API Playground & Sandbox

Intercepts your raw HTTP byte stream and echoes back every parsed header, query param, body field, and client IP.

Returns realistic HTTP responses for standard status codes across 2xx, 3xx, 4xx, and 5xx families.

Toggle Access-Control headers to simulate allowed vs blocked cross-origin requests and watch OPTIONS preflight handshakes.

Serves ETag and Cache-Control headers. Repeat GET with If-None-Match to witness a 304 Not Modified 0-byte transfer.

Test how server adapts its response MIME format and language based on client Accept and Accept-Language headers.

Fetches a large 300-record dataset with gzip compression active vs disabled to measure transfer size shrink (~85% savings).

Transmits binary file metadata and text fields separated by RFC multipart boundary delimiters.

Opens a persistent HTTP socket connection with Transfer-Encoding: chunked and watches Server-Sent Events arrive live.

Fires GET, POST, PUT, and DELETE to observe which methods alter state upon repetition vs which guarantee identical end state.

Demonstrates static route mapping where the same fixed path serves different handlers based on the HTTP method.

Extracts dynamic entity identifiers from path slots (:id) to perform database record lookups.

Transmits non-semantic filtering and search criteria using key-value pairs after the ? delimiter.

Slices large datasets into pages with metadata (currentPage, limit, totalPages, totalRecords).

Expresses parent-child domain hierarchies (User #123 ➔ Post #456) in clean REST paths.

Serves legacy contract format with name field for older client applications.

Serves modern schema with title, currency, and SKU fields without breaking v1 clients.

Sends a structured JSON payload, inspects server-side deserialization into memory, and observes re-serialized JSON response.

Compares text-based formats (JSON, YAML, XML) with binary wire formats (Protobuf) showing byte compactness and parsing differences.

Simulates secure credential verification with constant-time timing protection, generic error responses, and dual issuance of stateless JWT and stateful Session ID.

Cryptographically verifies the HMAC-SHA256 signature and decodes token claims in memory without requiring any database lookups.

Enforces permission boundaries across viewer, editor, and admin roles, differentiating 401 Unauthorized from 403 Forbidden.

Tests incoming request payloads against Type, Syntactic (email/phone), Semantic (DOB/age range), and Complex (password match, conditional partner) rules before service execution.

Casts raw query string parameters to typed integers, trims and lowercases email strings, and normalizes phone numbers into E.164 format before reaching the service layer.

Traces the exact flow of an incoming HTTP request through Ingress Middleware, Request Context injection, Controller input validation, HTTP-agnostic Service orchestration, and Repository database persistence.

Compares insecure client-supplied request body user IDs against cryptographically verified identity claims stored in per-request Context.

Demonstrates professional REST resource collections (/projects) with automatic fallback sane defaults (page=1, limit=10), status filtering, and sorting.

Executes a custom business action (POST /projects/:id/clone) that falls outside standard CRUD, creating a duplicated resource draft.

Simulates querying 1,000,000 PostgreSQL rows with B-Tree Index (O(log N)) vs sequential scan (O(N)), returning EXPLAIN ANALYZE and buffer page I/O metrics.

Compares raw string concatenation vulnerability against parameterized queries ($1), showing how prepared statements isolate user input from executable bytecode.

Demonstrates safe SQL pagination using ORDER BY, LIMIT, and OFFSET with full pagination metadata (page, limit, totalPages, hasNextPage).