Requests and protocols
Create a request, choose its protocol and enter the endpoint you want to call. Echo keeps the request, its response and its history together. Save useful requests in a collection so you can run them again or include them in a test.
Send an HTTP request
Choose the method, then add query parameters and headers. You can turn individual rows on or off without deleting them. The body editor supports text, JSON, XML, URL-encoded forms, multipart forms with files and a binary file. Format JSON or XML in the editor when you need to inspect a longer body.
Use {{baseUrl}}/orders instead of repeating a host name. Variables also work in headers, body values and authentication settings. See environments and variables.
The request settings control timeout, redirects, the maximum redirect count, URL encoding, TLS certificate validation and use of the cookie jar. The original-method option preserves the method and body for 301 and 302 redirects; 303 still changes to GET. Keep certificate validation enabled for normal use.
Choose authentication
Configure authentication on each request. Use variables for credentials you want to reuse.
| Method | Information to provide |
|---|---|
| Bearer | Access token |
| Basic | Username and password |
| API key | Key name, value and header or query location |
| OAuth2 client credentials | Token URL, client ID, client secret and scope |
| OAuth2 authorization code with PKCE | Authorization and token URLs, client ID, redirect URI and any required scope or audience |
| AWS Signature V4 | Access key, secret key, region, service and optional session token |
| Digest or NTLM | Credentials required by the server; NTLM can also use a domain |
| Hawk | Credential ID, key and algorithm |
Client-credentials tokens are cached between requests. Authorization-code login opens a browser, so it needs an interactive session and a redirect URI registered by the API's identity provider.
The inherited-authentication option does not currently resolve authentication from an editable parent collection. Set authentication explicitly on the request. When importing Postman collections, supported inherited authentication is copied into the imported requests.
Call a gRPC service
Enter the server address, discover its services and select a method. Discovery uses server reflection. You can also attach a .proto file when reflection is unavailable; the file must contain the definitions needed by the call.
Write the request message as JSON. Unary and server-streaming calls take one object. Client-streaming and bidirectional calls take an array, for example [{"name":"first"},{"name":"second"}]. Echo sends those messages in order and shows the received messages in the stream view. Use Stop to end an ongoing call.
Explore GraphQL
Write a query or mutation, provide its variables as JSON and set an operation name when needed. Introspection loads the schema so you can browse fields and insert query, mutation or subscription templates. If the server disables introspection, you can still enter an operation yourself.
For subscriptions, enable subscription mode and use the service's ws:// or wss:// endpoint. Read incoming events in the stream view. Check the GraphQL errors field as well as the HTTP status; a 200 response can still contain an operation error.
Work with WebSocket and SSE
A WebSocket request opens a connection and lets you send more messages while it stays active. Choose text or binary; the binary input accepts hexadecimal bytes such as DE AD BE EF. The stream view shows sent and received frames and lets you filter or clear the visible list.
SSE listens for server events. Automatic reconnection can use the server's retry hint and last event ID. Request settings let you turn reconnection off and adjust the idle timeout for WebSocket and SSE. Use Stop when you have collected enough events.
Inspect a response
Read the status, headers, body, cookies and test results. The script console helps explain failed assertions. History lets you reopen an earlier response, a comparison or a collection run. You can also turn a recorded HTTP response into a mock route after reviewing its contents.
The timing panel shows the measurements available for that call, including DNS, connection, TLS, first byte and download. A reused connection may not have a new measurement for every stage. After enough successful saved requests, Echo compares duration with recent history and can flag a slower response. Adjust the percentage threshold in settings; this is a comparison with your history, not a load test.
Cookies, proxies and client certificates
The cookie jar lets you inspect, edit and remove cookies for the current host, clear that host's cookies or import a Cookie header. Disable the jar on a request when you need to test without a saved session.
Advanced desktop settings provide system, disabled and manual proxy modes, proxy credentials and bypass rules. For mutual TLS, associate a host pattern with a PFX certificate or a certificate-store thumbprint. These settings and file paths belong to the device; configure them on each machine that runs the requests.
Use compare mode to inspect the same request in different environments, or automation to repeat it with assertions.