# Fun API Playground — full text # Every indexable page on https://funapi.dev/ as plain text, generated at # build time from the same content the site renders. See /llms.txt for the # short version. 242 pages. ================================================================ URL: https://funapi.dev/ TITLE: 39 Mock REST APIs for QA Testing — Fun API Playground ================================================================ 39 playful mock REST APIs. Every status code you'll ever need to test. Real, working mock REST endpoints with Swagger-style docs — CRUD, Bearer tokens, pagination, filtering, GraphQL, webhooks, and errors on demand. Always free, no signup. Pick an API and hit Try it out. Getting started guide Fandom & Pop Culture - Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints) - Movies API — QA-themed cinema. Sort, filter, rate. (9 endpoints) - Harry Potter API — Houses, students & spells from a magic school. (10 endpoints) - Star Wars API — Characters, planets & starships from a galaxy far away. (11 endpoints) - Sherlock Holmes API — Cases, suspects & clues from Baker Street. (10 endpoints) - Pokémon API — Creatures, trainers & simulated battles. (10 endpoints) - Middle-earth API — Fellowship, quests & artifacts from a fantasy realm. (9 endpoints) - The Office API — Employees, pranks & quotes from a paper company. (8 endpoints) - Marvel API — Avengers, villains & mission assignments. (10 endpoints) - Game of Thrones API — Houses, nobles & dragons of Westeros. (12 endpoints) - Rick and Morty API — Characters, locations & episodes across the multiverse. (9 endpoints) - Starfleet API — Ships, warp limits & exponentially multiplying tribbles. (10 endpoints) - GTA API — Characters, vehicles, weapons, missions, heists, a wanted system & radio stations across Los Santos, Vice City and Liberty City. (17 endpoints) - Dragon Ball API — Fighters, transformations, power levels & tournaments. (6 endpoints) - Voxel Worlds API — Block worlds, players, inventories & coordinates. (6 endpoints) - Anime Tournament API — Original fighters, power levels & tournament brackets. (5 endpoints) - Retro Quest API — Pixel heroes, quests, loot & save-game conflicts. (5 endpoints) Everyday Life - Pizza Orders API — Place & track orders. Includes a guaranteed 500. (9 endpoints) - Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints) - Football API — Teams, squads, standings & simulated matches. (7 endpoints) - Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints) - Airline API — Flights, seat conflicts & overbooking drama. (9 endpoints) - Shop API — Carts, stock drama & expired coupons. (9 endpoints) - Cargo Tracking API — Shipment state machines. Writes need an X-API-Key. (9 endpoints) - World Cup 2026 API — Teams, groups, venues, match simulation, tickets & bracket predictions across the 2026 host cities. (17 endpoints) - FIBA World Cup API — Teams, Doha arenas, quarter-by-quarter game simulation, box scores, coach challenges, cursor-paged play-by-play & ticketing. (22 endpoints) - Formula 1 API — Drivers, constructors, races, telemetry & pit stops. (7 endpoints) Original Worlds - Superhero API — Heroes, powers & nemeses. Great for nested resources. (6 endpoints) - Dino Park API — Dinosaurs, enclosures & the occasional breach. (9 endpoints) - Space Agency API — Launches, scrubs & probes with real signal lag. (9 endpoints) Testing Scenarios - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. (6 endpoints) - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints) - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints) - Object Storage API — Objects, checksums, ranges & resumable uploads. (4 endpoints) - Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. (6 endpoints) - Event Streams API — SSE events, replay cursors, heartbeats & ordering. (3 endpoints) - Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (5 endpoints) - Search & Facets API — Full-text queries, facets, highlights & cursor pagination. (2 endpoints) - Fun Data Bridge API — Seeded fixtures from schemas, inspired by fundata.dev. (4 endpoints) FAQ Do I need to sign up?No. The web playground runs entirely in your browser with zero backend, and the live API accepts the documented tokens without registration. Which Bearer token should I use?qa-admin-token for full access, qa-viewer-token for read + write with 403 on DELETE. Anything else returns 401. How do I reset sandbox data?Click ↺ Reset sandbox data on any docs page, reload the page, or call window.__funApiReset() in the browser console. Against the live backend, requests are isolated by X-Sandbox-ID. Can I export the API spec?Yes — every docs page has download buttons for an OpenAPI 3.1 spec and a Postman collection, and the whole catalog is served as one OpenAPI 3.1 document at /openapi.json. ================================================================ URL: https://funapi.dev/guide TITLE: Getting Started Guide — Fun API Playground ================================================================ Getting started Everything here is a simulated sandbox — no real server, no signup, nothing to break. Five minutes and you are testing. Step 1: Pick an API and open its docs From the homepage, click any API card. You land on a Swagger-style page listing every endpoint, grouped by tag. Green is GET, blue is POST, orange is PUT, red is DELETE. The catalog is grouped four ways — fandoms, everyday business domains, original worlds and pure testing scenarios — because the domain is the part you should not have to think about. If you already know how a pizza order or a flight booking behaves, the only new thing on the page is the HTTP. Step 2: Send your first request Expand an endpoint, click Try it out, fill the parameters, choose Browser sandbox, then click Run request. You get a real status code, a JSON body, response headers and a ready-to-copy curl command. A good first one: GET /friends/v1/quotes/random Browser sandbox runs the whole API engine locally — no network, no rate limits, nothing to wait for. Switch the environment picker to Live API when you want the same endpoint over the real network, served by a Cloud Function against Firestore. Step 3: Authorize for protected endpoints Endpoints marked with a lock need a Bearer token. Click Authorize at the top of any docs page and use one of these: - qa-admin-token: full access — everything works - qa-viewer-token: read + write, but DELETE returns 403 - anything else: always 401 Unauthorized One exception: the Cargo API's write endpoints use API-key auth instead — send the header X-API-Key: cargo-key-123. It is there precisely because not every API you will ever test uses Bearer. For a real token lifecycle rather than a static string, POST /auth/v1/login issues a genuine signed JWT, and the OAuth 2.0 endpoints run the authorization-code, client-credentials and refresh-token flows end to end. Step 4: Practice negative testing Every error code is one request away: - 400: send page=abc, an invalid JSON body, or a rating of 11 - 401 / 403: wrong token / viewer token on a DELETE - 404: ask for id 999, or a page past the last one - 418: GET /coffee/v1/teapot — it is, in fact, a teapot - 402: GET /bank/v1/premium/statements — the paywall says hi - 500: GET /pizza/v1/oven/status — always fails, by design - 503 / 504: GET /protocol/v1/maintenance and /gateway-timeout — outages on demand - 413 / 415: POST /movies/v1/movies/{id}/poster — oversized or wrong-type file upload The point of provoking these deliberately is that each one should make your client do something different. A 429 means wait and retry; a 403 means never retry; a 503 means retry the whole request later; a 400 means fix the request first. A client that treats all four as "the call failed" is a client that will retry its way into an outage. Step 5: Take it into your own tools Each docs page has a download button for an OpenAPI 3.1 spec and a Postman collection — import either into Postman, Insomnia, Bruno or Swagger Editor and build your test collections there. Every executed request also shows its equivalent in nine languages: curl, fetch, axios, Python, HTTPie, Playwright, RestAssured, C# and k6. There is a merged spec covering all the APIs at once, next to the per-API downloads, if you want one file to point a contract tester at. Step 6: Test concurrency and idempotency PUT and DELETE on characters, heroes and movies accept an optional If-Match header — send a stale ETag to get 412 Precondition Failed, which is what stops two clients silently overwriting each other. POST endpoints accept an Idempotency-Key header — repeat the same key and you get the original response back instead of a duplicate. Both are worth rehearsing because both fail quietly in production: an ignored ETag loses an edit nobody notices for a week, and a missing idempotency key turns one network retry into two charges. Step 7: Automate it Turn on Deterministic mode in Test settings for repeatable random values — quotes, scores, latency — which is what makes an assertion safe to run in CI. Call window.__funApiReset() from your test runner to reset data without touching the UI. Feed the OpenAPI spec into a contract tester such as Dredd or Schemathesis to check real responses against the spec, and try GET /pizza/v1/oven/preheat — it always takes about three seconds, which is exactly what you need to prove your client's timeout works. Against the live API, every caller is isolated by an X-Sandbox-ID header, so a suite that creates and deletes records cannot collide with anybody else running the same suite. Good to know POST, PUT and DELETE really change the sandbox data — create a character, then GET it back. Reloading the page or clicking Reset sandbox data restores the original seed. Where to go next Jump straight into an API: Friends API · Pokémon API · Star Wars API · Bank API · Auth Playground API · Webhooks API Go deeper on one technique: Pagination testing · Rate limit testing · Idempotency key testing · ETag and If-Match testing · Webhook signature testing · OAuth and JWT testing · Negative testing · Async job testing Or look up a status code: all 53 of them Browse all 39 APIs Last updated 6 September 2026 ================================================================ URL: https://funapi.dev/challenges TITLE: 23 API Testing Exercises — Fun API Playground ================================================================ 23 API testing exercises you can actually finish Reading about a 409 is not the same as provoking one. These are 23 things to make the APIs do, in 7 groups, from a first 200 to verifying an HMAC signature on a webhook delivery. Each step ticks itself off the moment a request you run produces the response it asks for — in the browser sandbox or against the live API, either counts — because the runner records every endpoint and status it sees. Nothing is submitted anywhere and there is no account: progress is stored on your own device. New to the site? Start with the getting started guide, or look up any status code as you go. First contact (easy) Send a request, read a status line, and find your way around an endpoint panel. - Get a random Friends quote — a plain 200 with no parameters to fill in. Open the endpoint · Passes on 200 OK - Fetch a single character by id. Open the endpoint · Passes on 200 OK - Ask for a character that does not exist (try id 999) and get a 404 back. Open the endpoint · Passes on 404 Not Found Errors on demand (easy) The four error codes every test suite should have a case for, each one request away. - Brew coffee in a teapot and collect your 418. Open the endpoint · Passes on 418 I'm a Teapot - Trip the coffee shop rush-hour rate limit — four requests inside ten seconds gets you a 429. Open the endpoint · Passes on 429 Too Many Requests - Check the pizza oven, which fails by design, for a 500. Open the endpoint · Passes on 500 Internal Server Error - Walk into the bank paywall and get a 402. Open the endpoint · Passes on 402 Payment Required Auth and roles (medium) Prove that the same request behaves differently for three different callers. - Call a protected endpoint with no token, or a junk one, and get a 401. Open the endpoint · Passes on 401 Unauthorized - Authorize with qa-admin-token and create a character — a 201 with a Location header. Open the endpoint · Passes on 201 Created - Switch to qa-viewer-token and try a DELETE. Authenticated, but not allowed: 403. Open the endpoint · Passes on 403 Forbidden - Log in for a real signed JWT (admin / admin123) instead of a demo token. Open the endpoint · Passes on 200 OK Concurrency and caching (medium) The headers that stop two clients from overwriting each other — and stop you re-sending a payment. - Send an If-None-Match with a current ETag to a standings endpoint and get a 304. Open the endpoint · Passes on 304 Not Modified - Send a stale If-Match on a PUT and get a 412 instead of a silent overwrite. Open the endpoint · Passes on 412 Precondition Failed - Create a conflict a retry cannot fix — book a taken seat, or check out an empty cart: 409. Open the endpoint · Passes on 409 Conflict Protocol lab (hard) Asynchronous work, redirects, content negotiation and the two outage codes. - Start a background job and get a 202 with somewhere to poll. Open the endpoint · Passes on 202 Accepted - Follow a permanent redirect and read the Location header off a 301. Open the endpoint · Passes on 301 Moved Permanently - Ask for a representation the server cannot produce and get a 406. Open the endpoint · Passes on 406 Not Acceptable - Hit a maintenance window (503, with Retry-After) or a gateway timeout (504). Open the endpoint · Passes on 503 Service Unavailable, 504 Gateway Timeout Uploads and partial success (hard) The two failure modes of file upload, and the status code for “some of it worked”. - Upload a poster the server considers too large: 413. Open the endpoint · Passes on 413 Content Too Large - Upload the wrong content type to the same endpoint: 415. Open the endpoint · Passes on 415 Unsupported Media Type - Bulk-create characters where only some of them are valid and read the 207 body. Open the endpoint · Passes on 207 Multi-Status Webhooks end to end (hard) Subscribe, trigger, and verify the signature that proves the delivery was not forged. - Create a webhook subscription and keep its secret. Open the endpoint · Passes on 201 Created - Trigger an event and watch a delivery attempt come back. Open the endpoint · Passes on 201 Created, 200 OK Testing techniques explained · All 39 mock REST APIs Last updated 6 September 2026 ================================================================ URL: https://funapi.dev/about TITLE: About & how it works — Fun API Playground ================================================================ About Fun API Playground Fun API Playground is a sandbox for practising REST API testing. It exists because the realistic parts of API work — the 429 you have to back off from, the 412 that means someone else wrote first, the POST that timed out and may or may not have gone through — are exactly the parts you cannot rehearse against a real production API without consequences. Who it is for QA engineers writing their first API test suite, developers learning what the headers in an HTTP exchange are actually for, students who need an endpoint that answers immediately, and anyone building a client who wants to see it meet a failure before a customer does. No account, no API key, no quota to apply for. The documented Bearer tokens are printed on every docs page because they are demo credentials, not secrets. How it actually works There are two of everything. The web playground runs the entire API engine inside your browser, with no backend involved at all — that is why "Try it out" answers instantly and keeps working offline. The same catalog is also served over the real network by a single Express application on Firebase Cloud Functions, backed by Firestore, for when you need a genuine HTTP round trip from curl, Postman or CI. Both are generated from one catalog definition, so the docs, the OpenAPI 3.1 spec, the Postman collection and the live endpoints cannot describe different APIs. What is real and what is pretend The data is invented. The characters, orders, flights and transfers are fiction, and no endpoint here is a proxy for a real service. The HTTP behaviour is not invented. Rate limits are counted in a shared store over a live window. Webhook deliveries are signed with a real HMAC you can verify. Tokens are genuinely signed and genuinely expire. Optimistic concurrency compares real version tokens, and writes run inside real transactions. That distinction is the entire point: practising against a mock that only pretends to fail teaches you nothing about the client you are writing. Your data Requests are isolated per caller by a sandbox id, so anything you create, edit or delete is yours and resets on demand. There is nothing to sign up with, so there is no account to leak. Analytics load only after an explicit opt-in — decline and no third-party tag is ever fetched. Related playgrounds - Fun UI Playground — the same idea for UI test automation. - Fun Data Playground — synthetic test data generation. All 39 mock REST APIs · Getting started guide · Testing techniques Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status TITLE: Every HTTP Status Code, Live — Fun API Playground ================================================================ Every HTTP status code, returned on demand This playground answers with 53 different HTTP status codes — not as documentation, but as live endpoints you can call right now. Each page explains what the code means, why you would provoke it deliberately, and which endpoints produce it. Success - 200 OK — The request succeeded and the response carries the representation you asked for. For a GET this is the body; for a PUT or POST it is the result of the operation. - 201 Created — A new resource exists as a result of this request. A well-behaved API also sends a Location header pointing at it, and usually the created representation as the body. - 202 Accepted — The request was accepted but has not been carried out yet. The work happens asynchronously, and the response tells you where to look for the result. - 203 Non-Authoritative Information — The request succeeded, but the body was modified by a transforming proxy between you and the origin server — it is not exactly what the origin sent. - 204 No Content — The request succeeded and there is deliberately no body. Most commonly the answer to a successful DELETE. - 205 Reset Content — The request succeeded and the client should reset the view that sent it — clear the form, so the user can enter another. There is never a body. - 206 Partial Content — The response carries only the byte range you asked for with a Range header, described by Content-Range. This is how resumable downloads and media seeking work. - 207 Multi-Status — One response carrying several independent outcomes, for a request that operated on more than one resource. Each element has its own status. Redirection - 300 Multiple Choices — The resource has several representations and the server is asking the client to pick one, usually listing them in the body and optionally suggesting one in Location. - 301 Moved Permanently — The resource has a new URL, given in the Location header, and clients should use it from now on. - 302 Found — The resource is temporarily at a different URL. Unlike a 301, the original URL stays authoritative and should still be used for future requests. - 303 See Other — The answer is somewhere else, at the URL in Location, and the client should fetch it with GET — whatever method the original request used. - 304 Not Modified — The answer to a conditional GET whose If-None-Match matched the current ETag: your cached copy is still valid, so no body is sent. - 307 Temporary Redirect — The resource is temporarily at another URL; repeat the same request — same method, same body — there, and keep using the original URL afterwards. - 308 Permanent Redirect — The resource has moved permanently to the URL in Location; repeat the same request there, method and body unchanged, and use the new URL from now on. Client error - 400 Bad Request — The server could not understand the request — malformed JSON, a missing required field, or a parameter of the wrong type. - 401 Unauthorized — Authentication is missing or invalid. Despite the name, this is about identity, not permission — the server does not know who you are. - 402 Payment Required — Reserved in the original spec and now used in practice for quota, billing and insufficient-funds conditions. - 403 Forbidden — The server knows who you are and is refusing anyway. Authentication succeeded; authorization did not. - 404 Not Found — There is no resource at this URL. The server will not say whether there ever was one. - 405 Method Not Allowed — The URL exists but not with this method. The response must include an Allow header listing what is permitted. - 406 Not Acceptable — The server cannot produce a representation matching your Accept header. - 407 Proxy Authentication Required — A proxy between you and the server needs credentials before it will forward the request. It names the scheme it wants in Proxy-Authenticate. - 408 Request Timeout — The server gave up waiting for the client to finish sending the request, and has closed (or will close) the connection. - 409 Conflict — The request is valid but clashes with the current state — a duplicate, a seat already taken, a state transition that is not allowed from here. - 410 Gone — The resource existed and has been permanently removed. Unlike a 404, the server is stating that it will not come back. - 411 Length Required — The server refuses a request with a body but no Content-Length header, because it will not accept a chunked or unbounded body. - 412 Precondition Failed — A condition in the request headers was not met — almost always an If-Match ETag that no longer reflects the current state of the resource. - 413 Content Too Large — The request body exceeds what the server will accept. Still widely known by its old reason phrase, Payload Too Large. - 414 URI Too Long — The request URI is longer than the server is willing to interpret, usually because too much data went into the query string. - 415 Unsupported Media Type — The body is in a format the endpoint does not accept — usually a Content-Type mismatch. - 416 Range Not Satisfiable — The Range header asks for bytes that do not exist — typically an offset past the end of the resource. - 417 Expectation Failed — The server cannot meet the expectation in the request's Expect header — in practice, Expect: 100-continue. - 418 I'm a Teapot — From the 1998 April Fools' hypertext coffee-pot spec. It is a real, registered code, and a teapot cannot brew coffee. - 421 Misdirected Request — The request reached a server that is not able to answer for the host it asked about, typically because an HTTP/2 connection was reused for the wrong origin. - 422 Unprocessable Content — The syntax is fine and the server understood the request, but the content is semantically wrong — a valid date in the past where a future one is required, a transfer that would overdraw an account. - 423 Locked — The resource is locked, and this request would need the lock it does not hold. - 424 Failed Dependency — This operation failed because another operation it depended on failed first. - 425 Too Early — The server will not process a request sent in TLS early data (0-RTT), because it could be replayed by an attacker. - 426 Upgrade Required — The server refuses to serve this request over the current protocol and names the one to switch to in the Upgrade header. - 428 Precondition Required — The server requires this request to be conditional — to carry If-Match or similar — so that a write cannot overwrite a change it has not seen. - 429 Too Many Requests — You are being rate limited. The response should carry Retry-After, and usually X-RateLimit-Limit, -Remaining and -Reset. - 431 Request Header Fields Too Large — The request's headers are too large — all together, or one of them on its own — for the server to process. - 451 Unavailable For Legal Reasons — The server will not serve this resource for legal reasons — a court order, a government block or a takedown that applies to the requester. Server error - 500 Internal Server Error — The server failed and cannot say anything more useful. Nothing about the request needs to be wrong. - 501 Not Implemented — The server does not support the functionality required — usually the HTTP method itself — for any resource. - 502 Bad Gateway — A gateway or proxy got an invalid response from the server behind it — a crash, a closed connection, garbage instead of HTTP. - 503 Service Unavailable — The server is temporarily unable to handle the request — overloaded, or down for maintenance. Often accompanied by Retry-After. - 504 Gateway Timeout — An upstream server did not respond in time. The failure is in the chain behind the endpoint, not at the endpoint itself. - 505 HTTP Version Not Supported — The server does not support the major HTTP version used in the request. - 507 Insufficient Storage — The server cannot store the representation needed to complete the request — it has run out of space. - 508 Loop Detected — The server stopped processing because it detected an infinite loop — typically a resource that, directly or indirectly, includes itself. - 511 Network Authentication Required — The client has to authenticate to gain network access — the response comes from a captive portal, not from the server you asked for. Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing TITLE: API Testing Techniques, Hands-On — Fun API Playground ================================================================ API testing techniques you can practise right now Each technique below is backed by endpoints that really behave that way — real rate limits, real token expiry, real HMAC signatures, real conflicts — so you can rehearse the failure before production supplies it. - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Every HTTP status code · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/friends TITLE: Friends API — Mock REST API, 14 endpoints | Fun API ================================================================ Friends API — free mock REST API for testing Characters, episodes and quotes from the sitcom universe. Practice CRUD, Bearer auth, pagination, filtering and every error code — no setup needed. The Friends API models a sitcom archive: six main characters with jobs and catchphrases, ten episodes, and a quote collection. It is the catalog's introduction to API versioning — the v1 character list is deliberately marked deprecated and answers with Deprecation, Sunset and Link headers pointing at v2, so you can practise the one migration path most public APIs eventually force on their consumers. Base URL: https://funapi.dev/api/friends/v1 · 14 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/friends/v1/episodes — List episodes, filter by season. No token, no signup: curl -i https://funapi.dev/api/friends/v1/episodes answers 200 OK with: { "total": 10, "data": [ { "id": 1, "title": "The One Where Monica Gets a Roommate", "season": 1, "episode": 1, "rating": 8.3 }, { "id": 2, "title": "The One with the Prom Video", "season": 2, "episode": 14, "rating": 9.4 }, { "id": 3, "title": "The One Where No One's Ready", "season": 3, "episode": 2, "rating": 8.9 }, { "id": 4, "title": "The One with the Embryos", "season": 4, "episode": 12, "rating": 9.5 }, { "id": 5, "title": "The One with All the Thanksgivings", "season": 5, "episode": 8, "rating": 9.1 }, { "id": 6, "title": "The One with Ross's Sandwich", "season": 5, "episode": 9, "rating": 9 }, { "id": 7, "title": "The One Where Everybody Finds Out", "season": 5, "episode": 14, "rating": 9.7 }, { "id": 8, "title": "The One with the Cop", "season": 5, "episode": 16, (truncated — the full response comes back when you run it) Open and run this endpoint What you can practise here - Read the Deprecation and Sunset headers on GET /characters, then follow the Link header to the v2 successor. - Send an unknown query parameter to the strict v1 list endpoint and watch it answer 400 rather than ignoring it. - Create a character with an Idempotency-Key, replay the exact request, and confirm you get the original 201 body back instead of a duplicate. - Ask for a page beyond the end of the collection and handle the 404 your pagination code probably assumes never happens. characters the six of them, and more GET /friends/v1/characters — List all characters (paginated) — v1, deprecated · Responds with 200 400 404 Link to this endpoint GET /friends/v1/characters/{id} — Get one character · Responds with 200 400 404 Link to this endpoint POST /friends/v1/characters — Create a character (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint POST /friends/v1/characters/bulk — Batch-create characters (array body, per-item validation) (requires Bearer auth) · Responds with 201 207 400 401 Link to this endpoint PUT /friends/v1/characters/{id} — Update a character (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint POST /friends/v1/characters/bulk-delete — Bulk-delete characters by id (partial success supported) (requires Bearer auth) · Responds with 200 207 400 401 403 Link to this endpoint DELETE /friends/v1/characters/{id} — Delete a character (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint GET /friends/v1/characters/{id}/quotes — Get a character's quotes (nested resource) · Responds with 200 404 Link to this endpoint GET /friends/v2/characters — List characters — v2 (breaking change: job → occupation, re-wrapped) · Responds with 200 400 404 Link to this endpoint GET /friends/version — Discover supported API versions · Responds with 200 Link to this endpoint GET /friends/characters — Content-negotiated version via Accept header (406 if unsupported) · Responds with 200 406 Link to this endpoint episodes ten fan favorites GET /friends/v1/episodes — List episodes, filter by season · Responds with 200 400 Link to this endpoint quotes could this API BE any more quotable? GET /friends/v1/quotes/random — A random quote · Responds with 200 Link to this endpoint graphql one POST endpoint, query-shaped POST /friends/v1/graphql — Run a query or mutation over character data · Responds with 200 400 Link to this endpoint Related APIs - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. - Sherlock Holmes API — Cases, suspects & clues from Baker Street. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Friends API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/superhero TITLE: Superhero API — Mock REST API, 6 endpoints | Fun API ================================================================ Superhero API — free mock REST API for testing Original heroes and villains with powers, teams and nemeses. Practice nested resources (/heroes/{id}/nemesis), filtering and role-based auth. The Superhero API is the smallest resource tree in the catalog and the clearest one for practising nested routes: heroes own powers, and powers are addressed underneath their hero rather than in a flat collection. If you are writing a client that has to build URLs from parent ids, or tests that must clean up children before parents, this is the shape to rehearse on. Base URL: https://funapi.dev/api/superheroes/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/superheroes/v1/heroes — List heroes (paginated, filterable). No token, no signup: curl -i https://funapi.dev/api/superheroes/v1/heroes answers 200 OK with: { "page": 1, "pageSize": 4, "total": 8, "totalPages": 2, "data": [ { "id": 1, "name": "Captain Volt", "alias": "Deniz Aksoy", "power": "electricity", "team": "Alpha Squad", "nemesisId": 5, "_v": 1 }, { "id": 2, "name": "Night Owl", "alias": "Sam Reyes", "power": "night vision", "team": "Alpha Squad", "nemesisId": 6, "_v": 1 }, { "id": 3, "name": "Aqua Comet", "alias": "Mira Chen", "power": "hydrokinesis", "team": "Freelance", "nemesisId": null, "_v": 1 }, { "id": 4, "name": "Turbo Tortoise", "alias": "unknown", "power": "super speed (eventually)", "team": "Freelance", "nemesisId": 7, "_v": 1 } ] } Open and run this endpoint What you can practise here - Fetch a hero, then its powers sub-collection, and check what happens when the parent id is valid but the child id is not. - Delete a hero that still has powers attached and see how the API handles the orphaned children. - Use If-Match with a stale ETag on an update and confirm the 412 before your real client meets one. - Call a write endpoint with qa-viewer-token to see the 403 that separates read-only from admin credentials. heroes capes, powers and their sworn enemies GET /superheroes/v1/heroes — List heroes (paginated, filterable) · Responds with 200 400 404 Link to this endpoint GET /superheroes/v1/heroes/{id} — Get one hero · Responds with 200 404 Link to this endpoint GET /superheroes/v1/heroes/{id}/nemesis — Get a hero's nemesis (nested resource) · Responds with 200 404 Link to this endpoint POST /superheroes/v1/heroes — Register a new hero (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint DELETE /superheroes/v1/heroes/{id} — Retire a hero (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint POST /superheroes/v1/heroes/versus — Simulate a fight between two heroes (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint Related APIs - Dino Park API — Dinosaurs, enclosures & the occasional breach. - Space Agency API — Launches, scrubs & probes with real signal lag. