How to Test a REST API: Methods, Status Codes, Headers and CORS
A practical introduction to testing APIs — HTTP methods, reading status codes and headers, authentication, and why browser requests hit CORS errors.
Editorial disclosure: Pyalm publishes and maintains the products and free tools discussed on this site. Regulatory statements are linked to primary sources where applicable. No independent professional review is claimed unless a reviewer is explicitly named.
Whether you're integrating a payment gateway, a WhatsApp API or your own backend, the first step is the same: send a request and look carefully at what comes back.
HTTP methods
| Method | Meaning | Has a body |
|---|---|---|
| GET | Read data | No |
| POST | Create something | Yes |
| PUT | Replace something | Yes |
| PATCH | Update part of something | Yes |
| DELETE | Remove something | Usually no |
| HEAD / OPTIONS | Headers only / ask what's allowed | No |
Status codes to recognise
| Code | Meaning | Usually means |
|---|---|---|
| 200 / 201 | OK / Created | Success |
| 204 | No Content | Success with an empty body |
| 301 / 302 | Redirect | Check the Location header |
| 400 | Bad Request | Your body or parameters are malformed |
| 401 | Unauthorized | Missing or invalid credentials |
| 403 | Forbidden | Authenticated but not allowed |
| 404 | Not Found | Wrong URL or ID |
| 409 / 422 | Conflict / Unprocessable | Validation failed — read the error body |
| 429 | Too Many Requests | Rate limited — back off |
| 500 / 502 / 503 | Server errors | Not your fault (usually) — retry later |
Send your first request
- Open the free API Tester.
- Pick a method and enter the URL — or try one of the example APIs.
- Add query parameters, headers (e.g.
Accept: application/json), a bearer token and a JSON body as needed. - Click Send and inspect the status, timing, size, headers and formatted body.
- Copy the request as cURL or fetch() for your code or documentation.
Requests go straight from your browser to the API; nothing passes through Pyalm.
Authentication patterns
- Bearer tokens —
Authorization: Bearer eyJ…(decode JWTs with the JWT Decoder) - API keys — in a header like
X-API-Keyor a query parameter - Basic auth —
Authorization: Basic+ Base64 ofuser:password
Never paste production secrets into shared docs or tickets.
Understanding CORS errors
Browsers block a web page from reading responses from another domain unless that API sends Access-Control-Allow-Origin headers. Many server-to-server APIs don't, so a browser-based tester shows "Failed to fetch" even though the API works fine. Copy the request as cURL and run it in a terminal — terminals don't enforce CORS.
Good testing habits
- Test the unhappy paths: missing fields, wrong types, expired tokens.
- Check response times as well as results.
- Validate JSON bodies with the JSON Formatter.
- Compare responses between versions with JSON Compare.
Need an integration built?
Pyalm builds APIs and integrations — ERPs, payment gateways, WhatsApp, e-invoicing platforms — and automation that keeps your systems in sync.
Related free tools
API Tester | JSON Formatter | JWT Decoder | URL Encoder | All free tools