HTTP API

Report this deployment's limits and storage mode.

Returns the numeric limits every other endpoint enforces, and whether webhook and mock state is held in a shared store or in a single instance's memory.

Response

{
  "version": "v1",
  "storage": { "shared": false, "note": "…" },
  "limits": { "fetch": { … }, "webhooks": { … }, "mocks": { … } }
}

Fetch a URL and analyse its response headers.

Sends one GET request and returns every response header plus a structured analysis: security headers with explanations, cookie attributes, CORS, caching and the redirect chain.

Request

curl -X POST https://toolbox.r3x.site/api/v1/http/headers \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

Response

{
  "finalUrl": "https://example.com/",
  "status": 200,
  "durationMs": 143,
  "redirects": [],
  "headers": [["content-type", "text/html; charset=utf-8"]],
  "analysis": {
    "security": [
      {
        "name": "Content-Security-Policy",
        "status": "missing",
        "severity": "high",
        "explanation": "Restricts where scripts, styles…",
        "advice": "Start with a report-only policy…"
      }
    ],
    "cookies": [], "cors": [], "caching": [], "disclosure": []
  }
}

Extract a page's title, description and social tags.

Fetches up to 1 MB of an HTML document and returns its metadata plus a list of findings. Non-HTML content types are rejected rather than parsed.

Request

curl -X POST https://toolbox.r3x.site/api/v1/http/metadata \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

Response

{
  "finalUrl": "https://example.com/",
  "metadata": {
    "title": "Example Domain",
    "description": null,
    "canonical": null,
    "openGraph": [], "twitter": [], "favicons": [],
    "headings": [{ "level": 1, "text": "Example Domain" }]
  },
  "findings": [
    { "level": "warn", "label": "Description missing", "detail": "…" }
  ]
}

Fetch two URLs for comparison.

Fetches both URLs in parallel and returns each one's headers, extracted text, formatted HTML, metadata, links and images. The diff itself is computed by the caller.

Request

curl -X POST https://toolbox.r3x.site/api/v1/http/diff \
  -H "Content-Type: application/json" \
  -d '{"urlA":"https://example.com","urlB":"https://example.org"}'

Response

{
  "a": { "finalUrl": "…", "status": 200, "text": "…", "html": "…", "metadata": { … } },
  "b": { "finalUrl": "…", "status": 200, "text": "…", "html": "…", "metadata": { … } }
}

Forward an arbitrary HTTP request.

Sends the request you describe and returns the response. Nothing about the request or response is logged or stored. Hop-by-hop and connection headers are rejected; an Authorization header is dropped if a redirect crosses origins.

Request

curl -X POST https://toolbox.r3x.site/api/v1/http/request \
  -H "Content-Type: application/json" \
  -d '{
    "method": "POST",
    "url": "https://api.example.com/users",
    "headers": [["Content-Type", "application/json"]],
    "body": "{\"name\":\"Ada\"}"
  }'

Response

{
  "status": 201,
  "statusText": "Created",
  "durationMs": 212,
  "bodyBytes": 84,
  "headers": [["content-type", "application/json"]],
  "bodyEncoding": "utf8",
  "body": "{\"id\":1,\"name\":\"Ada\"}"
}

Create a temporary webhook endpoint.

Returns the endpoint id and a manage token. The token is shown once and only its hash is stored; there is no way to recover it. The endpoint is deleted after 60 minutes.

Request

curl -X POST https://toolbox.r3x.site/api/v1/webhooks

Response

{
  "session": {
    "id": "hk_8F3K92MB",
    "expiresAt": 1757000000000,
    "received": 0,
    "limits": { "maxRequests": 50, "maxBodyBytes": 65536 }
  },
  "token": "…"
}

Read captured requests.

Returns the session and its captured requests, newest first. An unknown id and a wrong token both answer 404, so an id cannot be probed for existence.

Authorization: Bearer <manage token>

Request

curl https://toolbox.r3x.site/api/v1/webhooks/hk_8F3K92MB \
  -H "Authorization: Bearer $TOKEN"

Response

{
  "session": { "id": "hk_8F3K92MB", "received": 2, … },
  "requests": [
    {
      "id": "req_a1b2c3",
      "at": 1756999000000,
      "method": "POST",
      "headers": [["content-type", "application/json"]],
      "bodyKind": "json",
      "body": "{\"event\":\"test\"}",
      "sourceIp": "203.0.113.0"
    }
  ]
}

Issue a new URL for the same session.

Moves the session to a fresh id, carrying captured requests across, and deletes the old id immediately. The manage token does not change.

Authorization: Bearer <manage token>

Delete an endpoint and everything it captured.

Also available as DELETE /api/v1/webhooks/{id}/requests to clear captures but keep the endpoint.

Authorization: Bearer <manage token>

Create a temporary mock API.

Returns the mock id and a manage token, with one example endpoint defined. Deleted after 24 hours.

Request

curl -X POST https://toolbox.r3x.site/api/v1/mocks

Response

{
  "server": {
    "id": "m_a1b2c3",
    "cors": true,
    "endpoints": [
      { "id": "ep_x1", "method": "GET", "path": "/users", "status": 200, "body": "[…]" }
    ]
  },
  "token": "…"
}

Replace the endpoint definition.

Validates the whole definition and rejects it as a unit. At most 20 endpoints, 32 KB per body, 3000 ms maximum delay. Response headers that would let a definition inject a header line are refused.

Authorization: Bearer <manage token>

Request

curl -X PUT https://toolbox.r3x.site/api/v1/mocks/m_a1b2c3 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoints": [{
      "id": "ep_x1", "method": "GET", "path": "/users",
      "status": 200, "headers": [], "contentType": "application/json",
      "body": "[{\"id\":1,\"name\":\"Alice\"}]", "delayMs": 0, "enabled": true
    }]
  }'

Read the mock's request log.

The last 50 requests it answered, newest first, with request and response detail. DELETE the same path to clear it.

Authorization: Bearer <manage token>