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/pizza TITLE: Pizza Orders API — Mock REST API, 9 endpoints | Fun API ================================================================ Pizza Orders API — free mock REST API for testing A tiny pizzeria backend: menu, order placement with validation, an order-status flow — and /oven/status, which always returns 500 for negative testing. The Pizza Orders API is a small order-lifecycle service: a menu, orders that move through states, and an oven endpoint that fails on purpose. It is the page to open when you need a guaranteed, repeatable 500 — most sandboxes make server errors impossible to reproduce, which is exactly why retry logic and error handling so often ship untested. Base URL: https://funapi.dev/api/pizza/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/pizza/v1/menu — Get the menu. No token, no signup: curl -i https://funapi.dev/api/pizza/v1/menu answers 200 OK with: { "total": 6, "data": [ { "id": 1, "name": "Margherita", "price": 9.5, "vegetarian": true }, { "id": 2, "name": "Pepperoni", "price": 11, "vegetarian": false }, { "id": 3, "name": "Quattro Formaggi", "price": 12.5, "vegetarian": true }, { "id": 4, "name": "Veggie Garden", "price": 10.5, "vegetarian": true }, { "id": 5, "name": "BBQ Chicken", "price": 12, "vegetarian": false }, { "id": 6, "name": "Hawaiian", "price": 11, "vegetarian": false, "controversial": true } ] } Open and run this endpoint What you can practise here - Call the oven endpoint for a reliable 500 and verify your client retries, backs off, or surfaces the error rather than hanging. - Send a PUT to an endpoint that only accepts POST and read the 405 together with its Allow header. - Cancel an order twice and use the 409 to check that your code treats conflict as a state problem, not a transport failure. - Hit the deliberately slow endpoint to confirm your HTTP client timeout is actually configured and actually fires. menu six pizzas, one controversial DELETE /pizza/v1/menu — Delete the menu — always 405, the menu is read-only · Responds with 405 Link to this endpoint GET /pizza/v1/menu — Get the menu · Responds with 200 400 Link to this endpoint orders received → baking → out-for-delivery → delivered POST /pizza/v1/orders — Place an order (validated) · Responds with 201 400 Link to this endpoint GET /pizza/v1/orders/{id} — Track an order · Responds with 200 404 Link to this endpoint PUT /pizza/v1/orders/{id}/status — Update order status (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint PATCH /pizza/v1/orders/{id} — Partially update an order (address or size) · Responds with 200 400 404 Link to this endpoint DELETE /pizza/v1/orders/{id} — Cancel an order (409 if already delivered) · Responds with 204 404 409 Link to this endpoint oven do not trust the oven GET /pizza/v1/oven/status — Always returns 500 — for negative tests · Responds with 500 Link to this endpoint GET /pizza/v1/oven/preheat — Preheat the oven — always takes ~3s · Responds with 200 Link to this endpoint Related APIs - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. - Airline API — Flights, seat conflicts & overbooking drama. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/coffee TITLE: Coffee Shop API — Mock REST API, 6 endpoints | Fun API ================================================================ Coffee Shop API — free mock REST API for testing A café counter API: browse drinks, place orders — and GET /teapot, which proudly returns HTTP 418 "I'm a teapot". The Coffee Shop API is the catalog's rate-limiting playground and the home of HTTP 418. Its rush endpoint enforces a real quota: exceed it and you get a 429 with Retry-After and the usual X-RateLimit headers, refreshed on a live window. Client-side throttling and backoff are almost impossible to test against a well-behaved API, and this one misbehaves on request. Base URL: https://funapi.dev/api/coffee/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/coffee/v1/drinks — List drinks, filter by type. No token, no signup: curl -i https://funapi.dev/api/coffee/v1/drinks answers 200 OK with: { "total": 8, "data": [ { "id": 1, "name": "Espresso", "type": "hot", "price": 2.5 }, { "id": 2, "name": "Latte", "type": "hot", "price": 4 }, { "id": 3, "name": "Cappuccino", "type": "hot", "price": 3.8 }, { "id": 4, "name": "Flat White", "type": "hot", "price": 4.2 }, { "id": 5, "name": "Cold Brew", "type": "cold", "price": 4.5 }, { "id": 6, "name": "Iced Matcha Latte", "type": "cold", "price": 4.8 }, { "id": 7, "name": "Mocha", "type": "hot", "price": 4.4 }, { "id": 8, "name": "Turkish Coffee", "type": "hot", "price": 3 } ] } Open and run this endpoint What you can practise here - Fire requests at the rush endpoint until it answers 429, then respect Retry-After and watch the window reopen. - Read X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset on a successful call and build your throttle from them. - Ask the teapot endpoint to brew coffee and collect the 418 your status-code assertion table is missing. - Order a drink that is out of stock and separate the 409 from the 400 in your error handling. drinks hot and cold GET /coffee/v1/drinks — List drinks, filter by type · Responds with 200 400 Link to this endpoint GET /coffee/v1/drinks/{id} — Get one drink · Responds with 200 404 Link to this endpoint orders name on the cup POST /coffee/v1/orders — Order a drink · Responds with 201 400 Link to this endpoint PUT /coffee/v1/orders/{id}/ready — Mark an order ready (409 if already ready) · Responds with 200 404 409 412 Link to this endpoint rush hammer it and watch the 429s GET /coffee/v1/rush-hour — Rush hour special — max 3 requests per 10s · Responds with 200 429 Link to this endpoint teapot RFC 2324 compliance GET /coffee/v1/teapot — Try to brew coffee in a teapot · Responds with 418 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. - Airline API — Flights, seat conflicts & overbooking drama. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/football TITLE: Football API — Mock REST API, 7 endpoints | Fun API ================================================================ Football API — free mock REST API for testing A fictional league: teams with nested player squads, a standings table, and a match simulator with input validation. The Football API keeps league tables, squads and simulated match results — data that changes only when a match is played, which makes it the right place to practise HTTP caching. Standings respond with an ETag, and a conditional GET carrying If-None-Match answers 304 with no body at all. Base URL: https://funapi.dev/api/football/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/football/v1/teams — List teams (paginated). No token, no signup: curl -i https://funapi.dev/api/football/v1/teams answers 200 OK with: { "page": 1, "pageSize": 4, "total": 6, "totalPages": 2, "data": [ { "id": 1, "name": "Atlas FC", "city": "Istanbul", "founded": 1962, "_v": 1 }, { "id": 2, "name": "River Wolves", "city": "Porto Verde", "founded": 1948, "_v": 1 }, { "id": 3, "name": "Port Albion", "city": "Southbay", "founded": 1931, "_v": 1 }, { "id": 4, "name": "Falcon United", "city": "Ankara", "founded": 1975, "_v": 1 } ] } Open and run this endpoint What you can practise here - GET the standings, keep the ETag, and repeat the request with If-None-Match for a 304 with an empty body. - Simulate a match, then confirm the standings ETag changed and your cached copy is correctly invalidated. - Delete a team without a token and with a viewer token, and compare the 401 against the 403. - Register the same fixture twice and handle the 409 as a duplicate rather than a retryable failure. teams six fictional clubs GET /football/v1/teams — List teams (paginated) · Responds with 200 400 404 Link to this endpoint GET /football/v1/teams/{id} — Get one team · Responds with 200 404 Link to this endpoint GET /football/v1/teams/{id}/players — Get a team's squad (nested) · Responds with 200 404 Link to this endpoint GET /football/v1/teams/{id}/matches — Get a team's match history (nested resource) · Responds with 200 404 Link to this endpoint DELETE /football/v1/teams/{id} — Remove a team (409 if it has played matches) (requires Bearer auth) · Responds with 204 401 403 404 409 412 Link to this endpoint league standings and matches GET /football/v1/standings — League table — cacheable (ETag / If-None-Match / 304) · Responds with 200 304 Link to this endpoint POST /football/v1/matches — Simulate a match (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. - Airline API — Flights, seat conflicts & overbooking drama. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/movies TITLE: Movies API — Mock REST API, 9 endpoints | Fun API Playground ================================================================ Movies API — free mock REST API for testing A catalog of entirely fictional QA-themed films. Practice multi-parameter filtering, sorting, range validation on ratings, and role-based deletes. The Movies API is a QA-themed catalog you can sort, filter and rate — and the only one with a file-upload endpoint that enforces limits. Posters have a maximum size and an allowed content type, so this is where 413 Payload Too Large and 415 Unsupported Media Type stop being theory. Base URL: https://funapi.dev/api/movies/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/movies/v1/movies — List movies (filter, sort, paginate). No token, no signup: curl -i https://funapi.dev/api/movies/v1/movies answers 200 OK with: { "page": 1, "pageSize": 5, "total": 10, "totalPages": 2, "data": [ { "id": 1, "title": "Midnight Debugger", "genre": "thriller", "year": 2019, "rating": 7.8, "_v": 1 }, { "id": 2, "title": "The 404 Identity", "genre": "thriller", "year": 2021, "rating": 8.1, "_v": 1 }, { "id": 3, "title": "Gone in 60 Milliseconds", "genre": "action", "year": 2020, "rating": 6.9, "_v": 1 }, { "id": 4, "title": "The Curious Case of the Missing Semicolon", "genre": "comedy", "year": 2018, "rating": 7.2, "_v": 1 }, { "id": 5, "title": "Null Pointer in Manhattan", "genre": "drama", "year": 2022, "rating": 7.5, "_v": 1 } ] } Open and run this endpoint What you can practise here - Upload a poster over the size limit for a 413, then one with the wrong Content-Type for a 415. - Combine sort and filter query parameters and check the ordering your client assumes is actually the one returned. - Rate a film outside the valid range and read the validation error the API sends back. - Update a movie with a stale ETag to trigger the 412 optimistic-concurrency path. movies now showing: Edge Case (2024) GET /movies/v1/movies — List movies (filter, sort, paginate) · Responds with 200 400 404 Link to this endpoint GET /movies/v1/movies/{id} — Get one movie · Responds with 200 404 Link to this endpoint GET /movies/v1/search — Full-text search movie titles · Responds with 200 Link to this endpoint GET /movies/v1/search/fuzzy — Typo-tolerant search (fuzzy match, "did you mean") · Responds with 200 400 Link to this endpoint POST /movies/v1/movies — Add a movie (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /movies/v1/movies/{id}/rating — Rate a movie (0–10 inclusive) (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /movies/v1/movies/{id} — Remove a movie (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint GET /movies/v1/movies/{id}/similar — Get movies with the same genre (recommendation) · Responds with 200 404 Link to this endpoint uploads simulated multipart file uploads POST /movies/v1/movies/{id}/poster — Upload a movie poster (simulated multipart file upload) (requires Bearer auth) · Responds with 201 400 401 404 413 415 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. - Sherlock Holmes API — Cases, suspects & clues from Baker Street. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/wizarding TITLE: Harry Potter API — Mock REST API, 10 endpoints | Fun API ================================================================ Harry Potter API — free mock REST API for testing Houses, students and spells from a fictional wizarding school. Practice CRUD, Bearer auth, nested filtering by house, pagination and optimistic concurrency. The Harry Potter API models a magic school: four houses with point totals, students sorted into them, and a spell book. Points move between houses, which makes it a natural fit for practising the read-modify-write cycle — and for seeing what happens when two clients try it at the same time. Base URL: https://funapi.dev/api/wizarding/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/wizarding/v1/houses — List all houses. No token, no signup: curl -i https://funapi.dev/api/wizarding/v1/houses answers 200 OK with: { "total": 4, "data": [ { "id": 1, "name": "Gryffindor", "founder": "Godric Gryffindor", "traits": [ "courage", "bravery", "daring" ], "element": "fire", "points": 472 }, { "id": 2, "name": "Slytherin", "founder": "Salazar Slytherin", "traits": [ "ambition", "cunning", "resourcefulness" ], "element": "water", "points": 452 }, { "id": 3, "name": "Hufflepuff", "founder": "Helga Hufflepuff", "traits": [ "patience", "loyalty", "fairness" ], "element": "earth", "points": 428 }, { "id": 4, "name": "Ravenclaw", "founder": "Rowena Ravenclaw", "traits": [ "wisdom", "wit", "creativity" ], "element": "air", "points": 461 } ] } Open and run this endpoint What you can practise here - Award house points from two concurrent requests and use If-Match to make one of them lose with a 412. - Sort a student into a house that does not exist and read the 404 rather than a silent success. - Page through the spell list and confirm your client handles the final, partially-full page correctly. - Try a protected write with no Authorization header at all to see the bare 401. houses four houses, four elements GET /wizarding/v1/houses — List all houses · Responds with 200 Link to this endpoint GET /wizarding/v1/houses/{id} — Get one house · Responds with 200 404 Link to this endpoint POST /wizarding/v1/sorting-hat — The Sorting Hat assigns you a house (stateless, random) · Responds with 200 Link to this endpoint students sorted, patronus and all GET /wizarding/v1/students — List students (paginated, filter by house) · Responds with 200 400 404 Link to this endpoint GET /wizarding/v1/students/{id} — Get one student · Responds with 200 404 Link to this endpoint POST /wizarding/v1/students — Enroll a student (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /wizarding/v1/students/{id} — Update a student (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /wizarding/v1/students/{id} — Expel a student (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint spells charms, jinxes, and one unforgivable GET /wizarding/v1/spells — List spells, filter by type · Responds with 200 Link to this endpoint GET /wizarding/v1/spells/random — A random spell · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Star Wars API — Characters, planets & starships from a galaxy far away. - Sherlock Holmes API — Cases, suspects & clues from Baker Street. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Harry Potter API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/galaxy TITLE: Star Wars API — Mock REST API, 11 endpoints | Fun API ================================================================ Star Wars API — free mock REST API for testing Characters, homeworlds and starships from a fictional space opera. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency. The Star Wars API covers characters, planets and starships — three related collections with enough cross-references to make filtering interesting. It is a good first stop for anyone building a client that has to resolve ids across resources and page through more records than fit in a single response. Base URL: https://funapi.dev/api/galaxy/v1 · 11 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/galaxy/v1/planets — List all planets. No token, no signup: curl -i https://funapi.dev/api/galaxy/v1/planets answers 200 OK with: { "total": 5, "data": [ { "id": 1, "name": "Tatooine", "climate": "arid", "population": 200000 }, { "id": 2, "name": "Hoth", "climate": "frozen", "population": 0 }, { "id": 3, "name": "Dagobah", "climate": "murky", "population": 0 }, { "id": 4, "name": "Coruscant", "climate": "temperate", "population": 1000000000 }, { "id": 5, "name": "Endor", "climate": "temperate", "population": 30000000 } ] } Open and run this endpoint What you can practise here - Filter characters by their home planet and check the empty-result case returns 200 with an empty list, not a 404. - Walk every page of the starship collection and assert the total count matches what you actually collected. - Create a starship, update it with the wrong ETag for a 412, then retry with the current one. - Delete with a viewer token to see the 403 that read-only credentials produce. planets five worlds, one swamp GET /galaxy/v1/planets — List all planets · Responds with 200 Link to this endpoint GET /galaxy/v1/planets/{id} — Get one planet · Responds with 200 404 Link to this endpoint characters rebels, empire, and neutral parties GET /galaxy/v1/characters — List characters (paginated, filter by affiliation) · Responds with 200 400 404 Link to this endpoint GET /galaxy/v1/characters/{id} — Get one character · Responds with 200 404 Link to this endpoint GET /galaxy/v1/characters/{id}/homeworld — Get a character's homeworld (nested resource) · Responds with 200 404 Link to this endpoint POST /galaxy/v1/characters — Add a character (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /galaxy/v1/characters/{id} — Update a character (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /galaxy/v1/characters/{id} — Remove a character (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint starships freighters to capital ships GET /galaxy/v1/starships — List starships, filter by class · Responds with 200 Link to this endpoint GET /galaxy/v1/starships/random — A random starship · Responds with 200 Link to this endpoint GET /galaxy/v1/starships/{id} — Get one starship · Responds with 200 404 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Sherlock Holmes API — Cases, suspects & clues from Baker Street. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures How this Star Wars API differs from SWAPI Unofficial and fan-made. The Star Wars API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/holmes TITLE: Sherlock Holmes API — Mock REST API, 10 endpoints | Fun API ================================================================ Sherlock Holmes API — free mock REST API for testing Cases, suspects and clues from a fictional Victorian detective agency. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency. The Sherlock Holmes API is a case file: investigations with suspects and clues, and cases that move from open to solved. It is the catalog's PATCH endpoint — partial updates rather than whole-object PUTs — which is where most clients quietly send the wrong thing and never find out. Base URL: https://funapi.dev/api/holmes/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/holmes/v1/cases — List all cases. No token, no signup: curl -i https://funapi.dev/api/holmes/v1/cases answers 200 OK with: { "total": 5, "data": [ { "id": 1, "title": "The Vanishing Violin", "status": "solved", "year": 1889 }, { "id": 2, "title": "The Crimson Cipher", "status": "solved", "year": 1891 }, { "id": 3, "title": "The Baker Street Burglary", "status": "open", "year": 1894 }, { "id": 4, "title": "The Midnight Telegram", "status": "solved", "year": 1896 }, { "id": 5, "title": "The Fogbound Heir", "status": "open", "year": 1899 } ] } Open and run this endpoint What you can practise here - PATCH a single field on a case and confirm the untouched fields survive, which a careless PUT would have wiped. - Close a case that is already closed and read the 409 rather than assuming the operation is idempotent. - Add a clue to a case that does not exist and check the 404 comes from the parent, not the child. - Attach a suspect twice and see how the API reports the duplicate. cases five cases, two still open GET /holmes/v1/cases — List all cases · Responds with 200 400 Link to this endpoint GET /holmes/v1/cases/{id} — Get one case · Responds with 200 404 Link to this endpoint GET /holmes/v1/cases/{id}/suspects — Get all suspects for a case (nested resource) · Responds with 200 404 Link to this endpoint PATCH /holmes/v1/cases/{id} — Update a case status (409 if unchanged) (requires Bearer auth) · Responds with 200 400 401 404 409 Link to this endpoint suspects alibis included, guilt undisclosed GET /holmes/v1/suspects/{id} — Get one suspect · Responds with 200 404 Link to this endpoint POST /holmes/v1/suspects — Add a suspect to a case (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /holmes/v1/suspects/{id} — Update a suspect (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /holmes/v1/suspects/{id} — Clear a suspect (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint clues physical, document, and testimony GET /holmes/v1/clues — List clues, filter by case or type · Responds with 200 Link to this endpoint GET /holmes/v1/clues/random — A random clue · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/pokemon TITLE: Pokémon API — Mock REST API, 10 endpoints | Fun API ================================================================ Pokémon API — free mock REST API for testing Creatures, trainers and a battle simulator. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency. The Pokémon API holds creatures, trainers and a battle endpoint that resolves a fight from the two teams you send it. The battle result is computed, not stored, which makes it the catalog's clearest example of a POST that is neither a create nor idempotent — and a good target for contract tests over a non-trivial response shape. Base URL: https://funapi.dev/api/pokemon/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/pokemon/v1/pokemon — List Pokémon (paginated, filter by type). No token, no signup: curl -i https://funapi.dev/api/pokemon/v1/pokemon answers 200 OK with: { "page": 1, "pageSize": 4, "total": 8, "totalPages": 2, "data": [ { "id": 1, "name": "Pikachu", "type": "electric", "level": 12, "hp": 60, "_v": 1 }, { "id": 2, "name": "Bulbasaur", "type": "grass", "level": 10, "hp": 65, "_v": 1 }, { "id": 3, "name": "Charmander", "type": "fire", "level": 11, "hp": 58, "_v": 1 }, { "id": 4, "name": "Squirtle", "type": "water", "level": 10, "hp": 63, "_v": 1 } ] } Open and run this endpoint What you can practise here - Run a battle twice with the same teams and decide whether your test asserts on the outcome or only on the response shape. - Filter creatures by type and confirm your client handles a type with no members. - Register a trainer, then create one with a name already taken, and read the conflict. - Page through the creature list and check the pagination metadata against the number of records you received. pokemon eight starters and friends GET /pokemon/v1/pokemon — List Pokémon (paginated, filter by type) · Responds with 200 400 404 Link to this endpoint GET /pokemon/v1/pokemon/{id} — Get one Pokémon · Responds with 200 404 Link to this endpoint GET /pokemon/v1/pokemon/random — A random Pokémon (wild encounter) · Responds with 200 Link to this endpoint POST /pokemon/v1/pokemon — Catch a new Pokémon (create) (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /pokemon/v1/pokemon/{id} — Update a Pokémon (level up, heal, etc.) (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /pokemon/v1/pokemon/{id} — Release a Pokémon (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint trainers three trainers, their rosters GET /pokemon/v1/trainers — List all trainers · Responds with 200 Link to this endpoint GET /pokemon/v1/trainers/{id}/pokemon — Get a trainer's roster (nested resource) · Responds with 200 404 Link to this endpoint battles simulate a fight, get a random winner POST /pokemon/v1/battles — Simulate a battle between two Pokémon (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint GET /pokemon/v1/battles — List battle history (empty until you POST one) · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures How this Pokémon API differs from PokeAPI Unofficial and fan-made. The Pokémon API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/middleearth TITLE: Middle-earth API — Mock REST API, 9 endpoints | Fun API ================================================================ Middle-earth API — free mock REST API for testing Fellowship members, quests and artifacts from a fictional fantasy epic. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency. The Middle-earth API tracks a fellowship, the quests it is assigned and the artifacts it carries. Members join and leave quests, so it is built around association endpoints — the join-table operations that are easy to write and easy to get wrong when the same member is added twice or removed from a quest they were never on. Base URL: https://funapi.dev/api/middleearth/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/middleearth/v1/fellowship — List fellowship members (paginated, filter by race). No token, no signup: curl -i https://funapi.dev/api/middleearth/v1/fellowship answers 200 OK with: { "page": 1, "pageSize": 3, "total": 6, "totalPages": 2, "data": [ { "id": 1, "name": "Aldric Underhill", "race": "hobbit", "skill": "stealth", "_v": 1 }, { "id": 2, "name": "Thoren Oakenshield II", "race": "dwarf", "skill": "axework", "_v": 1 }, { "id": 3, "name": "Elarion Swiftarrow", "race": "elf", "skill": "archery", "_v": 1 } ] } Open and run this endpoint What you can practise here - Assign the same member to a quest twice and check whether the second call is a conflict or a no-op. - Remove a member from a quest they never joined and read the status the API chose. - Update a quest with If-Match after someone else has changed it, for a 412. - List artifacts filtered by bearer and handle the empty result as success. fellowship six companions, six races GET /middleearth/v1/fellowship — List fellowship members (paginated, filter by race) · Responds with 200 400 404 Link to this endpoint GET /middleearth/v1/fellowship/{id} — Get one fellowship member · Responds with 200 404 Link to this endpoint GET /middleearth/v1/fellowship/{id}/artifact — Get the artifact carried by a member (nested resource) · Responds with 200 404 Link to this endpoint POST /middleearth/v1/fellowship — Recruit a new member (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /middleearth/v1/fellowship/{id} — Update a fellowship member (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /middleearth/v1/fellowship/{id} — Remove a member from the fellowship (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint quests one ring, several detours GET /middleearth/v1/quests — List quests, filter by status · Responds with 200 400 Link to this endpoint GET /middleearth/v1/quests/random — A random quest · Responds with 200 Link to this endpoint artifacts each bound to a bearer GET /middleearth/v1/artifacts — List all artifacts · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Middle-earth API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/auth TITLE: Auth Playground API — Mock REST API, 6 endpoints | Fun API ================================================================ Auth Playground API — free mock REST API for testing A simulated OAuth 2.0 authorization server. Practice the client-credentials and authorization-code grants, token expiry, refresh tokens, and the standard invalid_client / invalid_grant error shapes — independent of the qa-admin-token / qa-viewer-token used elsewhere on this site. The "real tokens" tag issues a working token from /login (or /firebase-token) that unlocks every 🔒 endpoint across this playground. The Auth Playground issues real, verifiable tokens over genuine OAuth 2.0 flows — client credentials and authorization code, plus refresh and deliberate expiry. Nothing here is a stub: the tokens are signed, they expire on schedule, and an expired one is rejected. It is the page for testing what your client does when a token dies mid-session, which is the failure most integrations never rehearse. Base URL: https://funapi.dev/api/auth/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/auth/v1/oauth/protected-resource — A resource protected by a token from this flow (not the site-wide Authorize button). No token, no signup: curl -i https://funapi.dev/api/auth/v1/oauth/protected-resource answers 401 Unauthorized with: { "error": "invalid_token", "message": "Missing or malformed Authorization header. Expected \"Bearer \"." } Open and run this endpoint What you can practise here - Complete the client-credentials flow, then call a protected endpoint with the token you were issued. - Wait for a short-lived token to expire and confirm your client refreshes instead of failing the user's request. - Exchange a refresh token, then try to reuse the old one and read the rejection. - Send a structurally valid but wrongly-signed token and check it is refused as firmly as a missing one. oauth client demo-client / secret demo-secret POST /auth/v1/oauth/authorize — Step 1: request an authorization code · Responds with 200 400 Link to this endpoint POST /auth/v1/oauth/token — Step 2: exchange for a token (client_credentials / authorization_code / refresh_token) · Responds with 200 400 Link to this endpoint GET /auth/v1/oauth/protected-resource — A resource protected by a token from this flow (not the site-wide Authorize button) · Responds with 200 401 Link to this endpoint real tokens log in for a token that works on the 🔒 endpoints site-wide POST /auth/v1/login — Log in as a demo user and get a working token (roles: admin / viewer) · Responds with 200 400 401 Link to this endpoint POST /auth/v1/firebase-token — Mint a simulated Firebase-style token whose role claim grants admin or viewer · Responds with 200 400 Link to this endpoint GET /auth/v1/me — Inspect the token you are sending (role, kind, subject) (requires Bearer auth) · Responds with 200 401 Link to this endpoint Related APIs - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Object Storage API — Objects, checksums, ranges & resumable uploads. - Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/webhooks TITLE: Webhooks API — Mock REST API, 7 endpoints | Fun API ================================================================ Webhooks API — free mock REST API for testing A simulated webhook dispatcher. Register a subscription, trigger an event, and inspect delivery attempts (~70% simulated success rate), retries, and payload-signature verification. Signatures here are a simplified simulated scheme for testing your verification logic — not real HMAC-SHA256. The Webhooks API is the receiving end of the problem: register a callback URL, trigger an event, then inspect exactly what was delivered and replay it. Deliveries are signed with an HMAC, so you can practise verifying a signature — including the constant-time comparison and the replay window that separate a real verifier from a string equality check. Base URL: https://funapi.dev/api/webhooks/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. What you can practise here - Register a subscription, trigger an event, and verify the HMAC signature on the delivery against the shared secret. - Replay a stored delivery and confirm your receiver is idempotent rather than double-processing it. - Tamper with one byte of a delivery body and check that signature verification fails. - Inspect the delivery log to see what your endpoint actually received, headers included. subscriptions who gets notified, and for what POST /webhooks/v1/subscriptions — Register a webhook subscription (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint GET /webhooks/v1/subscriptions — List webhook subscriptions (secrets redacted) (requires Bearer auth) · Responds with 200 Link to this endpoint DELETE /webhooks/v1/subscriptions/{id} — Unsubscribe (requires Bearer auth) · Responds with 204 401 403 404 Link to this endpoint deliveries attempts, replays, and signature checks POST /webhooks/v1/trigger — Fire an event to all matching subscriptions (~70% simulated success) (requires Bearer auth) · Responds with 200 201 400 Link to this endpoint GET /webhooks/v1/deliveries — List delivery attempts, filter by status or subscription (requires Bearer auth) · Responds with 200 400 Link to this endpoint POST /webhooks/v1/deliveries/{id}/replay — Replay a delivery attempt (409 after 3 attempts) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint POST /webhooks/v1/verify-signature — Verify a payload signature (simulated scheme, not real HMAC) · Responds with 200 400 Link to this endpoint Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Object Storage API — Objects, checksums, ranges & resumable uploads. - Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/theoffice TITLE: The Office API — Mock REST API, 8 endpoints | Fun API ================================================================ The Office API — free mock REST API for testing Employees, office pranks and quotes from a fictional paper company mockumentary. