Test an API Online: Server Mode, Browser CORS and Response Checks

Article

Quick answer: An online API tester sends an HTTP request and helps inspect the response. Mayexa supports REST requests, GraphQL JSON envelopes, environments, collections and declarative assertions. Server mode routes public API requests through Mayexa; Browser mode calls the target directly and remains subject to browser CORS rules.

Open API Request Tester to inspect its current options and availability.

Understand the method before choosing an action

Choose the mode before entering credentials. Server mode transiently receives the destination URL, headers and body and blocks private or local network addresses. Browser mode does not use the relay, but the target must allow the browser request. Neither mode silently falls back to the other, and redirects should be inspected explicitly.

A practical example to work through

Start with a public, read-only GET endpoint you control. Record the status, inspect the JSON body and add an assertion for a field that your contract actually requires. A 200 response alone does not prove the whole payload is correct. A GraphQL response can also contain application errors in its JSON body, so inspect those alongside the HTTP status.

Use the Mayexa workspace

Enter a full URL and choose an HTTP method, or import cURL, Mayexa collection JSON or the supported Postman collection subset.
Configure parameters, headers, authentication, body and visual assertions. Use {{variable}} values from the active environment.
Click Send request or Ctrl/Cmd + Enter. Choose Server mode for public APIs without CORS; your URL, credentials and body pass through Mayexa. Browser mode sends directly and requires CORS.
Inspect status, total time, decoded bytes, pretty/raw body, exposed headers and tests. Filter lines or inspect a JSON path.
Pin a response for comparison, export code, or save requests to the in-memory collection. Run collection explicitly sends the saved requests sequentially.
Save redacted local templates only after opting in. Export is redacted by default; review custom URLs and headers before sharing. Reload clears unsaved session data.

Limits, privacy and interpretation

POST, PUT, PATCH and DELETE can change real target data; the collection runner sends real requests sequentially. Importing a collection does not run its scripts, and this tool does not offer arbitrary JavaScript execution or full Postman parity. Local persistence and exports have explicit redaction choices. Review custom URLs and headers before sharing a template.

No Mayexa account is required. Review the workspace's processing labels and limits before entering data.