { ... } }
Response formats
Every GET endpoint honors ?format= or the Accept header —
the same data, four ways.
Try it yourself
Build a request without leaving this page — anything left as "Default" is simply omitted from the URL.
/api/users
Click "Run" to see a live response here.
Create a custom mock endpoint
Paste any JSON response you want, generate a one-off URL, and hit it like a real endpoint. Each generated URL expires automatically after 12 hours.