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency. The Office API covers a paper company: employees, the pranks played on them and a quote collection. It is one of the gentler CRUD surfaces in the catalog and a reasonable first target when you are teaching someone the request/response loop before introducing auth, concurrency or error injection. Base URL: https://funapi.dev/api/office/v1 · 8 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/office/v1/employees — List employees (paginated, filter by department). No token, no signup: curl -i https://funapi.dev/api/office/v1/employees answers 200 OK with: { "page": 1, "pageSize": 4, "total": 8, "totalPages": 2, "data": [ { "id": 1, "name": "Michael Scott", "role": "Regional Manager", "department": "Management", "deskNumber": 1, "_v": 1 }, { "id": 2, "name": "Dwight Schrute", "role": "Assistant to the Regional Manager", "department": "Sales", "deskNumber": 2, "_v": 1 }, { "id": 3, "name": "Jim Halpert", "role": "Sales Representative", "department": "Sales", "deskNumber": 3, "_v": 1 }, { "id": 4, "name": "Pam Beesly", "role": "Receptionist", "department": "Reception", "deskNumber": 4, "_v": 1 } ] } Open and run this endpoint What you can practise here - Create, read, update and delete an employee end to end, watching the status code change at each step. - Repeat the delete and see the 404 that tells you the resource is already gone. - Filter pranks by target and confirm an unmatched filter is an empty 200, not an error. - Attempt a write without a token to meet the 401 before you meet it in production. employees eight desks, one regional manager GET /office/v1/employees — List employees (paginated, filter by department) · Responds with 200 400 404 Link to this endpoint GET /office/v1/employees/{id} — Get one employee · Responds with 200 404 Link to this endpoint GET /office/v1/employees/{id}/pranks — Get pranks involving an employee (nested resource) · Responds with 200 404 Link to this endpoint POST /office/v1/employees — Hire a new employee (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /office/v1/employees/{id} — Update an employee (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /office/v1/employees/{id} — Fire an employee (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint pranks mostly aimed at one assistant (to the) regional manager GET /office/v1/pranks — List pranks, filter by severity · Responds with 200 400 Link to this endpoint quotes that's what she said GET /office/v1/quotes/random — A random quote · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The The Office API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/dinopark TITLE: Dino Park API — Mock REST API, 9 endpoints | Fun API ================================================================ Dino Park API — free mock REST API for testing A fictional dinosaur park: creatures, enclosure capacity, and a breach simulator. Practice CRUD, Bearer auth, nested resources, capacity conflicts (409), pagination and optimistic concurrency. The Dino Park API runs a park: dinosaurs, the enclosures holding them, and an incident log for when those two facts stop agreeing. Enclosures have capacity and species compatibility rules, so writes are validated against the current state rather than accepted blindly — which makes it a good target for testing business-rule failures rather than schema failures. Base URL: https://funapi.dev/api/dinopark/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/dinopark/v1/dinosaurs — List dinosaurs (paginated, filter by diet). No token, no signup: curl -i https://funapi.dev/api/dinopark/v1/dinosaurs answers 200 OK with: { "page": 1, "pageSize": 4, "total": 7, "totalPages": 2, "data": [ { "id": 1, "name": "Rexy", "species": "Tyrannosaurus rex", "diet": "carnivore", "enclosureId": 1, "dangerLevel": "extreme", "_v": 1 }, { "id": 2, "name": "Blue", "species": "Velociraptor", "diet": "carnivore", "enclosureId": 1, "dangerLevel": "high", "_v": 1 }, { "id": 3, "name": "Big Eatie", "species": "Brachiosaurus", "diet": "herbivore", "enclosureId": 2, "dangerLevel": "low", "_v": 1 }, { "id": 4, "name": "Bumpy", "species": "Ankylosaurus", "diet": "herbivore", "enclosureId": 2, "dangerLevel": "low", "_v": 1 } ] } Open and run this endpoint What you can practise here - Move a dinosaur into a full enclosure and read the conflict the capacity rule produces. - Put incompatible species together and check the error explains which rule was broken. - File an incident against an enclosure that does not exist and confirm the 404. - Update an enclosure with a stale ETag for the 412 concurrency path. dinosaurs seven residents, one very hungry rex GET /dinopark/v1/dinosaurs — List dinosaurs (paginated, filter by diet) · Responds with 200 400 404 Link to this endpoint GET /dinopark/v1/dinosaurs/{id} — Get one dinosaur · Responds with 200 404 Link to this endpoint GET /dinopark/v1/dinosaurs/{id}/enclosure — Get a dinosaur's enclosure (nested resource) · Responds with 200 404 Link to this endpoint POST /dinopark/v1/dinosaurs — Add a dinosaur (409 if enclosure is at capacity) (requires Bearer auth) · Responds with 201 400 401 409 Link to this endpoint PUT /dinopark/v1/dinosaurs/{id} — Update a dinosaur (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /dinopark/v1/dinosaurs/{id} — Relocate a dinosaur off-site (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint enclosures capacity matters GET /dinopark/v1/enclosures — List all enclosures with current occupancy · Responds with 200 Link to this endpoint incidents breach reports, growing list POST /dinopark/v1/incidents/breach — Simulate a containment breach (random dinosaur & severity) (requires Bearer auth) · Responds with 201 401 Link to this endpoint GET /dinopark/v1/incidents — List incident history (empty until you POST a breach) · Responds with 200 Link to this endpoint Related APIs - Superhero API — Heroes, powers & nemeses. Great for nested resources. - Space Agency API — Launches, scrubs & probes with real signal lag. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/marvel TITLE: Marvel API — Mock REST API, 10 endpoints | Fun API ================================================================ Marvel API — free mock REST API for testing Marvel heroes, villains and mission assignments. Practice CRUD, Bearer auth, nested resources, pagination, and state-transition conflicts (409). The Marvel API assigns heroes and villains to missions, which makes it a three-way relationship rather than a simple parent-child tree. Missions have states and rosters, so it is well suited to testing a client that has to keep several related collections consistent as it writes. Base URL: https://funapi.dev/api/marvel/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/marvel/v1/heroes — List heroes (paginated, filter by team). No token, no signup: curl -i https://funapi.dev/api/marvel/v1/heroes answers 200 OK with: { "page": 1, "pageSize": 4, "total": 6, "totalPages": 2, "data": [ { "id": 1, "name": "Iron Man", "codename": "Tony Stark", "power": "powered armor", "team": "Avengers", "_v": 1 }, { "id": 2, "name": "Spider-Man", "codename": "Peter Parker", "power": "wall-crawling & webs", "team": "Avengers", "_v": 1 }, { "id": 3, "name": "Thor", "codename": "Thor Odinson", "power": "storm control", "team": "Avengers", "_v": 1 }, { "id": 4, "name": "Hulk", "codename": "Bruce Banner", "power": "rage-fueled strength", "team": "Avengers", "_v": 1 } ] } Open and run this endpoint What you can practise here - Assign a hero already committed to another mission and read the conflict. - Advance a mission through its states and try an illegal transition. - Filter by affiliation and confirm the empty case is handled as success. - Delete a mission with a viewer token to see the 403. heroes six Avengers across two teams GET /marvel/v1/heroes — List heroes (paginated, filter by team) · Responds with 200 400 404 Link to this endpoint GET /marvel/v1/heroes/{id} — Get one hero · Responds with 200 404 Link to this endpoint GET /marvel/v1/heroes/{id}/missions — Get a hero's assigned missions (nested resource) · Responds with 200 404 Link to this endpoint POST /marvel/v1/heroes — Recruit a new hero (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /marvel/v1/heroes/{id} — Update a hero (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /marvel/v1/heroes/{id} — Retire a hero (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint villains threat levels, some defeated GET /marvel/v1/villains — List villains, filter by threat level · Responds with 200 400 Link to this endpoint missions assign heroes, then complete them POST /marvel/v1/missions — Assign heroes to a new mission (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint GET /marvel/v1/missions/{id} — Get one mission · Responds with 200 404 Link to this endpoint POST /marvel/v1/missions/{id}/complete — Mark a mission complete (409 if already complete) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Marvel API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/got TITLE: Game of Thrones API — Mock REST API, 12 endpoints | Fun API ================================================================ Game of Thrones API — free mock REST API for testing Great houses of Westeros, their nobles, and the dragons of House Targaryen. Practice CRUD, Bearer auth, nested resources, pagination, and a thematic 409 conflict. The Game of Thrones API is one of the larger surfaces here: houses, nobles, dragons, battles and quotes, with allegiances tying them together. Battles change house standing, so reads taken before a write go stale — making it a practical place to test cache invalidation and optimistic concurrency on something bigger than a two-field record. Base URL: https://funapi.dev/api/got/v1 · 12 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/got/v1/houses — List all houses. No token, no signup: curl -i https://funapi.dev/api/got/v1/houses answers 200 OK with: { "total": 4, "data": [ { "id": 1, "name": "House Stark", "seat": "Winterfell", "words": "Winter Is Coming", "sigil": "a grey direwolf on white" }, { "id": 2, "name": "House Targaryen", "seat": "Dragonstone", "words": "Fire and Blood", "sigil": "a red three-headed dragon on black" }, { "id": 3, "name": "House Lannister", "seat": "Casterly Rock", "words": "Hear Me Roar", "sigil": "a golden lion on crimson" }, { "id": 4, "name": "House Greyjoy", "seat": "Pyke", "words": "We Do Not Sow", "sigil": "a golden kraken on black" } ] } Open and run this endpoint What you can practise here - Fight a battle, then confirm the affected houses' representations changed and your cached copies are invalid. - Update a house with an If-Match header taken before the battle, for a 412. - Swear a noble to a house that does not exist and read the 404. - Page through nobles filtered by house and check the counts add up to the unfiltered total. houses four great houses GET /got/v1/houses — List all houses · Responds with 200 Link to this endpoint GET /got/v1/houses/{id} — Get one house · Responds with 200 404 Link to this endpoint GET /got/v1/houses/{id}/nobles — Get all nobles of a house (nested resource) · Responds with 200 404 Link to this endpoint nobles not all of them survive GET /got/v1/nobles/{id} — Get one noble · Responds with 200 404 Link to this endpoint POST /got/v1/nobles — Add a noble to a house (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /got/v1/nobles/{id} — Update a noble (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint POST /got/v1/nobles/{id}/kill — Kill off a noble (409 if already dead) (requires Bearer auth) · Responds with 200 401 403 404 409 Link to this endpoint dragons two are still unclaimed GET /got/v1/dragons — List dragons, filter by size · Responds with 200 400 Link to this endpoint GET /got/v1/dragons/random — A random dragon · Responds with 200 Link to this endpoint battles Westeros conflict simulator POST /got/v1/battles — Simulate a battle between two houses (requires Bearer auth) · Responds with 201 400 409 Link to this endpoint GET /got/v1/battles/{id} — Get a battle result · Responds with 200 404 Link to this endpoint quotes memorable lines GET /got/v1/quotes/random — Get a random Westeros quote · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Game of Thrones API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/rickandmorty TITLE: Rick and Morty API — Mock REST API, 9 endpoints | Fun API ================================================================ Rick and Morty API — free mock REST API for testing Characters, locations and episodes from the animated sci-fi sitcom. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency. The Rick and Morty API spans characters, locations and episodes across a multiverse, with characters appearing in many episodes. The many-to-many shape is the point: it is the catalog's best target for testing a client that has to de-duplicate records arriving from more than one relationship at once. Base URL: https://funapi.dev/api/rickandmorty/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/rickandmorty/v1/characters — List characters (paginated, filter by status). No token, no signup: curl -i https://funapi.dev/api/rickandmorty/v1/characters answers 200 OK with: { "page": 1, "pageSize": 4, "total": 8, "totalPages": 2, "data": [ { "id": 1, "name": "Rick Sanchez", "species": "Human", "status": "Alive", "locationId": 1, "_v": 1 }, { "id": 2, "name": "Morty Smith", "species": "Human", "status": "Alive", "locationId": 1, "_v": 1 }, { "id": 3, "name": "Summer Smith", "species": "Human", "status": "Alive", "locationId": 1, "_v": 1 }, { "id": 4, "name": "Beth Smith", "species": "Human", "status": "Alive", "locationId": 1, "_v": 1 } ] } Open and run this endpoint What you can practise here - List a character's episodes and an episode's characters, and confirm both sides agree. - Page through characters filtered by location and de-duplicate across pages. - Create a character in a location that does not exist and read the validation failure. - Update with a stale ETag to see the 412. characters eight characters, one dead GET /rickandmorty/v1/characters — List characters (paginated, filter by status) · Responds with 200 400 404 Link to this endpoint GET /rickandmorty/v1/characters/{id} — Get one character · Responds with 200 404 Link to this endpoint GET /rickandmorty/v1/characters/{id}/location — Get a character's current location (nested resource) · Responds with 200 404 Link to this endpoint POST /rickandmorty/v1/characters — Add a character (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint PUT /rickandmorty/v1/characters/{id} — Update a character (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint DELETE /rickandmorty/v1/characters/{id} — Remove a character (portal them out of existence) (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint locations planets, stations, and a dimension GET /rickandmorty/v1/locations — List locations, filter by dimension · Responds with 200 Link to this endpoint episodes five picks across seven seasons GET /rickandmorty/v1/episodes — List episodes, filter by episode code · Responds with 200 Link to this endpoint GET /rickandmorty/v1/episodes/random — A random episode · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Rick and Morty API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/bank TITLE: Bank API — Mock REST API, 9 endpoints | Fun API Playground ================================================================ Bank API — free mock REST API for testing A tiny FinTech sandbox: list accounts, page through transactions with an opaque cursor, and move money with idempotent transfers. Insufficient funds return HTTP 402 Payment Required, frozen accounts 409, and bad amounts 422. The Bank API is the strictest surface in the catalog and the one closest to a real payments integration: accounts, balances and transfers, with cursor-based pagination instead of page numbers. It is the home of 402 Payment Required and of 422 for a transfer that is well-formed but not permissible — the distinction between "I cannot parse this" and "I understood you and the answer is no". Base URL: https://funapi.dev/api/bank/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/bank/v1/exchange-rates — Exchange rates (cacheable, ETag + If-None-Match → 304). No token, no signup: curl -i https://funapi.dev/api/bank/v1/exchange-rates answers 200 OK with: { "base": "USD", "rates": { "EUR": 0.91, "GBP": 0.78, "TRY": 41.2, "JPY": 148.5, "GALLEON": 0.02, "CREDITS": 3800 }, "note": "Rates are frozen in time, like everything else in this sandbox." } Open and run this endpoint What you can practise here - Transfer more than an account holds and read the 402 rather than a generic 400. - Send a syntactically valid transfer that breaks a business rule and compare the 422 with the 400. - Walk the transaction history by cursor and confirm no record is skipped or repeated between pages. - Replay a transfer with the same Idempotency-Key and check the money moves exactly once. accounts who owns the money GET /bank/v1/accounts — List accounts (requires Bearer auth) · Responds with 200 401 Link to this endpoint GET /bank/v1/accounts/{id} — Get one account (requires Bearer auth) · Responds with 200 401 404 Link to this endpoint POST /bank/v1/accounts — Open a new account (requires Bearer auth) · Responds with 201 400 401 422 Link to this endpoint POST /bank/v1/accounts/{id}/freeze — Freeze an account (admin only) (requires Bearer auth) · Responds with 200 401 403 404 409 Link to this endpoint GET /bank/v1/exchange-rates — Exchange rates (cacheable, ETag + If-None-Match → 304) · Responds with 200 304 Link to this endpoint transactions cursor-based pagination GET /bank/v1/accounts/{id}/transactions — List transactions (cursor pagination) (requires Bearer auth) · Responds with 200 400 401 404 Link to this endpoint transfers idempotent money movement POST /bank/v1/transfers — Transfer money between accounts (requires Bearer auth) · Responds with 201 400 401 402 404 409 422 Link to this endpoint GET /bank/v1/transfers/{id} — Look up a transfer (requires Bearer auth) · Responds with 200 401 404 Link to this endpoint premium pay up — 402 on demand GET /bank/v1/premium/statements — Premium statements — always 402 · Responds with 402 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Airline API — Flights, seat conflicts & overbooking drama. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/airline TITLE: Airline API — Mock REST API, 9 endpoints | Fun API ================================================================ Airline API — free mock REST API for testing Book seats on four questionable flights. Practice 409 seat conflicts and overbooking, a booking state machine (confirmed → checked-in → cancelled), 410 Gone for cancelled bookings, If-Match concurrency and idempotent booking. The Airline API sells seats, which means it is built to be contended: two bookings for the same seat conflict, and flights that have departed are gone rather than merely missing. It is the catalog's only source of 410 Gone, the status most clients treat as a 404 and should not. Base URL: https://funapi.dev/api/airline/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/airline/v1/flights — List flights, filter by route. No token, no signup: curl -i https://funapi.dev/api/airline/v1/flights answers 200 OK with: { "total": 4, "data": [ { "id": "FN101", "from": "NYC", "to": "LON", "departs": "08:30", "gate": "A4", "status": "scheduled", "seatsTotal": 6, "seatsFree": 5 }, { "id": "FN202", "from": "IST", "to": "TYO", "departs": "13:45", "gate": "B2", "status": "scheduled", "seatsTotal": 4, "seatsFree": 4 }, { "id": "FN303", "from": "SFO", "to": "SYD", "departs": "21:05", "gate": "C1", "status": "cancelled", "seatsTotal": 4, "seatsFree": 4 }, { "id": "FN404", "from": "AMS", "to": "REK", "departs": "06:15", "gate": "D7", "status": "boarding", "seatsTotal": 2, "seatsFree": 1 } ] } Open and run this endpoint What you can practise here - Book the same seat twice and use the 409 to drive your retry-with-a-different-seat path. - Request a departed flight and handle the 410 differently from a 404 — one is permanent. - Cancel a booking, then cancel it again, and check the second response. - Change a booking with a stale ETag for the 412. flights where the planes pretend to go GET /airline/v1/flights — List flights, filter by route · Responds with 200 Link to this endpoint GET /airline/v1/flights/{id} — Get one flight · Responds with 200 404 Link to this endpoint GET /airline/v1/flights/{id}/seats — Seat map with availability · Responds with 200 404 Link to this endpoint GET /airline/v1/flights/{id}/status — Live-ish flight status (random delays) · Responds with 200 404 Link to this endpoint bookings a state machine with conflicts POST /airline/v1/bookings — Book a seat (409 on conflicts & overbooking) (requires Bearer auth) · Responds with 201 400 401 404 409 Link to this endpoint GET /airline/v1/bookings/{id} — Get a booking (410 if cancelled) (requires Bearer auth) · Responds with 200 401 404 410 Link to this endpoint PUT /airline/v1/bookings/{id}/seat — Change seat (If-Match concurrency) (requires Bearer auth) · Responds with 200 400 401 404 409 412 Link to this endpoint POST /airline/v1/bookings/{id}/checkin — Check in (state machine) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint DELETE /airline/v1/bookings/{id} — Cancel a booking (admin only, then 410) (requires Bearer auth) · Responds with 204 401 403 404 409 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/protocol TITLE: Protocol Lab API — Mock REST API, 12 endpoints | Fun API ================================================================ Protocol Lab API — free mock REST API for testing Protocol mechanics the themed APIs do not cover: 202 Accepted with job polling, 301/302 redirects (and a chain), 503 with Retry-After, a guaranteed 504, Accept-based content negotiation with 406, HATEOAS links, RFC 6902 JSON Patch and 410 Gone. The Protocol Lab is the catalog's HTTP semantics bench, and covers what most mock APIs never do: 202-accepted async jobs you poll to completion, 301 and 302 redirects, 503 and 504 outages, JSON Patch, and content negotiation that answers 406 when it cannot satisfy your Accept header. If a client library is going to surprise you, it will surprise you here. Base URL: https://funapi.dev/api/protocol/v1 · 12 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/protocol/v1/moved/old-dashboard — Permanently moved — 301. No token, no signup: curl -i https://funapi.dev/api/protocol/v1/moved/old-dashboard answers 301 Moved Permanently with: { "error": "Moved Permanently", "message": "The dashboard lives at /moved/new-dashboard now. Note that curl needs -L to follow redirects." } Open and run this endpoint What you can practise here - Start a job, follow the 202 and its Location header, and poll until it completes. - Follow a 301 and a 302 and check whether your HTTP client preserves the method and the body. - Send an Accept header the server cannot satisfy and read the 406. - Apply a JSON Patch document, then one whose test operation fails, and compare the results. - Trigger the 503 and 504 endpoints to confirm your timeout and retry policy behaves as designed. jobs 202 Accepted + poll to completion POST /protocol/v1/jobs — Start an async job — 202 Accepted · Responds with 202 400 Link to this endpoint GET /protocol/v1/jobs/{id} — Poll a job — progresses on every poll · Responds with 200 404 Link to this endpoint redirects 301, 302 and a chain to follow GET /protocol/v1/moved/old-dashboard — Permanently moved — 301 · Responds with 301 Link to this endpoint GET /protocol/v1/moved/new-dashboard — Where the 301 leads · Responds with 200 Link to this endpoint GET /protocol/v1/hop — A 302 redirect chain — follow it down · Responds with 200 302 400 Link to this endpoint outages 503 & 504 on demand GET /protocol/v1/maintenance — Scheduled maintenance — 503 + Retry-After · Responds with 503 Link to this endpoint GET /protocol/v1/gateway-timeout — Slow upstream — waits ~3s, then 504 · Responds with 504 Link to this endpoint documents HATEOAS, JSON Patch, 406 & 410 GET /protocol/v1/export/documents — Content negotiation via Accept (406 on anything else) · Responds with 200 406 Link to this endpoint GET /protocol/v1/documents — List documents (HATEOAS links) · Responds with 200 Link to this endpoint GET /protocol/v1/documents/{id} — Get a document (410 after deletion) · Responds with 200 404 410 Link to this endpoint PATCH /protocol/v1/documents/{id} — RFC 6902 JSON Patch (op/path/value) · Responds with 200 400 404 409 Link to this endpoint DELETE /protocol/v1/documents/{id} — Delete a document (admin only, then 410) (requires Bearer auth) · Responds with 204 401 403 404 410 Link to this endpoint Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Object Storage API — Objects, checksums, ranges & resumable uploads. - Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/shop TITLE: Shop API — Mock REST API, 9 endpoints | Fun API Playground ================================================================ Shop API — free mock REST API for testing A small e-commerce flow: browse products, build a cart, apply coupons and check out. Out-of-stock items return 409, invalid coupons 422, expired coupons 410, and checkout honors Idempotency-Key so retries never double-charge. The Shop API is a checkout: products with real stock counts, carts, and coupons that expire. Stock is decremented on checkout, so the interesting failures happen between adding an item and paying for it — which is precisely the window most e-commerce test suites skip. Base URL: https://funapi.dev/api/shop/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/shop/v1/products — List products, filter by category. No token, no signup: curl -i https://funapi.dev/api/shop/v1/products answers 200 OK with: { "total": 6, "data": [ { "id": 1, "name": "Rubber Duck (QA Edition)", "price": 9.99, "stock": 12, "category": "office" }, { "id": 2, "name": "Mechanical Keyboard, Extra Clicky", "price": 129, "stock": 5, "category": "office" }, { "id": 3, "name": "Limited Sneaker Drop", "price": 249.99, "stock": 0, "category": "fashion" }, { "id": 4, "name": "Coffee Beans, 1kg, Depressingly Strong", "price": 18.5, "stock": 40, "category": "food" }, { "id": 5, "name": "HTTP Status Cats Poster", "price": 14, "stock": 7, "category": "decor" }, { "id": 6, "name": "Infinite TODO Notebook", "price": 11.25, "stock": 3, "category": "office" } ] } Open and run this endpoint What you can practise here - Add the last unit to a cart, check out twice, and read the conflict on the second attempt. - Apply an expired coupon and see the 410 rather than a validation error. - Check out with an empty cart and read the 422. - Add a quantity larger than the stock on hand and confirm the error names the constraint. products things you do not need GET /shop/v1/products — List products, filter by category · Responds with 200 Link to this endpoint GET /shop/v1/products/{id} — Get one product · Responds with 200 404 Link to this endpoint carts add, remove, regret POST /shop/v1/carts — Create an empty cart · Responds with 201 400 Link to this endpoint GET /shop/v1/carts/{id} — Get a cart with its running total · Responds with 200 404 Link to this endpoint POST /shop/v1/carts/{id}/items — Add a product (409 when out of stock) · Responds with 200 400 404 409 Link to this endpoint DELETE /shop/v1/carts/{id}/items/{productId} — Remove a product from the cart · Responds with 200 404 Link to this endpoint checkout where the money pretends to move GET /shop/v1/coupons/{code} — Validate a coupon (410 when expired) · Responds with 200 404 410 Link to this endpoint POST /shop/v1/carts/{id}/checkout — Check out (idempotent, coupon-aware) · Responds with 201 400 404 409 422 Link to this endpoint GET /shop/v1/orders/{id} — Get an order · Responds with 200 404 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/cargo TITLE: Cargo Tracking API — Mock REST API, 9 endpoints | Fun API ================================================================ Cargo Tracking API — free mock REST API for testing Track parcels through a strict state machine (label-created → picked-up → in-transit → out-for-delivery → delivered). Reads are public; every write needs the header X-API-Key: cargo-key-123 — a different auth style than the Bearer tokens used elsewhere. The Cargo Tracking API is a shipment state machine — created, picked up, in transit, delivered — where illegal transitions are rejected rather than accepted. It is also the only API in the catalog that authenticates writes with an X-API-Key header instead of a Bearer token, which makes it useful for testing a client that must handle more than one auth scheme. Base URL: https://funapi.dev/api/cargo/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/cargo/v1/shipments — List shipments, filter by status. No token, no signup: curl -i https://funapi.dev/api/cargo/v1/shipments answers 200 OK with: { "total": 3, "data": [ { "id": "TRK123456", "recipient": "Wile E. Coyote", "status": "in-transit", "attempts": 0 }, { "id": "TRK777777", "recipient": "Joey Tribbiani", "status": "delivered", "attempts": 1 }, { "id": "TRK000001", "recipient": "H. Potter", "status": "label-created", "attempts": 0 } ] } Open and run this endpoint What you can practise here - Authenticate a write with X-API-Key and confirm a Bearer token is not accepted in its place. - Move a shipment from created straight to delivered and read the rejected transition. - Track a shipment id that does not exist and check the 404. - Update a shipment with a stale ETag to trigger the 412. tracking where is my package GET /cargo/v1/shipments — List shipments, filter by status · Responds with 200 400 Link to this endpoint GET /cargo/v1/shipments/{id} — Track one shipment · Responds with 200 404 Link to this endpoint GET /cargo/v1/shipments/{id}/events — Tracking history · Responds with 200 404 Link to this endpoint GET /cargo/v1/shipments/{id}/eta — Estimated delivery (deterministic-mode friendly) · Responds with 200 404 Link to this endpoint GET /cargo/v1/rates — Shipping quote by weight · Responds with 200 400 Link to this endpoint operations writes, gated by X-API-Key POST /cargo/v1/shipments — Create a shipping label (X-API-Key) · Responds with 201 400 401 Link to this endpoint POST /cargo/v1/shipments/{id}/advance — Advance the state machine one step (X-API-Key) · Responds with 200 401 404 409 Link to this endpoint POST /cargo/v1/shipments/{id}/attempt-delivery — Attempt delivery — may fail, 3 strikes returns it (X-API-Key) · Responds with 200 401 404 409 Link to this endpoint PUT /cargo/v1/shipments/{id}/address — Redirect a parcel (X-API-Key + If-Match) · Responds with 200 400 401 404 409 412 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/space TITLE: Space Agency API — Mock REST API, 9 endpoints | Fun API ================================================================ Space Agency API — free mock REST API for testing Run a small space program: schedule launches, scrub them for weather, and actually light the candle — a slow, risky operation that sometimes aborts. Probe pings take seconds, ideal for exercising client timeouts. The Space Agency API launches rockets, scrubs launches and talks to probes with a deliberate signal delay measured in seconds. The slow probe endpoints exist so you can test timeouts against something that genuinely takes time, rather than mocking a delay and hoping your client behaves the same way. Base URL: https://funapi.dev/api/space/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/space/v1/launches — List launches, filter by status. No token, no signup: curl -i https://funapi.dev/api/space/v1/launches answers 200 OK with: { "total": 3, "data": [ { "id": 1, "mission": "Artemis Redux", "vehicle": "Kestrel IX", "window": "2026-08-01T12:00:00Z", "status": "scheduled", "scrubCount": 0 }, { "id": 2, "mission": "Red Rover Resupply", "vehicle": "Pelican Heavy", "window": "2026-07-04T04:30:00Z", "status": "launched", "scrubCount": 1 }, { "id": 3, "mission": "Solar Sail Trials", "vehicle": "Kestrel IX", "window": "2026-06-20T22:00:00Z", "status": "scrubbed", "scrubCount": 3 } ] } Open and run this endpoint What you can practise here - Call a probe endpoint with a client timeout shorter than the signal lag and confirm the timeout actually fires. - Schedule a launch, scrub it, and try to scrub it again for the conflict. - Assign crew beyond a mission's capacity and read the error. - Request telemetry for a probe that is out of range and handle the failure. launches countdowns and scrubs GET /space/v1/launches — List launches, filter by status · Responds with 200 400 Link to this endpoint GET /space/v1/launches/{id} — Get one launch · Responds with 200 404 Link to this endpoint POST /space/v1/launches — Schedule a launch (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint POST /space/v1/launches/{id}/scrub — Scrub a scheduled launch (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint POST /space/v1/launches/{id}/launch — Light the candle — slow & occasionally aborts (admin only) (requires Bearer auth) · Responds with 200 401 403 404 409 Link to this endpoint GET /space/v1/launches/{id}/countdown — T-minus for a scheduled launch · Responds with 200 404 409 Link to this endpoint crew astronauts on the roster GET /space/v1/astronauts — List astronauts · Responds with 200 Link to this endpoint GET /space/v1/astronauts/{id} — Get one astronaut · Responds with 200 404 Link to this endpoint probes deep space, slow answers GET /space/v1/probes/{id}/ping — Ping a deep-space probe — takes ~3s · Responds with 200 404 Link to this endpoint Related APIs - Superhero API — Heroes, powers & nemeses. Great for nested resources. - Dino Park API — Dinosaurs, enclosures & the occasional breach. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/starfleet TITLE: Starfleet API — Mock REST API, 10 endpoints | Fun API ================================================================ Starfleet API — free mock REST API for testing Command a small fleet: crew rosters, warp-speed changes with physics-based validation, a breached warp core that refuses orders, and a tribble endpoint that doubles on every GET — a read that mutates, which your test suite should absolutely complain about. The Starfleet API runs ships and crews under warp-factor limits, and breeds tribbles that multiply exponentially on every read of their population. That growing number is the point: it is the catalog's only endpoint whose response changes on its own between two identical requests, which is exactly what breaks a naive snapshot test. Base URL: https://funapi.dev/api/starfleet/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/starfleet/v1/ships — List ships, filter by class or status. No token, no signup: curl -i https://funapi.dev/api/starfleet/v1/ships answers 200 OK with: { "total": 4, "data": [ { "id": 1, "name": "USS Curiosity", "registry": "NCC-1704", "class": "Constitution", "status": "active", "warpCore": "stable", "currentWarp": 0 }, { "id": 2, "name": "USS Paperwork", "registry": "NCC-9021", "class": "Miranda", "status": "active", "warpCore": "stable", "currentWarp": 2 }, { "id": 3, "name": "USS Redundancy", "registry": "NCC-4242", "class": "Excelsior", "status": "in-refit", "warpCore": "offline", "currentWarp": 0 }, { "id": 4, "name": "USS Boldly", "registry": "NCC-1138", "class": "Defiant", "status": "active", "warpCore": "breached", "currentWarp": 0 } ] } Open and run this endpoint What you can practise here - Read the tribble population twice and watch a snapshot assertion fail on data that was never written. - Set a warp factor above the ship's limit and read the validation error. - Assign a crew member to two ships and check the conflict. - Reset the sandbox and confirm the population returns to its seed value. ships the fleet, mostly functional GET /starfleet/v1/ships — List ships, filter by class or status · Responds with 200 Link to this endpoint GET /starfleet/v1/ships/{id} — Get one ship · Responds with 200 404 Link to this endpoint POST /starfleet/v1/ships — Commission a new ship (requires Bearer auth) · Responds with 201 400 401 409 Link to this endpoint PUT /starfleet/v1/ships/{id}/warp — Set warp factor (physics says no above 9.9) (requires Bearer auth) · Responds with 200 400 401 404 409 Link to this endpoint crew rosters and redshirts GET /starfleet/v1/crew — List crew, filter by species or ship · Responds with 200 Link to this endpoint GET /starfleet/v1/crew/{id} — Get one crew member · Responds with 200 404 Link to this endpoint POST /starfleet/v1/crew — Enlist a crew member (requires Bearer auth) · Responds with 201 400 401 404 Link to this endpoint DELETE /starfleet/v1/crew/{id} — Discharge a crew member (admin only) (requires Bearer auth) · Responds with 204 401 403 404 Link to this endpoint tribbles do NOT keep GETting GET /starfleet/v1/tribbles — Count tribbles — doubles on EVERY read · Responds with 200 Link to this endpoint POST /starfleet/v1/tribbles/purge — Beam the tribbles away (admin only) (requires Bearer auth) · Responds with 200 401 403 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Starfleet API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/worldcup TITLE: World Cup 2026 API — Mock REST API, 17 endpoints | Fun API ================================================================ World Cup 2026 API — free mock REST API for testing A full FIFA World Cup 2026 sandbox spanning the USA, Canada and Mexico: browse the 48-team format, compute live group standings, simulate matches with goal events, chase the Golden Boot, buy limited tickets (409 when sold out) and submit champion predictions. The World Cup 2026 API is the largest in the catalog — teams, groups, venues across the host cities, squads, match simulation, ticket sales and bracket predictions. Tickets are limited and matches must be played in group order, so it combines contended writes, business-rule validation and a slow simulation endpoint in one surface. It is the closest thing here to a full application backend. Base URL: https://funapi.dev/api/worldcup/v1 · 17 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/worldcup/v1/teams — List qualified teams (filter by group, confederation or hosts). No token, no signup: curl -i https://funapi.dev/api/worldcup/v1/teams answers 200 OK with: { "total": 48, "data": [ { "id": 1, "name": "United States", "code": "USA", "group": "A", "confederation": "CONCACAF", "fifaRank": 17, "host": true }, { "id": 2, "name": "Wales", "code": "WAL", "group": "A", "confederation": "UEFA", "fifaRank": 41, "host": false }, { "id": 3, "name": "Ghana", "code": "GHA", "group": "A", "confederation": "CAF", "fifaRank": 42, "host": false }, { "id": 4, "name": "Uzbekistan", "code": "UZB", "group": "A", "confederation": "AFC", "fifaRank": 48, "host": false }, { "id": 5, "name": "Mexico", "code": "MEX", "group": "B", "confederation": "CONCACAF", "fifaRank": 15, "host": true }, { "id": 6, "name": "Türkiye", "code": "TUR", "group": "B", "confederation": "UEFA", "fifaRank": 28, "host": false }, { "id": 7, "name": "Senegal", (truncated — the full response comes back when you run it) Open and run this endpoint What you can practise here - Buy the last ticket for a venue twice and read the conflict on the second purchase. - Simulate a knockout match before the group stage is finished and check the rule violation. - Submit a bracket prediction with an invalid shape and compare the 422 with a plain 400. - Request a match that has already been played and handle the 410. - Run the slow simulation endpoint to exercise your client timeout. teams national squads and groups GET /worldcup/v1/teams — List qualified teams (filter by group, confederation or hosts) · Responds with 200 400 Link to this endpoint GET /worldcup/v1/teams/{id} — Get one national team · Responds with 200 404 Link to this endpoint GET /worldcup/v1/groups/{letter}/standings — Live group standings computed from finished matches · Responds with 200 400 404 Link to this endpoint matches fixtures, simulation and VAR GET /worldcup/v1/matches — List fixtures (filter by stage, status, group or team) · Responds with 200 400 Link to this endpoint GET /worldcup/v1/matches/{id} — Get one fixture with team and venue details · Responds with 200 404 Link to this endpoint POST /worldcup/v1/matches/{id}/simulate — Kick off and simulate a match — updates score, goal events and standings (admin only) (requires Bearer auth) · Responds with 200 404 409 422 Link to this endpoint GET /worldcup/v1/matches/{id}/events — Goal timeline of a played match (409 before kickoff) · Responds with 200 404 409 Link to this endpoint GET /worldcup/v1/matches/{id}/var-review — Request a VAR review — the check takes ~3 seconds · Responds with 200 404 Link to this endpoint venues 2026 host stadiums GET /worldcup/v1/venues — List 2026 host stadiums, filter by country · Responds with 200 Link to this endpoint GET /worldcup/v1/venues/{id} — Get a stadium with its scheduled matches · Responds with 200 404 Link to this endpoint players Golden Boot race GET /worldcup/v1/players/top-scorers — Golden Boot race — top scorers so far · Responds with 200 422 Link to this endpoint tickets limited seats, real conflicts POST /worldcup/v1/tickets — Buy match tickets — limited seats, 409 when sold out (requires Bearer auth) · Responds with 201 400 409 422 Link to this endpoint GET /worldcup/v1/tickets/{id} — Get a ticket order (410 after cancellation) (requires Bearer auth) · Responds with 200 404 410 Link to this endpoint DELETE /worldcup/v1/tickets/{id} — Cancel a ticket order and release the seats (admin only) (requires Bearer auth) · Responds with 204 404 410 Link to this endpoint fanzone mascots and predictions POST /worldcup/v1/predictions — Predict the 2026 world champion · Responds with 201 422 Link to this endpoint GET /worldcup/v1/predictions/leaderboard — Most-predicted champions · Responds with 200 Link to this endpoint GET /worldcup/v1/fanzone/mascots — Meet Maple, Zayu and Clutch — the official 2026 mascots · Responds with 200 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The World Cup 2026 API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/fiba TITLE: FIBA World Cup API — Mock REST API, 22 endpoints | Fun API ================================================================ FIBA World Cup API — free mock REST API for testing A FIBA Basketball World Cup 2027 sandbox in Qatar: 32 teams in eight groups, games simulated quarter by quarter with overtime, ETag-guarded team staff and box scores. The FIBA World Cup API models the 2027 Basketball World Cup in Qatar, and it is built around the fact that basketball has no draws. Simulating a game plays four quarters possession by possession and then keeps adding five-minute overtimes until somebody is ahead, so the group table can use FIBA’s real classification system — two points for a win, one for a loss — and never needs a draw column. Everything downstream is derived from that one write: the box score, the cursor-paged play-by-play, the tournament leaders and the MVP race all read the plays the simulation produced, and none of them can be written directly. Base URL: https://funapi.dev/api/fiba/v1 · 22 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/fiba/v1/teams — List qualified teams (filter by group, FIBA zone or hosts). No token, no signup: curl -i https://funapi.dev/api/fiba/v1/teams answers 200 OK with: { "total": 32, "data": [ { "id": 1, "name": "Qatar", "code": "QAT", "group": "A", "zone": "Asia", "fibaRank": 24, "host": true, "headCoach": null, "captainPlayerId": null, "_v": 1 }, { "id": 2, "name": "United States", "code": "USA", "group": "A", "zone": "Americas", "fibaRank": 1, "host": false, "headCoach": null, "captainPlayerId": null, "_v": 1 }, { "id": 3, "name": "Lithuania", "code": "LTU", "group": "A", "zone": "Europe", "fibaRank": 8, "host": false, "headCoach": null, "captainPlayerId": null, "_v": 1 }, { "id": 4, "name": "Egypt", "code": "EGY", "group": "A", "zone": "Africa", "fibaRank": 30, "host": false, "headCoach": null, "captainPlayerId": null, "_v": 1 }, { "id": 5, "name": "Germany", "code": "GER", "group": "B", "zone": "Europe", "fibaRank": 2, (truncated — the full response comes back when you run it) Open and run this endpoint What you can practise here - GET /teams/32, keep the ETag, then PUT /teams/32/staff with If-Match: v1 — repeat the same request and read the 412 the second, now-stale etag earns. - Name a captain who plays for another nation and compare that 422 with the 412 above: one is a stale precondition, the other a body that can never be valid. - GET /groups/A/standings, send its ETag back as If-None-Match for a 304 with no body, then simulate a group A game and watch the same header start returning 200 again. - POST /games/1/simulate as admin, then walk GET /games/1/play-by-play?limit=5 by following nextCursor until it comes back null. - POST /games/1/challenge for the home bench (it takes ~3s — a real replay review), then challenge again from the same bench for the 409. - POST /games/1/highlights for a 202 and a Location, then poll GET /highlights/1 until progress hits 100 and a downloadUrl appears. - GET /players/63/advanced for a 402 Payment Required that never succeeds, and buy the last seats for a game to turn POST /tickets into a 409. teams the 32 qualified nations GET /fiba/v1/teams — List qualified teams (filter by group, FIBA zone or hosts) · Responds with 200 400 Link to this endpoint GET /fiba/v1/teams/{id} — Get one national team — carries the ETag its staff update needs · Responds with 200 404 Link to this endpoint PUT /fiba/v1/teams/{id}/staff — Name the head coach and captain — optimistic concurrency via If-Match (requires Bearer auth) · Responds with 200 401 403 404 412 422 Link to this endpoint GET /fiba/v1/groups/{letter}/standings — Group table computed from finished games — cacheable (ETag / If-None-Match / 304) · Responds with 200 304 400 404 Link to this endpoint games simulation, box scores and reviews GET /fiba/v1/games — List games (filter by stage, status, group or team) · Responds with 200 Link to this endpoint GET /fiba/v1/games/{id} — Get one game with team and arena names resolved · Responds with 200 404 Link to this endpoint POST /fiba/v1/games/{id}/simulate — Tip off — four quarters plus overtime until somebody wins (admin only) (requires Bearer auth) · Responds with 200 401 403 404 409 422 Link to this endpoint GET /fiba/v1/games/{id}/boxscore — Per-player box score, derived from the play-by-play · Responds with 200 404 409 Link to this endpoint GET /fiba/v1/games/{id}/play-by-play — Cursor-paged play-by-play — follow nextCursor to the final buzzer · Responds with 200 400 404 409 Link to this endpoint POST /fiba/v1/games/{id}/challenge — Coach's challenge — a slow (~3s) replay review, one per team (requires Bearer auth) · Responds with 200 401 404 409 422 Link to this endpoint POST /fiba/v1/games/{id}/highlights — Queue a highlight reel — 202 Accepted, then poll the job (requires Bearer auth) · Responds with 202 401 404 409 422 Link to this endpoint GET /fiba/v1/highlights/{id} — Poll a highlight job until it is ready · Responds with 200 404 Link to this endpoint arenas the Doha host courts GET /fiba/v1/arenas — List the Qatar host arenas, filter by city · Responds with 200 Link to this endpoint GET /fiba/v1/arenas/{id} — Get one arena with the games it hosts · Responds with 200 404 Link to this endpoint players stat leaders and the MVP race GET /fiba/v1/players — List players (filter by team or position) · Responds with 200 Link to this endpoint GET /fiba/v1/players/{id} — Get one player with their running tournament totals · Responds with 200 404 Link to this endpoint GET /fiba/v1/players/leaders — Tournament leaders for points, rebounds or assists · Responds with 200 422 Link to this endpoint GET /fiba/v1/players/{id}/advanced — Tracking data — always 402, it is on the paid analytics tier · Responds with 402 404 Link to this endpoint GET /fiba/v1/fanzone/mvp — The MVP race, ranked by a simplified efficiency index · Responds with 200 Link to this endpoint tickets limited seats, real conflicts POST /fiba/v1/tickets — Buy tickets — seats are limited, so 409 when the game sells out (requires Bearer auth) · Responds with 201 400 401 409 422 Link to this endpoint GET /fiba/v1/tickets/{id} — Get a ticket order — 410 once it has been cancelled · Responds with 200 404 410 Link to this endpoint DELETE /fiba/v1/tickets/{id} — Cancel an order and release the seats (requires Bearer auth) · Responds with 204 401 404 410 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The FIBA World Cup API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/gta TITLE: GTA API — Mock REST API, 17 endpoints | Fun API Playground ================================================================ GTA API — free mock REST API for testing A Grand Theft Auto–flavoured sandbox: browse Los Santos characters and vehicles, respray cars at a Pay-n-Spray, buy weapons from the catalogue, start missions with prerequisites, plan authenticated heists, run a slow (~2s) police chase that inflates your wanted level (0–5 stars) and bribe the LSPD to clear it. Cash starts at $5000 and 402 fires when you are broke. The GTA (Grand Theft Auto) API is a Los Santos–style sandbox spanning characters, vehicles, an ammu-nation weapon catalogue, story missions with prerequisites, admin-only heist planning and a 0–5 star wanted system. Cash is the spine of it: respraying cars and buying weapons spend money, completing missions earns it, and every broke path answers 402 Payment Required — the status code production APIs reach for when a metered resource is exhausted. Base URL: https://funapi.dev/api/gta/v1 · 17 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/gta/v1/characters — List characters (filter by city or affiliation). No token, no signup: curl -i https://funapi.dev/api/gta/v1/characters answers 200 OK with: { "total": 10, "data": [ { "id": 1, "name": "Tommy Vercetti", "alias": "The Harwood Butcher", "city": "Vice City", "affiliation": "Vercetti Gang", "status": "alive" }, { "id": 2, "name": "CJ", "alias": "Carl Johnson", "city": "Los Santos", "affiliation": "Grove Street Families", "status": "alive" }, { "id": 3, "name": "Niko Bellic", "alias": "The Yugoslav", "city": "Liberty City", "affiliation": "Pegorino Family", "status": "alive" }, { "id": 4, "name": "Michael De Santa", "alias": "Mikey", "city": "Los Santos", "affiliation": "Freelance", "status": "alive" }, { "id": 5, "name": "Trevor Philips", "alias": "T", "city": "Blaine County", "affiliation": "Trevor Philips Enterprises", "status": "alive" }, { "id": 6, "name": "Franklin Clinton", "alias": "Frank", "city": "Los Santos", "affiliation": "Freelance", "status": "alive" (truncated — the full response comes back when you run it) Open and run this endpoint What you can practise here - Buy a weapon with the admin token, then buy it again and read the 409 "already owned" conflict. - Respray a vehicle while your wallet is short and confirm the 402, then complete a mission to top up and retry. - Start a mission whose prerequisite is unmet and compare the 422 with a 409 from starting a second mission while one is active. - POST /wanted/increase twice for the ~2s police chase, then DELETE /wanted and check the bribe deducts $1000 per star. - Plan a heist with an approach outside stealth/loud/subtle and read the 422. characters heroes and contacts GET /gta/v1/characters — List characters (filter by city or affiliation) · Responds with 200 Link to this endpoint GET /gta/v1/characters/{id} — Get one character · Responds with 200 404 Link to this endpoint vehicles cars and Pay-n-Spray GET /gta/v1/vehicles — List vehicles (filter by class) · Responds with 200 Link to this endpoint GET /gta/v1/vehicles/{id} — Get one vehicle · Responds with 200 404 Link to this endpoint POST /gta/v1/vehicles/{id}/respray — Respray a vehicle at Pay-n-Spray — spends cash (402 when broke) (requires Bearer auth) · Responds with 200 402 404 422 Link to this endpoint weapons the ammu-nation catalogue GET /gta/v1/weapons — Browse the ammu-nation catalogue (filter by category) · Responds with 200 Link to this endpoint POST /gta/v1/weapons/{id}/buy — Buy a weapon — spends cash (402 when broke, 409 if already owned) (requires Bearer auth) · Responds with 200 404 409 402 Link to this endpoint missions story jobs with prereqs GET /gta/v1/missions — List missions (filter by status or city) · Responds with 200 Link to this endpoint GET /gta/v1/missions/{id} — Get one mission with its prereq · Responds with 200 404 Link to this endpoint POST /gta/v1/missions/{id}/start — Start a mission (409 if one is active, 422 if prereq not completed) (requires Bearer auth) · Responds with 200 404 409 422 Link to this endpoint POST /gta/v1/missions/{id}/complete — Complete the active mission — pays out the reward (requires Bearer auth) · Responds with 200 404 409 Link to this endpoint POST /gta/v1/heists — Plan a heist — choose an approach (admin only) (requires Bearer auth) · Responds with 201 422 Link to this endpoint GET /gta/v1/heists/{id} — Get a planned heist · Responds with 200 404 Link to this endpoint wanted stars, bribes and police chases GET /gta/v1/wanted — Current wanted level (0–5 stars) · Responds with 200 Link to this endpoint POST /gta/v1/wanted/increase — Commit a crime — inflates wanted level after a ~2s police chase (requires Bearer auth) · Responds with 200 409 Link to this endpoint DELETE /gta/v1/wanted — Bribe the LSPD to clear wanted level — costs $1000/star (402 when broke) (requires Bearer auth) · Responds with 200 402 409 Link to this endpoint radio in-game stations GET /gta/v1/radio — List in-game radio stations · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The GTA API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/dragonball TITLE: Dragon Ball API — Mock REST API, 6 endpoints | Fun API ================================================================ Dragon Ball API — free mock REST API for testing Explore Dragon Ball fighters and transformations, then run authenticated tournament battles with deterministic sandbox results. The Dragon Ball API tracks fighters, their transformations and the power levels those transformations produce, plus tournaments that seed brackets from them. Power level is derived rather than stored, which makes it a compact target for testing a client against computed fields it must not try to write. Base URL: https://funapi.dev/api/dragonball/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/dragonball/v1/fighters — List fighters by race or minimum power. No token, no signup: curl -i https://funapi.dev/api/dragonball/v1/fighters answers 200 OK with: { "total": 4, "data": [ { "id": 1, "name": "Goku", "race": "Saiyan", "powerLevel": 9001, "transformations": [ "Super Saiyan", "Ultra Instinct" ] }, { "id": 2, "name": "Vegeta", "race": "Saiyan", "powerLevel": 8800, "transformations": [ "Super Saiyan Blue", "Ultra Ego" ] }, { "id": 3, "name": "Piccolo", "race": "Namekian", "powerLevel": 7200, "transformations": [ "Orange Piccolo" ] }, { "id": 4, "name": "Frieza", "race": "Frieza Race", "powerLevel": 8500, "transformations": [ "Golden Frieza", "Black Frieza" ] } ] } Open and run this endpoint What you can practise here - Transform a fighter and confirm the power level the API computes rather than the one you sent. - Enter the same fighter into a tournament twice and read the conflict. - Submit a transformation the fighter has not unlocked and check the 422. - Seed a bracket with an odd number of fighters and see how the API resolves it. fighters warriors and power levels GET /dragonball/v1/fighters — List fighters by race or minimum power · Responds with 200 Link to this endpoint GET /dragonball/v1/fighters/{id} — Get one fighter · Responds with 200 404 Link to this endpoint GET /dragonball/v1/fighters/{id}/transformations — List a fighter’s transformations · Responds with 200 404 Link to this endpoint POST /dragonball/v1/fighters/{id}/power-up — Increase a fighter’s power level (requires Bearer auth) · Responds with 200 422 Link to this endpoint tournaments battle simulation POST /dragonball/v1/tournaments — Resolve a tournament match (requires Bearer auth) · Responds with 201 400 409 Link to this endpoint GET /dragonball/v1/tournaments/{id} — Get a tournament match · Responds with 200 404 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Dragon Ball API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/formula1 TITLE: Formula 1 API — Mock REST API, 7 endpoints | Fun API ================================================================ Formula 1 API — free mock REST API for testing A Formula 1 testing grid with drivers, constructors, race simulation, lap telemetry and authenticated pit-stop operations. The Formula 1 API covers drivers, constructors, races, pit stops and lap telemetry. Telemetry returns dense numeric arrays rather than the small object payloads the rest of the catalog serves, which makes it the right page for testing how your client, your assertions and your logging cope with a response that is genuinely large. Base URL: https://funapi.dev/api/formula1/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/formula1/v1/drivers — List drivers by team. No token, no signup: curl -i https://funapi.dev/api/formula1/v1/drivers answers 200 OK with: { "total": 4, "data": [ { "id": 1, "code": "VER", "name": "Max Verstappen", "teamId": 1, "number": 1, "points": 0 }, { "id": 2, "code": "LEC", "name": "Charles Leclerc", "teamId": 2, "number": 16, "points": 0 }, { "id": 3, "code": "NOR", "name": "Lando Norris", "teamId": 3, "number": 4, "points": 0 }, { "id": 4, "code": "HAM", "name": "Lewis Hamilton", "teamId": 2, "number": 44, "points": 0 } ] } Open and run this endpoint What you can practise here - Pull a full telemetry series and check your parser and assertions handle the array size without truncating it. - Record a pit stop against a race that has finished and read the conflict. - Submit a lap time in the wrong unit and see the 422. - Filter the grid by constructor and confirm the counts agree with the unfiltered list. grid drivers and constructors GET /formula1/v1/drivers — List drivers by team · Responds with 200 Link to this endpoint GET /formula1/v1/constructors — List constructors with drivers · Responds with 200 Link to this endpoint races events and results GET /formula1/v1/races — List races by status · Responds with 200 Link to this endpoint POST /formula1/v1/races/{id}/start — Run and finish a race (requires Bearer auth) · Responds with 200 404 409 Link to this endpoint GET /formula1/v1/races/{id}/results — Get classified race results · Responds with 200 409 Link to this endpoint telemetry laps and pit stops GET /formula1/v1/races/{id}/telemetry — Read lap telemetry after a race · Responds with 200 Link to this endpoint POST /formula1/v1/races/{id}/pit-stops — Record a pit stop (requires Bearer auth) · Responds with 201 422 Link to this endpoint Related APIs - Pizza Orders API — Place & track orders. Includes a guaranteed 500. - Coffee Shop API — Drinks & orders. Home of the legendary 418. - Football API — Teams, squads, standings & simulated matches. - Bank API — Accounts, transfers & cursor pagination. Home of the 402. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Unofficial and fan-made. The Formula 1 API is a practice API that borrows a theme; it is not affiliated with, sponsored or endorsed by the owners of the names it references, which belong to them. Every record it returns is test data for exercising HTTP behaviour, not an authoritative source on the subject. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/voxel TITLE: Voxel Worlds API — Mock REST API, 6 endpoints | Fun API ================================================================ Voxel Worlds API — free mock REST API for testing An original block-building sandbox inspired by voxel games. Practice world seeds, coordinate resources, inventory conflicts and optimistic concurrency. The Voxel Worlds API models block worlds with players, inventories and integer coordinates. Coordinates are bounded, so it is a compact place to practise boundary testing — the off-by-one at the edge of a valid range, which is the class of bug that unit tests catch and integration tests usually do not. Base URL: https://funapi.dev/api/voxel/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/voxel/v1/worlds — List worlds. No token, no signup: curl -i https://funapi.dev/api/voxel/v1/worlds answers 200 OK with: { "total": 1, "data": [ { "id": 1, "name": "Blockshire", "seed": 424242, "biome": "meadow", "difficulty": "normal", "_v": 1 } ] } Open and run this endpoint What you can practise here - Place a block exactly on the world boundary, then one block past it, and compare the two responses. - Add an item beyond a player's inventory capacity and read the error. - Join a world that is full and check the conflict. - Send a floating-point coordinate where an integer is required and read the validation failure. worlds procedural block worlds GET /voxel/v1/worlds — List worlds · Responds with 200 Link to this endpoint GET /voxel/v1/worlds/{id} — Get a world · Responds with 200 404 Link to this endpoint POST /voxel/v1/worlds — Generate a world from a seed (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint GET /voxel/v1/worlds/{id}/blocks/{x}/{y}/{z} — Inspect a block at coordinates · Responds with 200 404 Link to this endpoint players survival stats and inventory GET /voxel/v1/players — List players · Responds with 200 Link to this endpoint POST /voxel/v1/players/{id}/inventory — Add an inventory item (409 on duplicate) (requires Bearer auth) · Responds with 200 404 409 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/anime TITLE: Anime Tournament API — Mock REST API, 5 endpoints | Fun API ================================================================ Anime Tournament API — free mock REST API for testing An original anime-style tournament with transformations, rankings and deliberately dramatic power scaling. The Anime Tournament API uses original characters rather than licensed ones, and exists to exercise bracket logic: fighters with power levels, matches seeded from them, and rounds that only advance when the previous one is complete. Small surface, strict ordering rules. Base URL: https://funapi.dev/api/anime/v1 · 5 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/anime/v1/fighters — List fighters, filter by rank. No token, no signup: curl -i https://funapi.dev/api/anime/v1/fighters answers 200 OK with: { "total": 3, "data": [ { "id": 1, "name": "Nova Fist", "element": "plasma", "power": 9100, "rank": "S" }, { "id": 2, "name": "Mochi Ronin", "element": "wind", "power": 7200, "rank": "A" }, { "id": 3, "name": "Captain Kawaii", "element": "water", "power": 6800, "rank": "A" } ] } Open and run this endpoint What you can practise here - Report a result for a round that has not started and read the 422. - Enter a fighter twice and check the duplicate response. - Advance the bracket and confirm the seeding matches the power levels you supplied. - Request a match id that does not exist for the 404. fighters heroes and rivals GET /anime/v1/fighters — List fighters, filter by rank · Responds with 200 Link to this endpoint GET /anime/v1/fighters/{id} — Get fighter power profile · Responds with 200 404 Link to this endpoint POST /anime/v1/fighters/{id}/transform — Transform a fighter and increase power (requires Bearer auth) · Responds with 200 422 Link to this endpoint matches tournament battles POST /anime/v1/matches — Run a deterministic tournament match (requires Bearer auth) · Responds with 201 400 Link to this endpoint GET /anime/v1/matches — List match history · Responds with 200 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/retroquest TITLE: Retro Quest API — Mock REST API, 5 endpoints | Fun API ================================================================ Retro Quest API — free mock REST API for testing An original 16-bit RPG world for testing quests, inventory, saves and state transitions. The Retro Quest API is a pixel-era RPG: heroes, quests, loot tables and save games. Saves carry a version, and writing over a newer save is rejected — a save-conflict model that is the simplest, most concrete illustration of optimistic concurrency in the whole catalog. Base URL: https://funapi.dev/api/retro/v1 · 5 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/retro/v1/heroes — List pixel heroes. No token, no signup: curl -i https://funapi.dev/api/retro/v1/heroes answers 200 OK with: { "total": 1, "data": [ { "id": 1, "name": "Ada of Bytewood", "class": "debugger", "hp": 42, "xp": 120 } ] } Open and run this endpoint What you can practise here - Load a save, write it back after another client has written a newer one, and read the conflict. - Accept the same quest twice and see how the API responds. - Roll loot from a table and confirm the response shape against your contract test. - Create a hero with an invalid class and read the validation error. heroes pixel adventurers GET /retro/v1/heroes — List pixel heroes · Responds with 200 Link to this endpoint POST /retro/v1/heroes — Create a hero (requires Bearer auth) · Responds with 201 400 Link to this endpoint quests bugs disguised as monsters GET /retro/v1/quests — List quests by status · Responds with 200 Link to this endpoint POST /retro/v1/quests/{id}/accept — Accept a quest (409 if already accepted) (requires Bearer auth) · Responds with 200 409 Link to this endpoint POST /retro/v1/quests/{id}/complete — Complete an active quest (requires Bearer auth) · Responds with 200 409 Link to this endpoint Related APIs - Friends API — Characters, episodes & quotes from the coffee-house gang. - Movies API — QA-themed cinema. Sort, filter, rate. - Harry Potter API — Houses, students & spells from a magic school. - Star Wars API — Characters, planets & starships from a galaxy far away. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/storage TITLE: Object Storage API — Mock REST API, 4 endpoints | Fun API ================================================================ Object Storage API — free mock REST API for testing Practice object metadata, base64 content, checksums, Range requests and resumable upload state. The Object Storage API is a small S3-shaped surface: PUT an object, GET it back, and verify it. It is the only place in the catalog that serves HTTP 206 Partial Content for a Range request and 416 when that range cannot be satisfied — plus checksum validation and resumable uploads, the three things object-storage clients get wrong most often. Base URL: https://funapi.dev/api/storage/v1 · 4 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/storage/v1/objects — List stored objects. No token, no signup: curl -i https://funapi.dev/api/storage/v1/objects answers 200 OK with: { "total": 0, "data": [] } Open and run this endpoint What you can practise here - Request a byte range and read the 206 together with its Content-Range header. - Ask for a range past the end of the object and handle the 416. - Upload with a deliberately wrong checksum and confirm the object is rejected, not silently stored. - Start a resumable upload, interrupt it, and resume from the offset the API reports. objects stored test files GET /storage/v1/objects — List stored objects · Responds with 200 Link to this endpoint PUT /storage/v1/objects/{key} — Upload a base64 object with checksum (requires Bearer auth) · Responds with 201 412 422 Link to this endpoint GET /storage/v1/objects/{key} — Download object metadata/content; accepts Range · Responds with 200 206 416 Link to this endpoint DELETE /storage/v1/objects/{key} — Delete an object (requires Bearer auth) · Responds with 204 404 Link to this endpoint uploads resumable sessions Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/identity TITLE: Modern Identity API — Mock REST API, 6 endpoints | Fun API ================================================================ Modern Identity API — free mock REST API for testing A modern identity lab complementing the OAuth playground with OIDC discovery, PKCE, device authorization, introspection and revocation. The Modern Identity API implements the parts of OpenID Connect that clients actually integrate against: a discovery document, PKCE, the device authorization flow and the full token lifecycle. If you are testing a login that runs on a TV, a CLI or anything without a browser redirect, the device-code flow here behaves like the real thing. Base URL: https://funapi.dev/api/identity/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/identity/v1/.well-known/openid-configuration — OIDC discovery document. No token, no signup: curl -i https://funapi.dev/api/identity/v1/.well-known/openid-configuration answers 200 OK with: { "issuer": "https://funapi.dev/api/identity/v1", "authorization_endpoint": "https://funapi.dev/api/identity/v1/authorize", "token_endpoint": "https://funapi.dev/api/identity/v1/token", "jwks_uri": "https://funapi.dev/api/identity/v1/jwks", "code_challenge_methods_supported": [ "S256" ], "scopes_supported": [ "openid", "profile", "email", "offline_access" ] } Open and run this endpoint What you can practise here - Fetch the discovery document and drive the rest of the flow from its advertised endpoints rather than hardcoded URLs. - Complete an authorization-code exchange with PKCE, then retry with the wrong code_verifier and read the rejection. - Run the device-code flow and poll while it is pending until it is authorized. - Introspect a token, revoke it, and confirm the next introspection reports it inactive. discovery provider metadata GET /identity/v1/.well-known/openid-configuration — OIDC discovery document · Responds with 200 Link to this endpoint GET /identity/v1/jwks — Demo JSON Web Key Set · Responds with 200 Link to this endpoint tokens PKCE and lifecycle POST /identity/v1/authorize — Issue an authorization code with real PKCE (S256) · Responds with 200 400 Link to this endpoint POST /identity/v1/token — Exchange a PKCE code for scoped tokens — verifies BASE64URL(SHA256(codeVerifier)) against the stored codeChallenge · Responds with 200 400 Link to this endpoint POST /identity/v1/introspect — Introspect an access token · Responds with 200 Link to this endpoint POST /identity/v1/revoke — Revoke an access token · Responds with 204 Link to this endpoint Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Object Storage API — Objects, checksums, ranges & resumable uploads. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/streams TITLE: Event Streams API — Mock REST API, 3 endpoints | Fun API ================================================================ Event Streams API — free mock REST API for testing Practice event-stream consumers, Last-Event-ID resume behavior, duplicates and out-of-order detection. The Event Streams API serves Server-Sent Events with replay cursors, heartbeats and guaranteed ordering. Streaming is where test suites usually stop, because a long-lived response is awkward to assert on — this one is built to make that assertable, with a Last-Event-ID cursor you can reconnect from. Base URL: https://funapi.dev/api/streams/v1 · 3 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/streams/v1/events — Read events as JSON or text/event-stream. No token, no signup: curl -i https://funapi.dev/api/streams/v1/events answers 200 OK with: { "total": 12, "data": [ { "id": 1, "type": "lap.completed", "lap": 1, "position": 1 }, { "id": 2, "type": "lap.completed", "lap": 2, "position": 2 }, { "id": 3, "type": "lap.completed", "lap": 3, "position": 3 }, { "id": 4, "type": "lap.completed", "lap": 4, "position": 4 }, { "id": 5, "type": "lap.completed", "lap": 5, "position": 1 }, { "id": 6, "type": "lap.completed", "lap": 6, "position": 2 }, { "id": 7, "type": "lap.completed", "lap": 7, "position": 3 }, { "id": 8, "type": "lap.completed", "lap": 8, "position": 4 }, { "id": 9, "type": "lap.completed", "lap": 9, "position": 1 }, { "id": 10, "type": "lap.completed", "lap": 10, "position": 2 }, { "id": 11, "type": "lap.completed", "lap": 11, "position": 3 }, { "id": 12, (truncated — the full response comes back when you run it) Open and run this endpoint What you can practise here - Open the stream, drop the connection, and reconnect with Last-Event-ID to confirm no event was lost. - Assert that events arrive in order under a burst rather than only at rest. - Watch the heartbeat and set your idle timeout above it, not below. - Publish an event and check how quickly it appears to a connected consumer. events stream and replay GET /streams/v1/events — Read events as JSON or text/event-stream · Responds with 200 Link to this endpoint GET /streams/v1/events/{id} — Replay one event by id · Responds with 200 404 Link to this endpoint POST /streams/v1/events — Publish a custom event (requires Bearer auth) · Responds with 202 Link to this endpoint Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Object Storage API — Objects, checksums, ranges & resumable uploads. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/faults TITLE: Fault Injection API — Mock REST API, 5 endpoints | Fun API ================================================================ Fault Injection API — free mock REST API for testing Configure deterministic network and server failures inside your isolated sandbox. The Fault Injection API turns failure into a setting. Configure a target — latency, a status code, a malformed body, or a flaky success rate — then call it and get exactly that. It is the catalog's tool for testing resilience deliberately instead of waiting for production to supply the outage. Base URL: https://funapi.dev/api/faults/v1 · 5 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/faults/v1/config — Read fault profile. No token, no signup: curl -i https://funapi.dev/api/faults/v1/config answers 200 OK with: { "latencyMs": 0, "status": 200, "malformed": false, "failureRate": 0 } Open and run this endpoint What you can practise here - Set a 50% failure rate and check that your retry policy converges instead of amplifying the load. - Inject a malformed JSON body and confirm your client reports a parse error rather than crashing. - Inject latency just above your timeout, then just below, and verify the boundary behaves as designed. - Configure a 503 with Retry-After and check your backoff honours the header instead of guessing. control fault profile GET /faults/v1/config — Read fault profile · Responds with 200 Link to this endpoint PUT /faults/v1/config — Configure fault profile (requires Bearer auth) · Responds with 200 422 Link to this endpoint DELETE /faults/v1/config — Reset fault profile (requires Bearer auth) · Responds with 204 Link to this endpoint target endpoint under test GET /faults/v1/target — Call the configured flaky target · Responds with 200 500 503 Link to this endpoint GET /faults/v1/status/{code} — Return any status code on demand (200–599) · Responds with 200 201 202 203 204 205 206 207 300 301 302 303 304 307 308 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 425 426 428 429 431 451 500 501 502 503 504 505 507 508 511 Link to this endpoint Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Object Storage API — Objects, checksums, ranges & resumable uploads. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/searchlab TITLE: Search & Facets API — Mock REST API, 2 endpoints | Fun API ================================================================ Search & Facets API — free mock REST API for testing A compact search engine lab with category facets, score sorting, highlights and cursor pagination. The Search & Facets API is a query surface rather than a CRUD one: full-text search with facet counts, highlighted snippets and cursor pagination. Two endpoints, but the response is the most structurally complex in the catalog — the right target for a contract test that has to survive a nested, variable-shaped payload. Base URL: https://funapi.dev/api/search/v1 · 2 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/search/v1/items — Search items with facets and cursor. No token, no signup: curl -i https://funapi.dev/api/search/v1/items answers 200 OK with: { "total": 4, "data": [ { "id": 1, "title": "Moon Pizza", "category": "food", "tags": [ "space", "cheese" ], "score": 9.1, "highlight": "Moon Pizza" }, { "id": 2, "title": "Dragon Debugger", "category": "tools", "tags": [ "fantasy", "code" ], "score": 8.7, "highlight": "Dragon Debugger" }, { "id": 3, "title": "Pocket Monster Manual", "category": "books", "tags": [ "creatures", "training" ], "score": 8.3, "highlight": "Pocket Monster Manual" }, { "id": 4, "title": "Wizard Wireless", "category": "tools", "tags": [ "magic", "network" ], "score": 7.9, "highlight": "Wizard Wireless" } ], "facets": { "category": [ { "value": "food", "count": 1 }, { "value": "tools", "count": 2 }, { "value": "books", "count": 1 } ] }, (truncated — the full response comes back when you run it) Open and run this endpoint What you can practise here - Run a query and assert on facet counts as well as hits, since the two can disagree when filters are applied. - Page through results by cursor and confirm nothing is duplicated or skipped between pages. - Send a malformed query expression and read the 400. - Search for a term with no matches and confirm the empty result is a 200. search query and discover GET /search/v1/items — Search items with facets and cursor · Responds with 200 400 Link to this endpoint GET /search/v1/suggest — Autocomplete suggestions · Responds with 200 Link to this endpoint Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Object Storage API — Objects, checksums, ranges & resumable uploads. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/docs/datagen TITLE: Fun Data Bridge API — Mock REST API, 4 endpoints | Fun API ================================================================ Fun Data Bridge API — free mock REST API for testing Generate small deterministic JSON fixtures using fundata-style schemas, then reuse them in API tests. The Fun Data Bridge generates seeded fixtures from a schema you supply — the same idea as the sibling site fundata.dev, exposed as an API. Given the same seed it returns the same data, which is what makes it usable as a fixture source for tests that must be deterministic rather than merely realistic. Base URL: https://funapi.dev/api/data/v1 · 4 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide. Example request and response GET https://funapi.dev/api/data/v1/types — List supported field types. No token, no signup: curl -i https://funapi.dev/api/data/v1/types answers 200 OK with: { "data": [ "row", "integer", "boolean", "email", "uuid", "name", "date", "string" ] } Open and run this endpoint What you can practise here - Generate with a fixed seed twice and confirm the output is byte-identical, then change the seed and confirm it is not. - Post a schema with an unsupported field type and read the 422. - Request a large batch and follow the 202 to the finished result. - Feed the generated fixtures straight into another API in the catalog as request bodies. generate schemas and fixtures GET /data/v1/types — List supported field types · Responds with 200 Link to this endpoint POST /data/v1/generate — Generate deterministic JSON rows · Responds with 200 422 Link to this endpoint POST /data/v1/jobs — Queue a large fixture job (requires Bearer auth) · Responds with 202 422 Link to this endpoint GET /data/v1/jobs/{id} — Poll fixture job · Responds with 200 404 Link to this endpoint Related APIs - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. - Object Storage API — Objects, checksums, ranges & resumable uploads. All 39 mock REST APIs Use this response elsewhere - JSON to TypeScript on fundata.dev — an interface for this response - JSON to Zod on fundata.dev — a runtime validator for it - mock API data on fundata.dev — thousands of records of the same shape for your own fixtures Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/category/fandom TITLE: Fandom & Pop Culture — Mock REST APIs | Fun API Playground ================================================================ Fandom & Pop Culture Unfamiliar test data costs attention: every assertion needs you to remember what the record was supposed to contain. These APIs borrow worlds you already carry in your head, which leaves the whole of your attention for the part you are actually practising — the requests, the status codes and the headers. The trade is deliberate. A mock API built on invoice line items makes you hold two unfamiliar things at once — the domain and the protocol — and the domain always wins, because it is the one you have to reason about to know whether the response was right. Borrowing a world you already know collapses that to one. Start wherever the data is most familiar to you and work outward: list a collection, page through it, filter it, fetch one item, ask for one that does not exist. By the time the shape of the responses is boring, you are ready for the parts that are not — auth, conflicts, concurrency and the error codes each of these APIs is wired to produce on demand. 17 APIs in this category - Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints) - Movies API — QA-themed cinema. Sort, filter, rate. (9 endpoints) - Harry Potter API — Houses, students & spells from a magic school. (10 endpoints) - Star Wars API — Characters, planets & starships from a galaxy far away. (11 endpoints) - Sherlock Holmes API — Cases, suspects & clues from Baker Street. (10 endpoints) - Pokémon API — Creatures, trainers & simulated battles. (10 endpoints) - Middle-earth API — Fellowship, quests & artifacts from a fantasy realm. (9 endpoints) - The Office API — Employees, pranks & quotes from a paper company. (8 endpoints) - Marvel API — Avengers, villains & mission assignments. (10 endpoints) - Game of Thrones API — Houses, nobles & dragons of Westeros. (12 endpoints) - Rick and Morty API — Characters, locations & episodes across the multiverse. (9 endpoints) - Starfleet API — Ships, warp limits & exponentially multiplying tribbles. (10 endpoints) - GTA API — Characters, vehicles, weapons, missions, heists, a wanted system & radio stations across Los Santos, Vice City and Liberty City. (17 endpoints) - Dragon Ball API — Fighters, transformations, power levels & tournaments. (6 endpoints) - Voxel Worlds API — Block worlds, players, inventories & coordinates. (6 endpoints) - Anime Tournament API — Original fighters, power levels & tournament brackets. (5 endpoints) - Retro Quest API — Pixel heroes, quests, loot & save-game conflicts. (5 endpoints) Other categories - Everyday Life — 10 APIs - Original Worlds — 3 APIs - Testing Scenarios — 9 APIs All 39 mock REST APIs · Testing techniques Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/category/everyday-life TITLE: Everyday Life — Mock REST APIs | Fun API Playground ================================================================ Everyday Life These are the shapes most real integrations take: a cart whose stock runs out mid-checkout, a seat two people book at once, a transfer that would overdraw an account. Each one is small enough to hold in your head and strict enough that the interesting failures are reachable. What makes these worth practising against is that the rules push back. A pizza that has been delivered cannot be cancelled; a seat that is taken cannot be booked twice; a transfer larger than the balance is refused rather than quietly allowed. Every one of those is a conflict your client has to handle, and none of them can be provoked against an API that only ever says yes. They are also the closest thing here to the integrations you will actually be paid to test. If you want to rehearse a specific failure before production supplies it — a duplicate charge, an overbooked flight, a coupon that expired between the cart and the checkout — this is the group to reach for. 10 APIs in this category - Pizza Orders API — Place & track orders. Includes a guaranteed 500. (9 endpoints) - Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints) - Football API — Teams, squads, standings & simulated matches. (7 endpoints) - Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints) - Airline API — Flights, seat conflicts & overbooking drama. (9 endpoints) - Shop API — Carts, stock drama & expired coupons. (9 endpoints) - Cargo Tracking API — Shipment state machines. Writes need an X-API-Key. (9 endpoints) - World Cup 2026 API — Teams, groups, venues, match simulation, tickets & bracket predictions across the 2026 host cities. (17 endpoints) - FIBA World Cup API — Teams, Doha arenas, quarter-by-quarter game simulation, box scores, coach challenges, cursor-paged play-by-play & ticketing. (22 endpoints) - Formula 1 API — Drivers, constructors, races, telemetry & pit stops. (7 endpoints) Other categories - Fandom & Pop Culture — 17 APIs - Original Worlds — 3 APIs - Testing Scenarios — 9 APIs All 39 mock REST APIs · Testing techniques Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/category/original-worlds TITLE: Original Worlds — Mock REST APIs | Fun API Playground ================================================================ Original Worlds Original settings, built around a constraint rather than a licence: enclosures with capacity and compatibility rules, probes that answer slowly enough to make your timeouts matter, nested resources deep enough to make URL construction a real question. Borrowing a world means borrowing its rules, and real worlds are rarely strict enough to be interesting. These are invented so the constraints can be: an enclosure that will not take another dinosaur, a probe whose round trip is slow enough that your timeout configuration becomes a real decision, a resource tree deep enough that building the URL is itself part of the exercise. They are the best group here for the awkward parts of REST — nested resources, capacity limits, state machines that refuse a transition, and endpoints that deliberately take long enough to expose a client with no deadline of its own. 3 APIs in this category - Superhero API — Heroes, powers & nemeses. Great for nested resources. (6 endpoints) - Dino Park API — Dinosaurs, enclosures & the occasional breach. (9 endpoints) - Space Agency API — Launches, scrubs & probes with real signal lag. (9 endpoints) Other categories - Fandom & Pop Culture — 17 APIs - Everyday Life — 10 APIs - Testing Scenarios — 9 APIs All 39 mock REST APIs · Testing techniques Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/category/testing-scenarios TITLE: Testing Scenarios — Mock REST APIs | Fun API Playground ================================================================ Testing Scenarios No theme, no story: each of these exists to make one testing technique reachable. Real OAuth tokens that really expire, HMAC-signed webhook deliveries you can replay, a fault injector that fails on request, and a protocol bench covering the parts of HTTP that mock APIs usually skip. Everything else in the catalog wraps a technique in a theme. These do not: each one exists so that a specific mechanism is reachable in isolation, with nothing else in the way. The auth playground issues real signed JWTs and runs real OAuth flows; the webhook API signs its deliveries with an HMAC you can verify or deliberately fail; the protocol bench covers redirects, content negotiation, JSON Patch, ranges and conditional requests. If you arrived here from a specific problem — a token that expires mid-suite, a signature that will not verify, a redirect chain your client follows too far — this is the group that has an endpoint for it. 9 APIs in this category - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. (6 endpoints) - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints) - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints) - Object Storage API — Objects, checksums, ranges & resumable uploads. (4 endpoints) - Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. (6 endpoints) - Event Streams API — SSE events, replay cursors, heartbeats & ordering. (3 endpoints) - Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (5 endpoints) - Search & Facets API — Full-text queries, facets, highlights & cursor pagination. (2 endpoints) - Fun Data Bridge API — Seeded fixtures from schemas, inspired by fundata.dev. (4 endpoints) Other categories - Fandom & Pop Culture — 17 APIs - Everyday Life — 10 APIs - Original Worlds — 3 APIs All 39 mock REST APIs · Testing techniques Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/pagination TITLE: Pagination testing — mock API examples | Fun API Playground ================================================================ Testing pagination against a real API Pagination looks trivial until a page boundary lands in the middle of a record set that is still being written to. The APIs below implement both common styles — page numbers with a total, and opaque cursors — so you can write a client against each and find out which assumptions your code is making. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - Walk every page of a collection and assert that the number of records you collected equals the total the API reported. - Request a page past the end of the collection. Some APIs answer with an empty list and a 200; the Friends API answers 404. Both are defensible, and your client has to handle whichever it meets. - Check the last page: it is almost always partially full, and off-by-one errors hide there. - Walk the Bank API by cursor and confirm no record is skipped or repeated — the failure mode cursors are supposed to prevent. - Combine pagination with a filter and verify the counts still agree. APIs to try it on - Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints) - Star Wars API — Characters, planets & starships from a galaxy far away. (11 endpoints) - Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints) - Search & Facets API — Full-text queries, facets, highlights & cursor pagination. (2 endpoints) Status codes involved - 200 OK - 400 Bad Request - 404 Not Found Other techniques - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/rate-limiting TITLE: Rate limit testing — mock API examples | Fun API Playground ================================================================ Testing rate limits, 429s and backoff Almost nobody tests rate limiting, because a well-behaved API will not rate limit you on demand — and so the retry policy that turns a slowdown into an outage ships untested. The Coffee Shop API enforces a genuine quota over a live window, so you can exceed it deliberately and watch it reopen. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - Send requests until you get a 429, then read Retry-After and wait exactly that long before retrying. - Read X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset on successful calls and throttle from them, rather than waiting to be refused. - Verify your retry policy applies backoff and a ceiling — an immediate retry loop on a 429 is indistinguishable from an attack. - Check that a 429 is not counted as a permanent failure in your circuit breaker. - Use the Fault Injection API to combine a rate limit with intermittent 503s and see whether your client still converges. APIs to try it on - Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints) - Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (5 endpoints) Status codes involved - 429 Too Many Requests - 503 Service Unavailable Other techniques - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/idempotency TITLE: Idempotency key testing — mock API examples | Fun API ================================================================ Testing idempotency keys and safe retries A POST that times out is the hardest case in client design: the request may have succeeded, and you cannot tell. Idempotency keys resolve it by making the retry safe. The APIs below accept an Idempotency-Key header and replay the original response rather than performing the work again. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - Create a resource with an Idempotency-Key, then send the identical request again and confirm you get the original response — same id, same body. - Change the body but keep the key, and see how the API reports the mismatch. - Send the same body with a different key and confirm you get two distinct resources, which is the correct behaviour. - Transfer money on the Bank API with a repeated key and verify the balance moved exactly once. - Combine with the Fault Injection API: inject a timeout, retry with the same key, and check the end state is correct. APIs to try it on - Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints) - Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints) - Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (5 endpoints) Status codes involved - 200 OK - 201 Created - 409 Conflict Other techniques - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/optimistic-concurrency TITLE: ETag and If-Match testing — mock API examples | Fun API ================================================================ Testing optimistic concurrency with ETag and If-Match Lost updates are the quietest bug in any CRUD application: two clients read the same record, both write, and the second silently discards the first one's work. Optimistic concurrency turns that into a 412 you can handle. Most of the catalog supports it, so you can rehearse both the happy path and the conflict. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - GET a resource and keep its ETag, then PUT it back with If-Match and watch it succeed. - Have a second request modify the resource, then retry the first PUT with the now-stale ETag and collect the 412. - Write without an If-Match header at all and notice that nothing stops you — which is the bug this whole mechanism exists to prevent. - Combine with a conditional GET: send If-None-Match and confirm the 304 when nothing has changed. - Try the Retro Quest save-conflict endpoints, where the same idea is modelled as save-game versions. APIs to try it on - Football API — Teams, squads, standings & simulated matches. (7 endpoints) - Harry Potter API — Houses, students & spells from a magic school. (10 endpoints) - Game of Thrones API — Houses, nobles & dragons of Westeros. (12 endpoints) - Retro Quest API — Pixel heroes, quests, loot & save-game conflicts. (5 endpoints) Status codes involved - 304 Not Modified - 412 Precondition Failed Other techniques - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/webhook-signatures TITLE: Webhook signature testing — mock API examples | Fun API ================================================================ Testing webhooks and HMAC signature verification Webhook receivers are public endpoints that act on data from outside, which makes signature verification the only thing between you and anyone who knows your URL. The Webhooks API signs every delivery with an HMAC and keeps a delivery log you can inspect and replay, so you can test the verifier rather than trusting it. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - Register a subscription, trigger an event, and verify the signature against the shared secret before doing anything with the body. - Change one byte of the payload and confirm verification fails. - Replay a stored delivery and check your receiver is idempotent instead of processing it twice. - Check that your comparison is constant-time — a naive string equality leaks the signature a byte at a time. - Inspect the delivery log to see exactly which headers arrived, rather than the ones you assumed would. APIs to try it on - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints) - Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (5 endpoints) Status codes involved - 200 OK - 201 Created - 401 Unauthorized - 409 Conflict Other techniques - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/auth-tokens TITLE: OAuth and JWT testing — mock API examples | Fun API ================================================================ Testing OAuth 2.0, JWTs and token expiry Most auth testing stops at "a valid token works, an invalid one does not", which leaves the interesting half untested: the token that was valid when the request started and expired before it finished. The APIs below issue genuinely signed, genuinely short-lived tokens, so refresh and expiry are things that actually happen. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - Complete the client-credentials flow and call a protected endpoint with the token you were issued. - Wait for a short-lived token to expire and confirm your client refreshes transparently instead of failing the user's request. - Exchange a refresh token, then attempt to reuse the old one and read the rejection. - Run the authorization-code flow with PKCE, then retry with the wrong code_verifier. - Drive the device-code flow end to end — the one that matters for CLIs and TVs, and the one nobody tests. - Send a well-formed but wrongly-signed JWT and confirm it is refused as firmly as a missing one. APIs to try it on - Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. (6 endpoints) - Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints) - Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. (6 endpoints) Status codes involved - 200 OK - 400 Bad Request - 401 Unauthorized - 403 Forbidden Other techniques - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/negative-testing TITLE: Negative testing — mock API examples | Fun API Playground ================================================================ Negative testing: every error code on demand A test suite that only covers the happy path is testing the case that was never going to break. The catalog is built so every error is reachable on purpose: a guaranteed 500, a real rate limit, a teapot, and a fault injector that produces whatever you configure. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - Call the Pizza oven endpoint for a reliable 500 and verify your client retries, falls back, or reports it — but does not hang. - Use the Fault Injection API to set a status code, a latency and a failure rate, then run your suite against it. - Separate 400 from 422: one means the request was unreadable, the other that it was understood and refused. - Separate 401 from 403, and 404 from 410. Each pair is routinely collapsed, and each collapse hides a real bug. - Inject a malformed body and confirm your client reports a parse error rather than crashing. APIs to try it on - Pizza Orders API — Place & track orders. Includes a guaranteed 500. (9 endpoints) - Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints) - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints) - Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (5 endpoints) Status codes involved - 400 Bad Request - 401 Unauthorized - 403 Forbidden - 404 Not Found - 418 I'm a Teapot - 422 Unprocessable Content - 429 Too Many Requests - 500 Internal Server Error - 503 Service Unavailable Other techniques - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/testing/async-jobs TITLE: Async job testing — mock API examples | Fun API Playground ================================================================ Testing 202 Accepted and async job polling 202 Accepted is the status clients mishandle most, because it is a success response for work that has not happened. The Protocol Lab models the full pattern: submit, receive a 202 with a status URL, poll until the job resolves, and handle the job that fails rather than completes. Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns. How to practise it - Submit a job, read the Location header from the 202, and poll it rather than assuming the work is done. - Poll with a sensible interval and a ceiling — a tight loop against a job that never finishes is its own outage. - Handle the job that completes with a failure: the poll succeeded, the work did not. - Check what your client does when the job outlives your overall timeout. - Combine with the 503 and 504 endpoints to see polling behave under an unreliable upstream. APIs to try it on - Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints) - Event Streams API — SSE events, replay cursors, heartbeats & ordering. (3 endpoints) - Fun Data Bridge API — Seeded fixtures from schemas, inspired by fundata.dev. (4 endpoints) Status codes involved - 202 Accepted - 200 OK - 503 Service Unavailable - 504 Gateway Timeout Other techniques - Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected. - Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit. - Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge. - ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other. - Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected. - OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session. - Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently. Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/200 TITLE: HTTP 200 OK — Live Example | Fun API Playground ================================================================ HTTP 200 OK The request succeeded and the response carries the representation you asked for. For a GET this is the body; for a PUT or POST it is the result of the operation. Defined in RFC 9110 §15.3.1 — 200 OK · MDN reference On this page - Where you meet HTTP 200 in production - Why you would test it - What your client should do about a 200 - 200 versus the codes it gets confused with - Endpoints that return 200 - Questions about HTTP 200 - Other success codes Where you meet HTTP 200 in production The default answer to a successful GET, and to a PUT or POST whose result is returned inline. It is the code you will see most and inspect least. Why you would test it Worth asserting on more carefully than most suites do: a 200 with the wrong body, a stale representation or a missing header is still a 200, and a status-only assertion will pass it. What your client should do about a 200 Do not stop at the status line. Validate the body against a schema, check the content type is what you asked for, and confirm any caching headers you rely on are present. A 200 carrying an error object in the body is a real and common API design, and a status-only assertion sails straight past it. 200 versus the codes it gets confused with - 200 vs 201 Created — Use 201 when the request created a new resource. A POST that answers 200 with a body is saying "here is a result", not "here is a thing that now exists at a URL". - 200 vs 204 No Content — 204 is the same success with a deliberately empty body. If your handler always parses JSON, the two are not interchangeable. Endpoints that return 200 260 endpoints in this playground answer with 200. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/friends/v1/characters — Paginated character list, with Deprecation/Sunset/Link headers pointing at v2 (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/characters/{id} — The character (Friends API) Open & run this endpoint - PUT https://funapi.dev/api/friends/v1/characters/{id} — Updated (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters/bulk-delete — All ids existed and were deleted (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/episodes — Episode list (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/quotes/random — One random quote (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/characters/{id}/quotes — Matching quotes (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v2/characters — v2 shape: { apiVersion, data: { items, count } }, occupation replaces job (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/version — Current, supported and deprecated versions (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/characters — Shape depends on negotiated version (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/graphql — GraphQL convention: always 200, with data and/or an errors array (Friends API) Open & run this endpoint - GET https://funapi.dev/api/superheroes/v1/heroes — Paginated hero list (Superhero API) Open & run this endpoint - GET https://funapi.dev/api/superheroes/v1/heroes/{id} — The hero (Superhero API) Open & run this endpoint - GET https://funapi.dev/api/superheroes/v1/heroes/{id}/nemesis — The nemesis (Superhero API) Open & run this endpoint - GET https://funapi.dev/api/pizza/v1/menu — The menu (Pizza Orders API) Open & run this endpoint - GET https://funapi.dev/api/pizza/v1/orders/{id} — The order (Pizza Orders API) Open & run this endpoint - PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Updated (Pizza Orders API) Open & run this endpoint - PATCH https://funapi.dev/api/pizza/v1/orders/{id} — Updated (Pizza Orders API) Open & run this endpoint - GET https://funapi.dev/api/pizza/v1/oven/preheat — Preheated, after a deliberate ~3s delay (Pizza Orders API) Open & run this endpoint - GET https://funapi.dev/api/coffee/v1/drinks — Drink list (Coffee Shop API) Open & run this endpoint - GET https://funapi.dev/api/coffee/v1/drinks/{id} — The drink (Coffee Shop API) Open & run this endpoint - GET https://funapi.dev/api/coffee/v1/rush-hour — Got a spot in line (Coffee Shop API) Open & run this endpoint - PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — Marked ready (Coffee Shop API) Open & run this endpoint - GET https://funapi.dev/api/football/v1/teams — Paginated team list (Football API) Open & run this endpoint - GET https://funapi.dev/api/football/v1/teams/{id} — The team (Football API) Open & run this endpoint …and 235 more endpoints across the catalog. Questions about HTTP 200 - Can a 200 response contain an error?: Yes, and plenty of APIs do it — a 200 wrapping {"error": …} is common in older SOAP-influenced designs and in some GraphQL setups. It is why an assertion on status alone is weaker than it looks. - Should a POST return 200 or 201?: 201 if it created a resource you can address with a URL, 200 if it performed an action and is reporting the outcome. Other success codes - 201 Created - 202 Accepted - 203 Non-Authoritative Information - 204 No Content - 205 Reset Content - 206 Partial Content - 207 Multi-Status All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/201 TITLE: HTTP 201 Created — Live Example | Fun API Playground ================================================================ HTTP 201 Created A new resource exists as a result of this request. A well-behaved API also sends a Location header pointing at it, and usually the created representation as the body. Defined in RFC 9110 §15.3.2 — 201 Created · MDN reference On this page - Where you meet HTTP 201 in production - Why you would test it - What your client should do about a 201 - 201 versus the codes it gets confused with - Endpoints that return 201 - Questions about HTTP 201 - Other success codes Where you meet HTTP 201 in production Sign-ups, orders, uploads, bookings, comments — anything where a POST leaves something behind that has an address of its own afterwards, and where the caller will very likely want to fetch or modify it a moment later. Why you would test it Check the Location header, not just the status — clients that build the follow-up URL themselves break the first time the server changes its id scheme. What your client should do about a 201 Read the Location header and follow it rather than assembling the URL yourself from the id in the body. Servers change id schemes; clients that guess break on the day they do. Where the body carries the created representation, use it instead of an immediate re-fetch. 201 versus the codes it gets confused with - 201 vs 202 Accepted — 202 means the resource does not exist yet — the work is queued. 201 means it exists now. - 201 vs 200 OK — A 200 says the request succeeded. A 201 says it succeeded and something new is now addressable. Endpoints that return 201 45 endpoints in this playground answer with 201. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/friends/v1/characters — Created (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters/bulk — All items created (Friends API) Open & run this endpoint - POST https://funapi.dev/api/superheroes/v1/heroes — Created (Superhero API) Open & run this endpoint - POST https://funapi.dev/api/superheroes/v1/heroes/versus — Fight resolved, random winner (Superhero API) Open & run this endpoint - POST https://funapi.dev/api/pizza/v1/orders — Order placed (Pizza Orders API) Open & run this endpoint - POST https://funapi.dev/api/coffee/v1/orders — Order placed (Coffee Shop API) Open & run this endpoint - POST https://funapi.dev/api/football/v1/matches — Match played, random score (Football API) Open & run this endpoint - POST https://funapi.dev/api/movies/v1/movies — Created (Movies API) Open & run this endpoint - POST https://funapi.dev/api/movies/v1/movies/{id}/poster — Uploaded (Movies API) Open & run this endpoint - POST https://funapi.dev/api/wizarding/v1/students — Enrolled (Harry Potter API) Open & run this endpoint - POST https://funapi.dev/api/galaxy/v1/characters — Created (Star Wars API) Open & run this endpoint - POST https://funapi.dev/api/holmes/v1/suspects — Created (Sherlock Holmes API) Open & run this endpoint - POST https://funapi.dev/api/pokemon/v1/pokemon — Created (Pokémon API) Open & run this endpoint - POST https://funapi.dev/api/pokemon/v1/battles — Battle resolved, random winner (Pokémon API) Open & run this endpoint - POST https://funapi.dev/api/middleearth/v1/fellowship — Recruited (Middle-earth API) Open & run this endpoint - POST https://funapi.dev/api/webhooks/v1/subscriptions — Registered, includes a signingSecret (Webhooks API) Open & run this endpoint - POST https://funapi.dev/api/webhooks/v1/trigger — Delivered to one or more subscriptions (Webhooks API) Open & run this endpoint - POST https://funapi.dev/api/office/v1/employees — Hired (The Office API) Open & run this endpoint - POST https://funapi.dev/api/dinopark/v1/dinosaurs — Created (Dino Park API) Open & run this endpoint - POST https://funapi.dev/api/dinopark/v1/incidents/breach — Incident logged (Dino Park API) Open & run this endpoint - POST https://funapi.dev/api/marvel/v1/heroes — Recruited (Marvel API) Open & run this endpoint - POST https://funapi.dev/api/marvel/v1/missions — Mission created (Marvel API) Open & run this endpoint - POST https://funapi.dev/api/got/v1/nobles — Created (Game of Thrones API) Open & run this endpoint - POST https://funapi.dev/api/got/v1/battles — Battle resolved (Game of Thrones API) Open & run this endpoint - POST https://funapi.dev/api/rickandmorty/v1/characters — Created (Rick and Morty API) Open & run this endpoint …and 20 more endpoints across the catalog. Questions about HTTP 201 - Does a 201 have to include a body?: No. The Location header is the important part; the body is a convenience that saves the client a round trip. - What if the resource already existed?: Then it was not created. 200 with the existing representation, or 409 if the request was an unambiguous attempt to create a duplicate. Other success codes - 200 OK - 202 Accepted - 203 Non-Authoritative Information - 204 No Content - 205 Reset Content - 206 Partial Content - 207 Multi-Status All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/202 TITLE: HTTP 202 Accepted — Live Example | Fun API Playground ================================================================ HTTP 202 Accepted The request was accepted but has not been carried out yet. The work happens asynchronously, and the response tells you where to look for the result. Defined in RFC 9110 §15.3.3 — 202 Accepted · MDN reference On this page - Where you meet HTTP 202 in production - Why you would test it - What your client should do about a 202 - 202 versus the codes it gets confused with - Endpoints that return 202 - Questions about HTTP 202 - Other success codes Where you meet HTTP 202 in production Report generation, video transcoding, bulk imports, index rebuilds and payment captures that clear asynchronously — anywhere the real work outlives the request that asked for it and the server refuses to hold the connection open. Why you would test it The status your client is most likely to mishandle: it is a success, but the thing you asked for has not happened. Poll the status URL until it resolves instead of assuming completion. What your client should do about a 202 Treat it as "not yet", never as "done". Take the Location or the job id, poll with backoff, and give the poll a deadline. The most expensive bug in this shape is a test suite that asserts 202 and then asserts on data the job had not written yet — it passes locally and fails in CI, intermittently, forever. 202 versus the codes it gets confused with - 202 vs 201 Created — 201 means the resource is there. 202 means someone has agreed to make it. - 202 vs 200 OK — A 200 finishes the story. A 202 hands you a bookmark. Endpoints that return 202 5 endpoints in this playground answer with 202. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/protocol/v1/jobs — Accepted. Poll the Location header until status is "done". (Protocol Lab API) Open & run this endpoint - POST https://funapi.dev/api/fiba/v1/games/{id}/highlights — Render job accepted (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/streams/v1/events — Event accepted (Event Streams API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint - POST https://funapi.dev/api/data/v1/jobs — Job accepted (Fun Data Bridge API) Open & run this endpoint Questions about HTTP 202 - How do I know when the job is finished?: Poll the status URL the 202 gave you until it reports a terminal state. A well-designed API tells you a suggested interval; if it does not, back off exponentially. - What if the job fails?: The polling endpoint reports the failure — the 202 itself was correct, because the request to start the work really was accepted. Other success codes - 200 OK - 201 Created - 203 Non-Authoritative Information - 204 No Content - 205 Reset Content - 206 Partial Content - 207 Multi-Status All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/203 TITLE: HTTP 203 Non-Authoritative Information | Fun API ================================================================ HTTP 203 Non-Authoritative Information The request succeeded, but the body was modified by a transforming proxy between you and the origin server — it is not exactly what the origin sent. Defined in RFC 9110 §15.3.4 — 203 Non-Authoritative Information · MDN reference On this page - Where you meet HTTP 203 in production - Why you would test it - What your client should do about a 203 - 203 versus the codes it gets confused with - Endpoints that return 203 - Questions about HTTP 203 - Other success codes Where you meet HTTP 203 in production Content-rewriting proxies and some corporate gateways that compress images, strip headers or inject markup. Origin servers almost never send it themselves. Why you would test it Rarely produced on purpose, which is why clients that whitelist "200" as the only success break on it. Check your success test is a range, not a single value. What your client should do about a 203 Treat it as a success — it is one — and remember the representation may differ from the origin's: a checksum or signature over the body may no longer verify, and cached validators may not match. 203 versus the codes it gets confused with - 203 vs 200 OK — Same success, but 200 promises the body is the origin's own. 203 says something in between changed it. - 203 vs 206 Partial Content — 206 is a deliberately partial body the client asked for. 203 is a complete body that something in between altered. Endpoints that return 203 1 endpoint in this playground answers with 203. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 203 - Should my API return 203?: Almost never. It describes what an intermediary did, so it belongs to proxies, not to the application behind them. - Is 203 cacheable?: Yes, by default — it is one of the status codes HTTP lets a cache store without explicit freshness information. Other success codes - 200 OK - 201 Created - 202 Accepted - 204 No Content - 205 Reset Content - 206 Partial Content - 207 Multi-Status All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/204 TITLE: HTTP 204 No Content — Live Example | Fun API Playground ================================================================ HTTP 204 No Content The request succeeded and there is deliberately no body. Most commonly the answer to a successful DELETE. Defined in RFC 9110 §15.3.5 — 204 No Content · MDN reference On this page - Where you meet HTTP 204 in production - Why you would test it - What your client should do about a 204 - 204 versus the codes it gets confused with - Endpoints that return 204 - Questions about HTTP 204 - Other success codes Where you meet HTTP 204 in production Successful DELETEs, PUTs that do not echo the updated resource back, endpoints whose whole job is a side effect, and preference or settings writes where the client already knows the new state it just sent. Why you would test it Clients that call response.json() unconditionally throw here. Testing a 204 path is how you find out that your error handling has a hole in it. What your client should do about a 204 Do not call .json() unconditionally. Fetch-based clients throw on an empty body, and the throw surfaces as a network-looking error a long way from its cause. Branch on the status, or check content-length, before parsing. 204 versus the codes it gets confused with - 204 vs 200 OK — Both are success. 204 promises there is nothing to read; 200 promises there is. - 204 vs 404 Not Found — Deleting something that was already gone is a design decision: 204 (idempotent, the end state is what you asked for) or 404 (there was nothing to delete). Pick one and be consistent. Endpoints that return 204 24 endpoints in this playground answer with 204. Every one is free, needs no signup, and can be called from the browser or with curl. - DELETE https://funapi.dev/api/friends/v1/characters/{id} — Deleted, empty body (Friends API) Open & run this endpoint - DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Retired (Superhero API) Open & run this endpoint - DELETE https://funapi.dev/api/pizza/v1/orders/{id} — Cancelled (Pizza Orders API) Open & run this endpoint - DELETE https://funapi.dev/api/football/v1/teams/{id} — Removed (Football API) Open & run this endpoint - DELETE https://funapi.dev/api/movies/v1/movies/{id} — Removed (Movies API) Open & run this endpoint - DELETE https://funapi.dev/api/wizarding/v1/students/{id} — Expelled (Harry Potter API) Open & run this endpoint - DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Removed (Star Wars API) Open & run this endpoint - DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Cleared (Sherlock Holmes API) Open & run this endpoint - DELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — Released (Pokémon API) Open & run this endpoint - DELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — Removed (Middle-earth API) Open & run this endpoint - DELETE https://funapi.dev/api/webhooks/v1/subscriptions/{id} — Unsubscribed (Webhooks API) Open & run this endpoint - DELETE https://funapi.dev/api/office/v1/employees/{id} — Fired (The Office API) Open & run this endpoint - DELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — Relocated (Dino Park API) Open & run this endpoint - DELETE https://funapi.dev/api/marvel/v1/heroes/{id} — Retired (Marvel API) Open & run this endpoint - DELETE https://funapi.dev/api/rickandmorty/v1/characters/{id} — Removed (Rick and Morty API) Open & run this endpoint - DELETE https://funapi.dev/api/airline/v1/bookings/{id} — Cancelled — subsequent GETs return 410 (Airline API) Open & run this endpoint - DELETE https://funapi.dev/api/protocol/v1/documents/{id} — Deleted — subsequent GETs return 410 (Protocol Lab API) Open & run this endpoint - DELETE https://funapi.dev/api/starfleet/v1/crew/{id} — Beamed home safely (Starfleet API) Open & run this endpoint - DELETE https://funapi.dev/api/worldcup/v1/tickets/{id} — Cancelled (World Cup 2026 API) Open & run this endpoint - DELETE https://funapi.dev/api/fiba/v1/tickets/{id} — Cancelled (FIBA World Cup API) Open & run this endpoint - DELETE https://funapi.dev/api/storage/v1/objects/{key} — Deleted (Object Storage API) Open & run this endpoint - POST https://funapi.dev/api/identity/v1/revoke — Revoked or already absent (Modern Identity API) Open & run this endpoint - DELETE https://funapi.dev/api/faults/v1/config — Reset (Fault Injection API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 204 - Can a 204 have a body?: No. The specification forbids it, and intermediaries may drop it. - Is DELETE supposed to return 204?: 204 is the common choice. 200 with a body and 202 for a queued delete are both legitimate too. Other success codes - 200 OK - 201 Created - 202 Accepted - 203 Non-Authoritative Information - 205 Reset Content - 206 Partial Content - 207 Multi-Status All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/205 TITLE: HTTP 205 Reset Content — Live Example | Fun API Playground ================================================================ HTTP 205 Reset Content The request succeeded and the client should reset the view that sent it — clear the form, so the user can enter another. There is never a body. Defined in RFC 9110 §15.3.6 — 205 Reset Content · MDN reference On this page - Where you meet HTTP 205 in production - Why you would test it - What your client should do about a 205 - 205 versus the codes it gets confused with - Endpoints that return 205 - Questions about HTTP 205 - Other success codes Where you meet HTTP 205 in production Data-entry style flows — submit a record, get a blank form back for the next one. In practice most APIs use 204 and leave the reset to the frontend, so 205 is uncommon outside older form-centric systems. Why you would test it Like 204, it breaks any client that parses JSON unconditionally. Unlike 204 it carries an instruction, and few frontends honour it; test whether yours resets or does nothing. What your client should do about a 205 Do not read a body; there is none, and the server must not send one. Clear the input state that produced the request. If you cannot reset anything meaningful, treat it as 204. 205 versus the codes it gets confused with - 205 vs 204 No Content — Both are bodiless successes. 204 means "nothing to show"; 205 adds "and reset what you have". - 205 vs 200 OK — A 200 after a form post usually returns the saved record, which is the opposite of resetting. Endpoints that return 205 1 endpoint in this playground answers with 205. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 205 - Can a 205 response have a body?: No. HTTP forbids content in a 205, and servers that send one are non-compliant; some clients will misread the next response on the same connection. - Does fetch() treat 205 as ok?: Yes — response.ok is true for any 2xx. Calling response.json() on it throws, because the body is empty. Other success codes - 200 OK - 201 Created - 202 Accepted - 203 Non-Authoritative Information - 204 No Content - 206 Partial Content - 207 Multi-Status All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/206 TITLE: HTTP 206 Partial Content — Live Example | Fun API Playground ================================================================ HTTP 206 Partial Content The response carries only the byte range you asked for with a Range header, described by Content-Range. This is how resumable downloads and media seeking work. Defined in RFC 9110 §15.3.7 — 206 Partial Content · MDN reference On this page - Where you meet HTTP 206 in production - Why you would test it - What your client should do about a 206 - 206 versus the codes it gets confused with - Endpoints that return 206 - Questions about HTTP 206 - Other success codes Where you meet HTTP 206 in production Video and audio scrubbing, resumable downloads, and any client that asks for part of a large file with a Range header. Why you would test it Verify the range you receive is the range you requested, and that Content-Range agrees with the body length — off-by-one errors here corrupt files silently. What your client should do about a 206 Check the Content-Range header against what you asked for rather than assuming the server honoured the exact range. A server may return a different range, or ignore the request and answer 200 with the whole entity — which is legal, and will quietly blow up a client sized for a chunk. 206 versus the codes it gets confused with - 206 vs 200 OK — A 200 to a ranged request means the server ignored the Range header and sent everything. - 206 vs 416 Range Not Satisfiable — 416 means the range you asked for lies outside the resource. 206 means it was satisfiable and here it is. Endpoints that return 206 2 endpoints in this playground answer with 206. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/storage/v1/objects/{key} — Partial content (Object Storage API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 206 - How do I request a partial response?: Send a Range header, e.g. Range: bytes=0-1023. The server answers 206 with Content-Range if it can satisfy it. - Is 206 cacheable?: Yes, but partial responses interact with caching in subtle ways — validators must match before a cache may combine ranges. Other success codes - 200 OK - 201 Created - 202 Accepted - 203 Non-Authoritative Information - 204 No Content - 205 Reset Content - 207 Multi-Status All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/207 TITLE: HTTP 207 Multi-Status — Live Example | Fun API Playground ================================================================ HTTP 207 Multi-Status One response carrying several independent outcomes, for a request that operated on more than one resource. Each element has its own status. Defined in RFC 4918 §11.1 — 207 Multi-Status · MDN reference On this page - Where you meet HTTP 207 in production - Why you would test it - What your client should do about a 207 - 207 versus the codes it gets confused with - Endpoints that return 207 - Questions about HTTP 207 - Other success codes Where you meet HTTP 207 in production Bulk endpoints: create fifty records, delete a list of ids, dispatch a batch of messages. One request, many outcomes, and no single status that honestly describes all of them. Why you would test it The trap is treating the 207 itself as success. Individual operations inside it may have failed, and only the per-item statuses will tell you. What your client should do about a 207 The response is the assertion, not the status. Walk the per-item results and count successes and failures explicitly. A client that sees 2xx and moves on will silently drop the items that failed, and nothing downstream will know. 207 versus the codes it gets confused with - 207 vs 200 OK — A 200 on a batch endpoint claims the whole batch worked. 207 is honest that some of it may not have. - 207 vs 422 Unprocessable Content — If the whole batch is rejected before anything runs, that is a 400 or 422 — 207 means some of it happened. Endpoints that return 207 3 endpoints in this playground answer with 207. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/friends/v1/characters/bulk — Partial success — some items failed validation (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Partial success — some ids did not exist (Friends API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 207 - Is 207 a standard status code?: Yes — it comes from WebDAV (RFC 4918) and is widely reused for batch REST endpoints. - What should the body look like?: An array or map of per-item results, each with its own status and, on failure, its own error. Other success codes - 200 OK - 201 Created - 202 Accepted - 203 Non-Authoritative Information - 204 No Content - 205 Reset Content - 206 Partial Content All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/300 TITLE: HTTP 300 Multiple Choices — Live Example | Fun API ================================================================ HTTP 300 Multiple Choices The resource has several representations and the server is asking the client to pick one, usually listing them in the body and optionally suggesting one in Location. Defined in RFC 9110 §15.4.1 — 300 Multiple Choices · MDN reference On this page - Where you meet HTTP 300 in production - Why you would test it - What your client should do about a 300 - 300 versus the codes it gets confused with - Endpoints that return 300 - Questions about HTTP 300 - Other redirection codes Where you meet HTTP 300 in production Close to unused on the modern web — content negotiation through Accept headers replaced it. It survives in a few package indexes, document archives and language-selection pages. Why you would test it A redirect your HTTP library will not follow automatically. Test what your client does when it receives one: most surface it as a failure, which is the honest outcome. What your client should do about a 300 There is no standard machine-readable format for the choices, so a client cannot choose generically. If a Location is present, following it is reasonable; otherwise surface the list to a person. 300 versus the codes it gets confused with - 300 vs 406 Not Acceptable — 406 is "none of what you accept is available". 300 is "several things are available, choose". - 300 vs 302 Found — 302 picks for you and redirects automatically; 300 hands the choice back. Endpoints that return 300 1 endpoint in this playground answers with 300. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 300 - Do browsers follow a 300 automatically?: Only if it carries a Location header, and behaviour varies. Without one, the browser shows the response body. - Should an API ever return 300?: Rarely. Accept-based negotiation answering 200 or 406 is clearer for programmatic clients. Other redirection codes - 301 Moved Permanently - 302 Found - 303 See Other - 304 Not Modified - 307 Temporary Redirect - 308 Permanent Redirect All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/301 TITLE: HTTP 301 Moved Permanently — Live Example | Fun API ================================================================ HTTP 301 Moved Permanently The resource has a new URL, given in the Location header, and clients should use it from now on. Defined in RFC 9110 §15.4.2 — 301 Moved Permanently · MDN reference On this page - Where you meet HTTP 301 in production - Why you would test it - What your client should do about a 301 - 301 versus the codes it gets confused with - Endpoints that return 301 - Questions about HTTP 301 - Other redirection codes Where you meet HTTP 301 in production Domain moves, HTTPS upgrades, trailing-slash normalisation, and any URL you want search engines to forget in favour of a new one. Why you would test it Check whether your client follows the redirect, and whether it preserves the method and body when it does — many libraries silently turn a redirected POST into a GET. What your client should do about a 301 Follow the Location header, and update anything you have stored — the whole point of "permanently" is that the old URL should not be requested again. Note that many clients historically rewrite the method to GET when following a 301 after a POST; if the method must be preserved, the server should send 308. 301 versus the codes it gets confused with - 301 vs 302 Found — 302 is temporary: keep using the original URL. 301 says stop using it. - 301 vs 308 Permanent Redirect — 308 is 301 that guarantees the method and body survive the redirect. Use it for anything that is not a GET. Endpoints that return 301 2 endpoints in this playground answer with 301. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/protocol/v1/moved/old-dashboard — Always. Follow the Location header — real HTTP clients do it automatically. (Protocol Lab API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 301 - Does a 301 pass SEO signals?: Yes — a permanent redirect is the standard way to move ranking signals from an old URL to a new one. - Will a 301 be cached?: Aggressively, by browsers and intermediaries. That is what makes it hard to undo, and why it should be a considered decision. Other redirection codes - 300 Multiple Choices - 302 Found - 303 See Other - 304 Not Modified - 307 Temporary Redirect - 308 Permanent Redirect All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/302 TITLE: HTTP 302 Found — Live Example | Fun API Playground ================================================================ HTTP 302 Found The resource is temporarily at a different URL. Unlike a 301, the original URL stays authoritative and should still be used for future requests. Defined in RFC 9110 §15.4.3 — 302 Found · MDN reference On this page - Where you meet HTTP 302 in production - Why you would test it - What your client should do about a 302 - 302 versus the codes it gets confused with - Endpoints that return 302 - Questions about HTTP 302 - Other redirection codes Where you meet HTTP 302 in production Post/Redirect/Get after a form submission, load-balancing a caller to a regional host, short-lived redirects to a signed download URL, and login flows that bounce a visitor through an identity provider and back. Why you would test it Confirm your client does not cache a 302 as if it were permanent, and that redirect loops are bounded rather than hanging. What your client should do about a 302 Follow it, but keep the original URL — it is still the canonical address. Cap redirect following at a small number of hops so a redirect loop fails fast instead of hanging. If the method matters, remember that many clients turn the follow-up into a GET. 302 versus the codes it gets confused with - 302 vs 301 Moved Permanently — 301 is permanent and will be cached. 302 is not. - 302 vs 307 Temporary Redirect — 307 is the temporary redirect that preserves the method and body. Where a POST must stay a POST, 307 says so explicitly and 302 does not. Endpoints that return 302 2 endpoints in this playground answer with 302. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/protocol/v1/hop — Redirects to /hop?hops=n-1 (Protocol Lab API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 302 - Why is 302 sometimes described as "Found"?: That is its formal name. The behaviour people mean by it — "temporarily somewhere else" — is closer to what 307 defines precisely. - Is 302 bad for SEO?: Not bad, but it tells search engines to keep indexing the original URL. If the move is permanent, use 301. Other redirection codes - 300 Multiple Choices - 301 Moved Permanently - 303 See Other - 304 Not Modified - 307 Temporary Redirect - 308 Permanent Redirect All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/303 TITLE: HTTP 303 See Other — Live Example | Fun API Playground ================================================================ HTTP 303 See Other The answer is somewhere else, at the URL in Location, and the client should fetch it with GET — whatever method the original request used. Defined in RFC 9110 §15.4.4 — 303 See Other · MDN reference On this page - Where you meet HTTP 303 in production - Why you would test it - What your client should do about a 303 - 303 versus the codes it gets confused with - Endpoints that return 303 - Questions about HTTP 303 - Other redirection codes Where you meet HTTP 303 in production The classic "Post/Redirect/Get" pattern: a form submission answers 303 pointing at a confirmation page, so refreshing the page does not resubmit the form. Also used by async APIs to point at a finished result. Why you would test it The redirect that is supposed to change POST into GET. Test that your client does exactly that, and that it does not resubmit the body to the new URL. What your client should do about a 303 Follow the Location with a GET and no body. This is the one redirect where changing the method is the specified behaviour, not a quirk. 303 versus the codes it gets confused with - 303 vs 302 Found — Historically clients turned a redirected POST into GET on 302 too, but only by accident. 303 says it on purpose. - 303 vs 307 Temporary Redirect — 307 is the opposite instruction: repeat the same method and body at the new URL. Endpoints that return 303 1 endpoint in this playground answers with 303. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 303 - What is Post/Redirect/Get?: Answering a successful POST with 303 to a page that shows the result, so the browser's history holds a GET. Reloading then re-fetches the result instead of re-posting the form. - Is a 303 cacheable?: The 303 itself is not cacheable by default, but the resource it points to can be. Other redirection codes - 300 Multiple Choices - 301 Moved Permanently - 302 Found - 304 Not Modified - 307 Temporary Redirect - 308 Permanent Redirect All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/304 TITLE: HTTP 304 Not Modified — Live Example | Fun API Playground ================================================================ HTTP 304 Not Modified The answer to a conditional GET whose If-None-Match matched the current ETag: your cached copy is still valid, so no body is sent. Defined in RFC 9110 §15.4.5 — 304 Not Modified · MDN reference On this page - Where you meet HTTP 304 in production - Why you would test it - What your client should do about a 304 - 304 versus the codes it gets confused with - Endpoints that return 304 - Questions about HTTP 304 - Other redirection codes Where you meet HTTP 304 in production Every well-cached asset and API response with a validator. It is the code behind most of the bandwidth a busy site does not spend. Why you would test it The cheapest performance win most clients never claim. Test that you store the ETag, send it back, and treat the empty 304 body as a cache hit rather than an error. What your client should do about a 304 A 304 has no body, and that is the point — serve the cached copy. Send back exactly the validator you were given: the ETag in If-None-Match, or the Last-Modified date in If-Modified-Since. Do not synthesise a validator, and do not strip the quotes or weak-prefix off an ETag. 304 versus the codes it gets confused with - 304 vs 200 OK — A 200 to a conditional request means the representation changed and here is the new one. - 304 vs 412 Precondition Failed — Both compare validators. 304 answers a read — "you already have it". 412 refuses a write — "what you have is out of date". Endpoints that return 304 4 endpoints in this playground answer with 304. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/football/v1/standings — Not Modified — If-None-Match matched the current etag (Football API) Open & run this endpoint - GET https://funapi.dev/api/bank/v1/exchange-rates — On the live API: repeat with If-None-Match: "rates-v1" (Bank API) Open & run this endpoint - GET https://funapi.dev/api/fiba/v1/groups/{letter}/standings — Not Modified — If-None-Match matched (FIBA World Cup API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 304 - Why is my conditional request always returning 200?: Usually the validator is not being echoed exactly, or the server generates a fresh ETag per response. Compare the ETag you received with the one you sent, byte for byte. - Does a 304 count against a rate limit?: That is the server's choice, but a well-built API charges less for one, because it did less work. Other redirection codes - 300 Multiple Choices - 301 Moved Permanently - 302 Found - 303 See Other - 307 Temporary Redirect - 308 Permanent Redirect All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/307 TITLE: HTTP 307 Temporary Redirect — Live Example | Fun API ================================================================ HTTP 307 Temporary Redirect The resource is temporarily at another URL; repeat the same request — same method, same body — there, and keep using the original URL afterwards. Defined in RFC 9110 §15.4.8 — 307 Temporary Redirect · MDN reference On this page - Where you meet HTTP 307 in production - Why you would test it - What your client should do about a 307 - 307 versus the codes it gets confused with - Endpoints that return 307 - Questions about HTTP 307 - Other redirection codes Where you meet HTTP 307 in production Temporary moves where the method matters: an API failing over to another region, a load balancer bouncing an upload, HSTS upgrades in browsers (shown as an internal 307). Why you would test it Test a redirected POST: the body has to arrive at the new location intact. Clients that rebuild the request from scratch often drop it. What your client should do about a 307 Re-send the identical request to Location. Do not update bookmarks or stored URLs — it is temporary. Be wary of following a 307 that carries credentials to a different host. 307 versus the codes it gets confused with - 307 vs 302 Found — 302 permitted clients to switch POST to GET, and most did. 307 forbids it. - 307 vs 308 Permanent Redirect — 308 is the permanent version: same rule about the method, but update your stored URL. Endpoints that return 307 1 endpoint in this playground answers with 307. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 307 - Why do I see a 307 in Chrome when I typed http://?: That is HSTS: the browser upgrades to https internally and reports it as a 307 "Internal Redirect". No request reached the server. - Does fetch() follow a 307 POST?: Yes, with the same method and body, as long as the body can be replayed (a stream cannot). Other redirection codes - 300 Multiple Choices - 301 Moved Permanently - 302 Found - 303 See Other - 304 Not Modified - 308 Permanent Redirect All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/308 TITLE: HTTP 308 Permanent Redirect — Live Example | Fun API ================================================================ HTTP 308 Permanent Redirect The resource has moved permanently to the URL in Location; repeat the same request there, method and body unchanged, and use the new URL from now on. Defined in RFC 9110 §15.4.9 — 308 Permanent Redirect · MDN reference On this page - Where you meet HTTP 308 in production - Why you would test it - What your client should do about a 308 - 308 versus the codes it gets confused with - Endpoints that return 308 - Questions about HTTP 308 - Other redirection codes Where you meet HTTP 308 in production Permanent moves of APIs and upload endpoints where a POST or PUT must not degrade to GET — and increasingly for any permanent move, since it removes the ambiguity 301 carries. Why you would test it The redirect to test when you move an endpoint that accepts writes. Check the client follows it with the body intact and, ideally, logs that its configured URL is stale. What your client should do about a 308 Re-send the identical request to Location and update the stored URL. Search engines treat it like 301 for ranking purposes. 308 versus the codes it gets confused with - 308 vs 301 Moved Permanently — Both are permanent. 301 historically let clients change POST to GET; 308 does not. - 308 vs 307 Temporary Redirect — 307 is the temporary version: keep using the original URL. Endpoints that return 308 1 endpoint in this playground answers with 308. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 308 - 301 or 308 for an API move?: 308 when the endpoint accepts anything other than GET — it guarantees the method and body survive. For pages that are only ever fetched with GET, they behave the same. - Is 308 cacheable?: Yes, by default, like 301. Other redirection codes - 300 Multiple Choices - 301 Moved Permanently - 302 Found - 303 See Other - 304 Not Modified - 307 Temporary Redirect All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/400 TITLE: HTTP 400 Bad Request — Live Example | Fun API Playground ================================================================ HTTP 400 Bad Request The server could not understand the request — malformed JSON, a missing required field, or a parameter of the wrong type. Defined in RFC 9110 §15.5.1 — 400 Bad Request · MDN reference On this page - Where you meet HTTP 400 in production - Why you would test it - What your client should do about a 400 - 400 versus the codes it gets confused with - Endpoints that return 400 - Questions about HTTP 400 - Other client error codes Where you meet HTTP 400 in production Malformed JSON, a query parameter of the wrong type, a missing required field, a payload the parser cannot make sense of at all. Why you would test it The baseline negative test. It is also the code most often used where 422 would be more accurate, so check which one your API actually sends. What your client should do about a 400 Never retry a 400 unchanged — the request is wrong and will be wrong the second time. Surface the server's error detail rather than a generic failure message; the whole value of a 400 is that it says what it did not understand. 400 versus the codes it gets confused with - 400 vs 422 Unprocessable Content — 400 means the request could not be parsed or is structurally invalid. 422 means it parsed fine but the content is not acceptable — a well-formed date in a field that requires a future date. - 400 vs 404 Not Found — An id that does not exist is a 404. An id that is not a number when a number is required is a 400. Endpoints that return 400 106 endpoints in this playground answer with 400. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/friends/v1/characters — Invalid page parameter, or an unknown query parameter (strict mode) (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/characters/{id} — Invalid id (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters — Missing name / invalid JSON (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters/bulk — Body is not a JSON array (Friends API) Open & run this endpoint - PUT https://funapi.dev/api/friends/v1/characters/{id} — Empty body / invalid JSON (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters/bulk-delete — "ids" is missing, empty, or not an array of integers (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/episodes — Non-integer season (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v2/characters — Invalid page parameter (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/graphql — Missing "query" string, or completely unrecognized syntax (Friends API) Open & run this endpoint - GET https://funapi.dev/api/superheroes/v1/heroes — Invalid page (Superhero API) Open & run this endpoint - POST https://funapi.dev/api/superheroes/v1/heroes — Missing name or power (Superhero API) Open & run this endpoint - POST https://funapi.dev/api/superheroes/v1/heroes/versus — Same hero twice or unknown id (Superhero API) Open & run this endpoint - GET https://funapi.dev/api/pizza/v1/menu — Invalid vegetarian value (Pizza Orders API) Open & run this endpoint - POST https://funapi.dev/api/pizza/v1/orders — Unknown pizzaId, bad size, or missing address (Pizza Orders API) Open & run this endpoint - PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Invalid status value (Pizza Orders API) Open & run this endpoint - PATCH https://funapi.dev/api/pizza/v1/orders/{id} — Empty body, invalid JSON, or bad size (Pizza Orders API) Open & run this endpoint - GET https://funapi.dev/api/coffee/v1/drinks — Invalid type (Coffee Shop API) Open & run this endpoint - POST https://funapi.dev/api/coffee/v1/orders — Unknown drinkId or missing name (Coffee Shop API) Open & run this endpoint - GET https://funapi.dev/api/football/v1/teams — Invalid page (Football API) Open & run this endpoint - POST https://funapi.dev/api/football/v1/matches — Same team twice or unknown team (Football API) Open & run this endpoint - GET https://funapi.dev/api/movies/v1/movies — Invalid sort or page, or an unknown query parameter (strict mode) (Movies API) Open & run this endpoint - GET https://funapi.dev/api/movies/v1/search/fuzzy — Missing "q" or invalid maxDistance (Movies API) Open & run this endpoint - POST https://funapi.dev/api/movies/v1/movies — Missing title (Movies API) Open & run this endpoint - PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — Rating outside the inclusive 0–10 range (Movies API) Open & run this endpoint - POST https://funapi.dev/api/movies/v1/movies/{id}/poster — Missing filename or sizeBytes (Movies API) Open & run this endpoint …and 81 more endpoints across the catalog. Questions about HTTP 400 - Is 400 a catch-all for client errors?: It is often used that way, but a specific code — 401, 403, 404, 409, 422 — tells the caller far more, and lets their client behave differently for each. - Should a 400 have a body?: Yes. A 400 with no explanation makes the caller guess, and guessing is how retries begin. Other client error codes - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/401 TITLE: HTTP 401 Unauthorized — Live Example | Fun API Playground ================================================================ HTTP 401 Unauthorized Authentication is missing or invalid. Despite the name, this is about identity, not permission — the server does not know who you are. Defined in RFC 9110 §15.5.2 — 401 Unauthorized · MDN reference On this page - Where you meet HTTP 401 in production - Why you would test it - What your client should do about a 401 - 401 versus the codes it gets confused with - Endpoints that return 401 - Questions about HTTP 401 - Other client error codes Where you meet HTTP 401 in production A missing Authorization header, an expired access token, a signature that does not verify, a session that has been revoked. Why you would test it Test the missing-header case and the invalid-token case separately. They are different bugs and they fail in different places. What your client should do about a 401 A 401 means "authenticate and try again" — refresh the token once and retry, then stop. A refresh loop that never gives up is how a single expired credential becomes a sustained load spike. A compliant server sends a WWW-Authenticate header telling you which scheme it wants. 401 versus the codes it gets confused with - 401 vs 403 Forbidden — This is the pair people get wrong most. 401 means the server does not know who you are. 403 means it knows exactly who you are and the answer is still no. - 401 vs 419 — Some frameworks invent codes for expired sessions. 401 with a clear error body is the standard answer. Endpoints that return 401 89 endpoints in this playground answer with 401. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/friends/v1/characters — Missing or invalid token (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters/bulk — Missing or invalid token (Friends API) Open & run this endpoint - PUT https://funapi.dev/api/friends/v1/characters/{id} — Missing or invalid token (Friends API) Open & run this endpoint - POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Missing or invalid token (Friends API) Open & run this endpoint - DELETE https://funapi.dev/api/friends/v1/characters/{id} — Missing or invalid token (Friends API) Open & run this endpoint - POST https://funapi.dev/api/superheroes/v1/heroes — Missing or invalid token (Superhero API) Open & run this endpoint - DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Missing or invalid token (Superhero API) Open & run this endpoint - POST https://funapi.dev/api/superheroes/v1/heroes/versus — Missing or invalid token (Superhero API) Open & run this endpoint - PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Missing or invalid token (Pizza Orders API) Open & run this endpoint - POST https://funapi.dev/api/football/v1/matches — Missing or invalid token (Football API) Open & run this endpoint - DELETE https://funapi.dev/api/football/v1/teams/{id} — Missing or invalid token (Football API) Open & run this endpoint - POST https://funapi.dev/api/movies/v1/movies — Missing or invalid token (Movies API) Open & run this endpoint - PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — Missing or invalid token (Movies API) Open & run this endpoint - DELETE https://funapi.dev/api/movies/v1/movies/{id} — Missing or invalid token (Movies API) Open & run this endpoint - POST https://funapi.dev/api/movies/v1/movies/{id}/poster — Missing or invalid token (Movies API) Open & run this endpoint - POST https://funapi.dev/api/wizarding/v1/students — Missing or invalid token (Harry Potter API) Open & run this endpoint - PUT https://funapi.dev/api/wizarding/v1/students/{id} — Missing or invalid token (Harry Potter API) Open & run this endpoint - DELETE https://funapi.dev/api/wizarding/v1/students/{id} — Missing or invalid token (Harry Potter API) Open & run this endpoint - POST https://funapi.dev/api/galaxy/v1/characters — Missing or invalid token (Star Wars API) Open & run this endpoint - PUT https://funapi.dev/api/galaxy/v1/characters/{id} — Missing or invalid token (Star Wars API) Open & run this endpoint - DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Missing or invalid token (Star Wars API) Open & run this endpoint - POST https://funapi.dev/api/holmes/v1/suspects — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint - PUT https://funapi.dev/api/holmes/v1/suspects/{id} — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint - DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint - PATCH https://funapi.dev/api/holmes/v1/cases/{id} — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint …and 64 more endpoints across the catalog. Questions about HTTP 401 - Why is it called Unauthorized when it means unauthenticated?: A naming mistake in the original specification that is now permanent. Read 401 as "unauthenticated". - Should I retry after a 401?: Once, after refreshing the credential. If the refreshed credential is also rejected, the problem is not transient. Other client error codes - 400 Bad Request - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/402 TITLE: HTTP 402 Payment Required — Live Example | Fun API ================================================================ HTTP 402 Payment Required Reserved in the original spec and now used in practice for quota, billing and insufficient-funds conditions. Defined in RFC 9110 §15.5.3 — 402 Payment Required · MDN reference On this page - Where you meet HTTP 402 in production - Why you would test it - What your client should do about a 402 - 402 versus the codes it gets confused with - Endpoints that return 402 - Questions about HTTP 402 - Other client error codes Where you meet HTTP 402 in production Rare in public APIs and increasingly common in SaaS ones: an exhausted quota, an unpaid invoice, a feature behind a plan the caller is not on. Why you would test it Rare enough that most clients have never seen one, which is exactly why it is worth provoking before a payment provider sends you one in production. What your client should do about a 402 Never retry. A 402 is resolved by a human doing something commercial, not by the client trying again. Surface the message and the upgrade path; a retry loop here just burns quota that is already exhausted. 402 versus the codes it gets confused with - 402 vs 403 Forbidden — 403 is a permissions decision. 402 is a billing one — the same account with the same role would succeed on a different plan. - 402 vs 429 Too Many Requests — 429 is "too fast, slow down". 402 is "you have used your allowance for the period". Endpoints that return 402 7 endpoints in this playground answer with 402. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/bank/v1/transfers — Insufficient funds (Bank API) Open & run this endpoint - GET https://funapi.dev/api/bank/v1/premium/statements — Always. Payment Required on demand, like the pizza oven’s 500. (Bank API) Open & run this endpoint - GET https://funapi.dev/api/fiba/v1/players/{id}/advanced — Payment Required (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/gta/v1/vehicles/{id}/respray — Not enough cash (GTA API) Open & run this endpoint - POST https://funapi.dev/api/gta/v1/weapons/{id}/buy — Not enough cash (GTA API) Open & run this endpoint - DELETE https://funapi.dev/api/gta/v1/wanted — Not enough cash (GTA API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 402 - Is 402 actually used?: It was reserved for future use for decades, but plan-limited APIs have made it genuinely common. - What should a 402 body contain?: What limit was hit, what the current plan allows, and where to change it. Other client error codes - 400 Bad Request - 401 Unauthorized - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/403 TITLE: HTTP 403 Forbidden — Live Example | Fun API Playground ================================================================ HTTP 403 Forbidden The server knows who you are and is refusing anyway. Authentication succeeded; authorization did not. Defined in RFC 9110 §15.5.4 — 403 Forbidden · MDN reference On this page - Where you meet HTTP 403 in production - Why you would test it - What your client should do about a 403 - 403 versus the codes it gets confused with - Endpoints that return 403 - Questions about HTTP 403 - Other client error codes Where you meet HTTP 403 in production A reader trying to write, a tenant reaching for another tenant's data, a request from a blocked region, a valid token missing a scope. Why you would test it The 401-versus-403 distinction is the single most common auth bug. Test the same endpoint with no token, a valid read-only token and an admin token, and assert all three. What your client should do about a 403 Do not retry, and do not re-authenticate — the credential is fine. Re-authenticating on a 403 is a common and costly bug: it turns a clean permission error into a login storm. Show the user what they lack, or fail the operation. 403 versus the codes it gets confused with - 403 vs 401 Unauthorized — 401 is about identity, 403 is about permission. If refreshing the token could conceivably help, it was a 401. - 403 vs 404 Not Found — Some APIs answer 404 instead of 403 deliberately, so that the existence of a resource is not leaked to someone not allowed to see it. Both are defensible; be deliberate about which you use. Endpoints that return 403 25 endpoints in this playground answer with 403. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Viewer token not allowed (Friends API) Open & run this endpoint - DELETE https://funapi.dev/api/friends/v1/characters/{id} — Viewer token not allowed (Friends API) Open & run this endpoint - DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Viewer token not allowed (Superhero API) Open & run this endpoint - DELETE https://funapi.dev/api/football/v1/teams/{id} — Viewer token not allowed (Football API) Open & run this endpoint - DELETE https://funapi.dev/api/movies/v1/movies/{id} — Viewer token not allowed (Movies API) Open & run this endpoint - DELETE https://funapi.dev/api/wizarding/v1/students/{id} — Viewer token not allowed (Harry Potter API) Open & run this endpoint - DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Viewer token not allowed (Star Wars API) Open & run this endpoint - DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Viewer token not allowed (Sherlock Holmes API) Open & run this endpoint - DELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — Viewer token not allowed (Pokémon API) Open & run this endpoint - DELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — Viewer token not allowed (Middle-earth API) Open & run this endpoint - DELETE https://funapi.dev/api/webhooks/v1/subscriptions/{id} — Viewer token not allowed (Webhooks API) Open & run this endpoint - DELETE https://funapi.dev/api/office/v1/employees/{id} — Viewer token not allowed (The Office API) Open & run this endpoint - DELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — Viewer token not allowed (Dino Park API) Open & run this endpoint - DELETE https://funapi.dev/api/marvel/v1/heroes/{id} — Viewer token not allowed (Marvel API) Open & run this endpoint - POST https://funapi.dev/api/got/v1/nobles/{id}/kill — Viewer token not allowed (Game of Thrones API) Open & run this endpoint - DELETE https://funapi.dev/api/rickandmorty/v1/characters/{id} — Viewer token not allowed (Rick and Morty API) Open & run this endpoint - POST https://funapi.dev/api/bank/v1/accounts/{id}/freeze — Viewer token not allowed (Bank API) Open & run this endpoint - DELETE https://funapi.dev/api/airline/v1/bookings/{id} — Viewer token not allowed (Airline API) Open & run this endpoint - DELETE https://funapi.dev/api/protocol/v1/documents/{id} — Viewer token not allowed (Protocol Lab API) Open & run this endpoint - POST https://funapi.dev/api/space/v1/launches/{id}/launch — Viewer token cannot push the big red button (Space Agency API) Open & run this endpoint - DELETE https://funapi.dev/api/starfleet/v1/crew/{id} — Viewer token not allowed (Starfleet API) Open & run this endpoint - POST https://funapi.dev/api/starfleet/v1/tribbles/purge — Viewer token not allowed (Starfleet API) Open & run this endpoint - PUT https://funapi.dev/api/fiba/v1/teams/{id}/staff — Viewer token not allowed (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/fiba/v1/games/{id}/simulate — Viewer token not allowed (FIBA World Cup API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 403 - Should a 403 explain why?: Enough for a legitimate caller to act on, and no more — an over-detailed 403 can leak the shape of the permission model. - Can a 403 ever be fixed by retrying?: Only if permissions changed in between. As a client behaviour, treat it as terminal. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/404 TITLE: HTTP 404 Not Found — Live Example | Fun API Playground ================================================================ HTTP 404 Not Found There is no resource at this URL. The server will not say whether there ever was one. Defined in RFC 9110 §15.5.5 — 404 Not Found · MDN reference On this page - Where you meet HTTP 404 in production - Why you would test it - What your client should do about a 404 - 404 versus the codes it gets confused with - Endpoints that return 404 - Questions about HTTP 404 - Other client error codes Where you meet HTTP 404 in production Deleted records, mistyped ids, a page past the end of a collection, a route that no longer exists after a refactor. Why you would test it Test both halves: an id that never existed, and one that was deleted. Also check that a filter matching nothing returns an empty 200 rather than a 404. What your client should do about a 404 Do not retry. Distinguish "this id does not exist" from "this endpoint does not exist" — they are the same status and completely different bugs. If your client cannot tell them apart, an API rename will look like missing data for as long as it takes someone to open the network tab. 404 versus the codes it gets confused with - 404 vs 410 Gone — 410 says it existed and is deliberately gone, permanently. 404 leaves open the possibility it never existed or may come back. - 404 vs 400 Bad Request — A structurally invalid id is a 400. A well-formed id with nothing behind it is a 404. Endpoints that return 404 170 endpoints in this playground answer with 404. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/friends/v1/characters — Page out of range (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/characters/{id} — Unknown id (Friends API) Open & run this endpoint - PUT https://funapi.dev/api/friends/v1/characters/{id} — Unknown id (Friends API) Open & run this endpoint - DELETE https://funapi.dev/api/friends/v1/characters/{id} — Unknown id (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v1/characters/{id}/quotes — Unknown character (Friends API) Open & run this endpoint - GET https://funapi.dev/api/friends/v2/characters — Page out of range (Friends API) Open & run this endpoint - GET https://funapi.dev/api/superheroes/v1/heroes — Page out of range (Superhero API) Open & run this endpoint - GET https://funapi.dev/api/superheroes/v1/heroes/{id} — Unknown id (Superhero API) Open & run this endpoint - GET https://funapi.dev/api/superheroes/v1/heroes/{id}/nemesis — Unknown hero or no nemesis (Superhero API) Open & run this endpoint - DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Unknown id (Superhero API) Open & run this endpoint - GET https://funapi.dev/api/pizza/v1/orders/{id} — Unknown order (Pizza Orders API) Open & run this endpoint - PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Unknown order (Pizza Orders API) Open & run this endpoint - PATCH https://funapi.dev/api/pizza/v1/orders/{id} — Unknown order (Pizza Orders API) Open & run this endpoint - DELETE https://funapi.dev/api/pizza/v1/orders/{id} — Unknown order (Pizza Orders API) Open & run this endpoint - GET https://funapi.dev/api/coffee/v1/drinks/{id} — Unknown id (Coffee Shop API) Open & run this endpoint - PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — Unknown order (Coffee Shop API) Open & run this endpoint - GET https://funapi.dev/api/football/v1/teams — Page out of range (Football API) Open & run this endpoint - GET https://funapi.dev/api/football/v1/teams/{id} — Unknown id (Football API) Open & run this endpoint - GET https://funapi.dev/api/football/v1/teams/{id}/players — Unknown team (Football API) Open & run this endpoint - GET https://funapi.dev/api/football/v1/teams/{id}/matches — Unknown team (Football API) Open & run this endpoint - DELETE https://funapi.dev/api/football/v1/teams/{id} — Unknown id (Football API) Open & run this endpoint - GET https://funapi.dev/api/movies/v1/movies — Page out of range (Movies API) Open & run this endpoint - GET https://funapi.dev/api/movies/v1/movies/{id} — Unknown id (Movies API) Open & run this endpoint - PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — Unknown id (Movies API) Open & run this endpoint - DELETE https://funapi.dev/api/movies/v1/movies/{id} — Unknown id (Movies API) Open & run this endpoint …and 145 more endpoints across the catalog. Questions about HTTP 404 - Should an empty list be a 404?: No. A collection with no matching items is a 200 with an empty array — the collection exists. - Is it acceptable to return 404 instead of 403?: Yes, as a deliberate choice to avoid confirming that a resource exists to someone not allowed to know. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/405 TITLE: HTTP 405 Method Not Allowed — Live Example | Fun API ================================================================ HTTP 405 Method Not Allowed The URL exists but not with this method. The response must include an Allow header listing what is permitted. Defined in RFC 9110 §15.5.6 — 405 Method Not Allowed · MDN reference On this page - Where you meet HTTP 405 in production - Why you would test it - What your client should do about a 405 - 405 versus the codes it gets confused with - Endpoints that return 405 - Questions about HTTP 405 - Other client error codes Where you meet HTTP 405 in production A DELETE against a read-only collection, a POST to a URL that only supports GET, a client that has drifted from the API it was written against. Why you would test it Read the Allow header rather than guessing. It is the machine-readable answer to "what can I do with this resource?". What your client should do about a 405 Read the Allow header — a compliant 405 lists the methods that would have worked, which is the fastest route from the error to the fix. Never retry with the same method. 405 versus the codes it gets confused with - 405 vs 404 Not Found — A 404 means the path is unknown. A 405 means the path is known and the verb is not supported on it. - 405 vs 501 Not Implemented — 501 means the server does not implement the method at all, anywhere. 405 is about this resource. Endpoints that return 405 2 endpoints in this playground answer with 405. Every one is free, needs no signup, and can be called from the browser or with curl. - DELETE https://funapi.dev/api/pizza/v1/menu — Always. GET is the only supported method on /menu. (Pizza Orders API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 405 - Is the Allow header required?: Yes — the specification requires a 405 to include it. Many servers omit it anyway, which is worth checking for in a contract test. - Why do I get 405 on OPTIONS?: Usually a CORS preflight hitting a server that has no OPTIONS handler. It surfaces in the browser as a CORS failure rather than as the 405 it is. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 406 Not Acceptable - 407 Proxy Authentication Required - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/406 TITLE: HTTP 406 Not Acceptable — Live Example | Fun API Playground ================================================================ HTTP 406 Not Acceptable The server cannot produce a representation matching your Accept header. Defined in RFC 9110 §15.5.7 — 406 Not Acceptable · MDN reference On this page - Where you meet HTTP 406 in production - Why you would test it - What your client should do about a 406 - 406 versus the codes it gets confused with - Endpoints that return 406 - Questions about HTTP 406 - Other client error codes Where you meet HTTP 406 in production Content negotiation that cannot be satisfied — a client asking for text/csv from an endpoint that only speaks JSON, or a version in an Accept header the server has retired. Why you would test it Worth provoking if your client sends a narrow Accept header, because the failure looks like a server fault and is actually a negotiation failure. What your client should do about a 406 Do not retry with the same Accept header. Either fall back to a type the server does offer, or fail with a message naming what you asked for. A 406 that a client turns into "server error" wastes an on-call engineer's evening on a header. 406 versus the codes it gets confused with - 406 vs 415 Unsupported Media Type — The mirror image. 415 is about the type you *sent* (Content-Type). 406 is about the type you *asked for* (Accept). - 406 vs 400 Bad Request — A malformed Accept header is a 400. A well-formed one the server cannot satisfy is a 406. Endpoints that return 406 3 endpoints in this playground answer with 406. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/friends/characters — Accept header requests an unsupported media type (Friends API) Open & run this endpoint - GET https://funapi.dev/api/protocol/v1/export/documents — Unsupported Accept value (Protocol Lab API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 406 - Is it better to return 406 or just ignore the Accept header?: Many APIs serve JSON regardless, which is pragmatic but hides a client bug. 406 is the honest answer. - Does Accept: */* ever produce a 406?: It should not — it means the client will take anything. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 407 Proxy Authentication Required - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/407 TITLE: HTTP 407 Proxy Authentication Required | Fun API ================================================================ HTTP 407 Proxy Authentication Required A proxy between you and the server needs credentials before it will forward the request. It names the scheme it wants in Proxy-Authenticate. Defined in RFC 9110 §15.5.8 — 407 Proxy Authentication Required · MDN reference On this page - Where you meet HTTP 407 in production - Why you would test it - What your client should do about a 407 - 407 versus the codes it gets confused with - Endpoints that return 407 - Questions about HTTP 407 - Other client error codes Where you meet HTTP 407 in production Corporate and school networks with authenticating forward proxies; CI runners behind one; package managers failing to download for no apparent reason. Why you would test it Mostly a test of environment rather than code: what does your client do on a corporate network? Make sure the error it shows mentions the proxy, not the API. What your client should do about a 407 Do not retry with the API's credentials — they go in Authorization, the proxy wants Proxy-Authorization. Most HTTP clients read proxy credentials from configuration or environment (HTTPS_PROXY with user:pass), not from code. 407 versus the codes it gets confused with - 407 vs 401 Unauthorized — 401 comes from the server you are calling. 407 comes from a proxy in front of it. - 407 vs 511 Network Authentication Required — 511 is a captive portal — the network wants you to log in through a web page, not to send a header. Endpoints that return 407 1 endpoint in this playground answers with 407. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 407 - Why do I get 407 only on one machine?: Because that machine is behind an authenticating proxy and the others are not, or its proxy credentials are missing or expired. - Which header carries proxy credentials?: Proxy-Authorization. It is consumed by the proxy and never forwarded to the server. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 408 Request Timeout All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/408 TITLE: HTTP 408 Request Timeout — Live Example | Fun API Playground ================================================================ HTTP 408 Request Timeout The server gave up waiting for the client to finish sending the request, and has closed (or will close) the connection. Defined in RFC 9110 §15.5.9 — 408 Request Timeout · MDN reference On this page - Where you meet HTTP 408 in production - Why you would test it - What your client should do about a 408 - 408 versus the codes it gets confused with - Endpoints that return 408 - Questions about HTTP 408 - Other client error codes Where you meet HTTP 408 in production Idle keep-alive connections that a server or load balancer closes, slow mobile uploads, and clients that open a connection and never send. Browsers often retry silently after one. Why you would test it Simulates a slow or stalled upload. The thing to test is whether your client retries automatically — for an idempotent request it may, for a POST it must not without an idempotency key. What your client should do about a 408 A 408 means the request was not processed, so retrying is generally safe — the server says it did not act on it. Retry on a fresh connection. If it recurs, the problem is upload speed or a client that stalls mid-body. 408 versus the codes it gets confused with - 408 vs 504 Gateway Timeout — 504 is the server side waiting too long for an upstream. 408 is the server waiting too long for you. - 408 vs 499 — 499 is nginx's non-standard log code for "the client closed the connection first" — the mirror image of 408. Endpoints that return 408 1 endpoint in this playground answers with 408. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 408 - Is it safe to retry a 408?: Generally yes — the server is stating it did not process the request. Retry on a new connection. - Why do I see 408 without sending anything?: Some servers send it when they close an idle keep-alive connection, so a client that reuses that connection reads a 408 it did not cause. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/409 TITLE: HTTP 409 Conflict — Live Example | Fun API Playground ================================================================ HTTP 409 Conflict The request is valid but clashes with the current state — a duplicate, a seat already taken, a state transition that is not allowed from here. Defined in RFC 9110 §15.5.10 — 409 Conflict · MDN reference On this page - Where you meet HTTP 409 in production - Why you would test it - What your client should do about a 409 - 409 versus the codes it gets confused with - Endpoints that return 409 - Questions about HTTP 409 - Other client error codes Where you meet HTTP 409 in production Double-booked seats, duplicate usernames, deleting a record that something else still points at, cancelling an order that already shipped, and any state machine asked to make a transition it does not have. Why you would test it A 409 is a state problem, not a transport problem, so blind retries make it worse. Test that your retry policy distinguishes it from a 503. What your client should do about a 409 A 409 is about state, so a blind retry usually fails identically — the seat is still taken. Re-read the current state, decide whether the operation still makes sense, and only then try again. This is the status where an automatic retry policy does the most damage for the least benefit. 409 versus the codes it gets confused with - 409 vs 412 Precondition Failed — 412 is a conflict the client explicitly asked to be checked, by sending a validator. 409 is a conflict the server detected on its own. - 409 vs 422 Unprocessable Content — 422 rejects the content of the request. 409 accepts the content and rejects it against the current state of the resource. Endpoints that return 409 47 endpoints in this playground answer with 409. Every one is free, needs no signup, and can be called from the browser or with curl. - DELETE https://funapi.dev/api/pizza/v1/orders/{id} — Order already delivered — cannot cancel (Pizza Orders API) Open & run this endpoint - PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — Order is already ready (Coffee Shop API) Open & run this endpoint - DELETE https://funapi.dev/api/football/v1/teams/{id} — Team has played matches (Football API) Open & run this endpoint - PATCH https://funapi.dev/api/holmes/v1/cases/{id} — Case is already in that status (Sherlock Holmes API) Open & run this endpoint - POST https://funapi.dev/api/webhooks/v1/deliveries/{id}/replay — Max attempts (3) already reached (Webhooks API) Open & run this endpoint - POST https://funapi.dev/api/dinopark/v1/dinosaurs — Enclosure is at capacity (Dino Park API) Open & run this endpoint - POST https://funapi.dev/api/marvel/v1/missions/{id}/complete — Mission is already complete (Marvel API) Open & run this endpoint - POST https://funapi.dev/api/got/v1/nobles/{id}/kill — Noble is already dead (Game of Thrones API) Open & run this endpoint - POST https://funapi.dev/api/got/v1/battles — A house cannot fight itself (Game of Thrones API) Open & run this endpoint - POST https://funapi.dev/api/bank/v1/transfers — An account is frozen (Bank API) Open & run this endpoint - POST https://funapi.dev/api/bank/v1/accounts/{id}/freeze — Already frozen (Bank API) Open & run this endpoint - POST https://funapi.dev/api/airline/v1/bookings — Seat taken, flight cancelled, or flight full (overbooked) (Airline API) Open & run this endpoint - PUT https://funapi.dev/api/airline/v1/bookings/{id}/seat — Seat taken or booking checked-in (Airline API) Open & run this endpoint - POST https://funapi.dev/api/airline/v1/bookings/{id}/checkin — Already checked-in, or the flight is cancelled (Airline API) Open & run this endpoint - DELETE https://funapi.dev/api/airline/v1/bookings/{id} — Cannot cancel after check-in (Airline API) Open & run this endpoint - PATCH https://funapi.dev/api/protocol/v1/documents/{id} — A "test" operation failed (Protocol Lab API) Open & run this endpoint - POST https://funapi.dev/api/shop/v1/carts/{id}/items — Not enough stock (product 3 is always out) (Shop API) Open & run this endpoint - POST https://funapi.dev/api/shop/v1/carts/{id}/checkout — Cart already checked out, or stock ran out since adding (Shop API) Open & run this endpoint - POST https://funapi.dev/api/cargo/v1/shipments/{id}/advance — Shipment is in a terminal state (Cargo Tracking API) Open & run this endpoint - POST https://funapi.dev/api/cargo/v1/shipments/{id}/attempt-delivery — Not out-for-delivery (Cargo Tracking API) Open & run this endpoint - PUT https://funapi.dev/api/cargo/v1/shipments/{id}/address — Already delivered (Cargo Tracking API) Open & run this endpoint - POST https://funapi.dev/api/space/v1/launches/{id}/scrub — Already launched or already scrubbed (Space Agency API) Open & run this endpoint - POST https://funapi.dev/api/space/v1/launches/{id}/launch — Not scheduled, or an auto-abort at T-0 (~25% chance) (Space Agency API) Open & run this endpoint - GET https://funapi.dev/api/space/v1/launches/{id}/countdown — Launch is not scheduled (Space Agency API) Open & run this endpoint - POST https://funapi.dev/api/starfleet/v1/ships — A ship with that name already exists (Starfleet API) Open & run this endpoint …and 22 more endpoints across the catalog. Questions about HTTP 409 - Should a 409 body say what conflicted?: Yes, and specifically enough for the client to resolve it — "seat 14A is taken" beats "conflict". - Is a duplicate POST a 409?: 409 if the duplicate is genuinely unacceptable. If the caller sent an Idempotency-Key, replaying the original response is friendlier. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/410 TITLE: HTTP 410 Gone — Live Example | Fun API Playground ================================================================ HTTP 410 Gone The resource existed and has been permanently removed. Unlike a 404, the server is stating that it will not come back. Defined in RFC 9110 §15.5.11 — 410 Gone · MDN reference On this page - Where you meet HTTP 410 in production - Why you would test it - What your client should do about a 410 - 410 versus the codes it gets confused with - Endpoints that return 410 - Questions about HTTP 410 - Other client error codes Where you meet HTTP 410 in production Retired API versions, expired share links, records removed at a user's request, and endpoints deliberately sunset after a deprecation window — anywhere the absence is a decision rather than an accident. Why you would test it Most clients collapse 410 into 404 and keep retrying a URL that will never work again. Test it separately and stop retrying. What your client should do about a 410 Stop asking. A 410 is the server saying the URL will not come back, which means the right client behaviour is to remove it from whatever list keeps producing it — not to retry on a schedule. 410 versus the codes it gets confused with - 410 vs 404 Not Found — 404 is "not here". 410 is "not here, on purpose, and not coming back". Search engines drop a 410 faster than a 404. - 410 vs 301 Moved Permanently — If there is a replacement, redirect to it. 410 is for when there is not. Endpoints that return 410 9 endpoints in this playground answer with 410. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/airline/v1/bookings/{id} — Existed once, cancelled since — Gone (Airline API) Open & run this endpoint - GET https://funapi.dev/api/protocol/v1/documents/{id} — Deleted — Gone (Protocol Lab API) Open & run this endpoint - DELETE https://funapi.dev/api/protocol/v1/documents/{id} — Already deleted (Protocol Lab API) Open & run this endpoint - GET https://funapi.dev/api/shop/v1/coupons/{code} — Existed once, expired since (Shop API) Open & run this endpoint - GET https://funapi.dev/api/worldcup/v1/tickets/{id} — Order cancelled (World Cup 2026 API) Open & run this endpoint - DELETE https://funapi.dev/api/worldcup/v1/tickets/{id} — Already cancelled (World Cup 2026 API) Open & run this endpoint - GET https://funapi.dev/api/fiba/v1/tickets/{id} — Order was cancelled (FIBA World Cup API) Open & run this endpoint - DELETE https://funapi.dev/api/fiba/v1/tickets/{id} — Already cancelled (FIBA World Cup API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 410 - Do I have to use 410 instead of 404?: No, 404 is always acceptable. 410 is more informative when you know the removal is permanent. - Is 410 good for deprecating an API version?: Yes, after a deprecation window in which the endpoint still works and announces its end date. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/411 TITLE: HTTP 411 Length Required — Live Example | Fun API Playground ================================================================ HTTP 411 Length Required The server refuses a request with a body but no Content-Length header, because it will not accept a chunked or unbounded body. Defined in RFC 9110 §15.5.12 — 411 Length Required · MDN reference On this page - Where you meet HTTP 411 in production - Why you would test it - What your client should do about a 411 - 411 versus the codes it gets confused with - Endpoints that return 411 - Questions about HTTP 411 - Other client error codes Where you meet HTTP 411 in production Older servers, some object stores and signed-upload endpoints that need the size up front, for example to verify a signature or enforce a quota before reading. Why you would test it A test for clients that stream request bodies. Check what your HTTP library sends when the body is a stream of unknown length — it is usually chunked encoding, and some servers refuse it. What your client should do about a 411 Send Content-Length. Buffer the body, or compute its size before sending, instead of streaming it with Transfer-Encoding: chunked. Retrying the same streamed request will fail the same way. 411 versus the codes it gets confused with - 411 vs 413 Content Too Large — 413 means the body is too big. 411 means the server was not told how big it is. - 411 vs 400 Bad Request — A generic 400 is what many servers send instead of a precise 411. Endpoints that return 411 1 endpoint in this playground answers with 411. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 411 - When does a client omit Content-Length?: When it streams the body with chunked transfer encoding, which is the default in many libraries for streams and generators. - Does HTTP/2 need Content-Length?: No — frames carry lengths — but servers may still require the header for application reasons. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/412 TITLE: HTTP 412 Precondition Failed — Live Example | Fun API ================================================================ HTTP 412 Precondition Failed A condition in the request headers was not met — almost always an If-Match ETag that no longer reflects the current state of the resource. Defined in RFC 9110 §15.5.13 — 412 Precondition Failed · MDN reference On this page - Where you meet HTTP 412 in production - Why you would test it - What your client should do about a 412 - 412 versus the codes it gets confused with - Endpoints that return 412 - Questions about HTTP 412 - Other client error codes Where you meet HTTP 412 in production Optimistic concurrency — two people editing the same record, and the second write arriving with a version the server has already moved past. Why you would test it The core of optimistic concurrency. If you never see a 412 in testing, your client is probably not sending If-Match at all, and lost updates are going unnoticed. What your client should do about a 412 This is the code that stops a lost update, so treat it as a real outcome rather than an error. Re-fetch the resource, decide whether the change still applies to the new version, merge or prompt, and retry with the fresh ETag. Retrying with the same stale validator will produce the same 412 forever. 412 versus the codes it gets confused with - 412 vs 409 Conflict — Both are conflicts. 412 happens because the client asked for the check with If-Match; 409 happens without being asked. - 412 vs 304 Not Modified — Same machinery, opposite direction: 304 is a read that did not need to happen, 412 is a write that must not. Endpoints that return 412 32 endpoints in this playground answer with 412. Every one is free, needs no signup, and can be called from the browser or with curl. - PUT https://funapi.dev/api/friends/v1/characters/{id} — If-Match does not match current version (Friends API) Open & run this endpoint - DELETE https://funapi.dev/api/friends/v1/characters/{id} — If-Match does not match current version (Friends API) Open & run this endpoint - DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — If-Match does not match current version (Superhero API) Open & run this endpoint - PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — If-Match does not match current version (Pizza Orders API) Open & run this endpoint - PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — If-Match does not match current version (Coffee Shop API) Open & run this endpoint - DELETE https://funapi.dev/api/football/v1/teams/{id} — If-Match does not match current version (Football API) Open & run this endpoint - PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — If-Match does not match current version (Movies API) Open & run this endpoint - DELETE https://funapi.dev/api/movies/v1/movies/{id} — If-Match does not match current version (Movies API) Open & run this endpoint - PUT https://funapi.dev/api/wizarding/v1/students/{id} — If-Match does not match current version (Harry Potter API) Open & run this endpoint - DELETE https://funapi.dev/api/wizarding/v1/students/{id} — If-Match does not match current version (Harry Potter API) Open & run this endpoint - PUT https://funapi.dev/api/galaxy/v1/characters/{id} — If-Match does not match current version (Star Wars API) Open & run this endpoint - DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — If-Match does not match current version (Star Wars API) Open & run this endpoint - PUT https://funapi.dev/api/holmes/v1/suspects/{id} — If-Match does not match current version (Sherlock Holmes API) Open & run this endpoint - DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — If-Match does not match current version (Sherlock Holmes API) Open & run this endpoint - PUT https://funapi.dev/api/pokemon/v1/pokemon/{id} — If-Match does not match current version (Pokémon API) Open & run this endpoint - DELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — If-Match does not match current version (Pokémon API) Open & run this endpoint - PUT https://funapi.dev/api/middleearth/v1/fellowship/{id} — If-Match does not match current version (Middle-earth API) Open & run this endpoint - DELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — If-Match does not match current version (Middle-earth API) Open & run this endpoint - PUT https://funapi.dev/api/office/v1/employees/{id} — If-Match does not match current version (The Office API) Open & run this endpoint - DELETE https://funapi.dev/api/office/v1/employees/{id} — If-Match does not match current version (The Office API) Open & run this endpoint - PUT https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — If-Match does not match current version (Dino Park API) Open & run this endpoint - DELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — If-Match does not match current version (Dino Park API) Open & run this endpoint - PUT https://funapi.dev/api/marvel/v1/heroes/{id} — If-Match does not match current version (Marvel API) Open & run this endpoint - DELETE https://funapi.dev/api/marvel/v1/heroes/{id} — If-Match does not match current version (Marvel API) Open & run this endpoint - PUT https://funapi.dev/api/got/v1/nobles/{id} — If-Match does not match current version (Game of Thrones API) Open & run this endpoint …and 7 more endpoints across the catalog. Questions about HTTP 412 - How do I get the ETag to send?: From the ETag response header of a prior GET. Send it back verbatim in If-Match. - What is If-Match: * for?: It requires that the resource exists at all, without pinning a specific version. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/413 TITLE: HTTP 413 Content Too Large — Live Example | Fun API ================================================================ HTTP 413 Content Too Large The request body exceeds what the server will accept. Still widely known by its old reason phrase, Payload Too Large. Defined in RFC 9110 §15.5.14 — 413 Content Too Large · MDN reference RFC 7231 called this "Payload Too Large"; RFC 9110 renamed it. Both refer to the same code. On this page - Where you meet HTTP 413 in production - Why you would test it - What your client should do about a 413 - 413 versus the codes it gets confused with - Endpoints that return 413 - Questions about HTTP 413 - Other client error codes Where you meet HTTP 413 in production File uploads past a limit, oversized JSON payloads, batch requests with too many items — often enforced by a proxy before the application ever sees the request. Why you would test it Test at the boundary, not far past it. A client that streams uploads may fail differently from one that buffers. What your client should do about a 413 Do not retry the same payload. Compress it, chunk it, or reject it client-side with a clear message. Check the limit before uploading where the API publishes one; failing at the browser is far cheaper than failing after a 40 MB upload. 413 versus the codes it gets confused with - 413 vs 400 Bad Request — A 400 says the request was malformed. A 413 says it was well-formed and too big. - 413 vs 414 URI Too Long — 414 is specifically an over-long URI — usually a GET that should have been a POST. Endpoints that return 413 2 endpoints in this playground answer with 413. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/movies/v1/movies/{id}/poster — sizeBytes over the 5 MB limit (Movies API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 413 - Who enforces the limit?: Often a reverse proxy or gateway, which is why a 413 can arrive without any application log line to match it. - Can the server say what the limit is?: It should, in the body — and a Retry-After is appropriate if the limit is temporary. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/414 TITLE: HTTP 414 URI Too Long — Live Example | Fun API Playground ================================================================ HTTP 414 URI Too Long The request URI is longer than the server is willing to interpret, usually because too much data went into the query string. Defined in RFC 9110 §15.5.15 — 414 URI Too Long · MDN reference On this page - Where you meet HTTP 414 in production - Why you would test it - What your client should do about a 414 - 414 versus the codes it gets confused with - Endpoints that return 414 - Questions about HTTP 414 - Other client error codes Where you meet HTTP 414 in production Search and filter endpoints that put long lists of IDs in the query, GET requests that should have been POSTs, redirect loops that append to the URL each time, and SSO flows carrying large tokens. Why you would test it Generate a query string with thousands of IDs and see where your stack breaks. The limit is rarely the server's alone: proxies, CDNs and browsers each have one. What your client should do about a 414 Move the data into a request body — a POST to a search endpoint is the conventional answer. Do not split the request blindly; filters often have to apply together. 414 versus the codes it gets confused with - 414 vs 431 Request Header Fields Too Large — 431 is the headers being too large, including oversized cookies. 414 is the URL itself. - 414 vs 413 Content Too Large — 413 is the body. Moving data from the URL to the body can trade a 414 for a 413 if both are too large. Endpoints that return 414 1 endpoint in this playground answers with 414. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 414 - How long can a URL be?: HTTP sets no limit, but implementations do — commonly around 8 KB at servers and proxies. Keeping URLs under 2,000 characters is the long-standing safe choice. - Why did my redirect produce 414?: A redirect loop that appends a parameter on every hop grows the URL until something refuses it. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/415 TITLE: HTTP 415 Unsupported Media Type — Live Example | Fun API ================================================================ HTTP 415 Unsupported Media Type The body is in a format the endpoint does not accept — usually a Content-Type mismatch. Defined in RFC 9110 §15.5.16 — 415 Unsupported Media Type · MDN reference On this page - Where you meet HTTP 415 in production - Why you would test it - What your client should do about a 415 - 415 versus the codes it gets confused with - Endpoints that return 415 - Questions about HTTP 415 - Other client error codes Where you meet HTTP 415 in production Posting form-encoded data to a JSON-only endpoint, uploading a file type the server will not take, or omitting Content-Type entirely and having the server refuse to guess. Why you would test it Frequently caused by the client, not the server: a forgotten Content-Type header, or a form encoding where JSON was expected. What your client should do about a 415 Do not retry unchanged. Fix the Content-Type header or convert the payload. Most occurrences are a missing header rather than genuinely unsupported content, which makes it worth logging the header you actually sent. 415 versus the codes it gets confused with - 415 vs 406 Not Acceptable — The mirror image: 415 is about what you sent, 406 about what you asked to receive. - 415 vs 422 Unprocessable Content — 415 means the server will not parse this media type. 422 means it parsed it and disagreed with the contents. Endpoints that return 415 2 endpoints in this playground answer with 415. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/movies/v1/movies/{id}/poster — contentType is not an accepted image type (Movies API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 415 - Does the charset matter?: Sometimes. application/json and application/json; charset=utf-8 are treated as equivalent by most servers and as different by some strict ones. - What should the response include?: The media types that are supported — an Accept-Post header or a body listing them. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/416 TITLE: HTTP 416 Range Not Satisfiable — Live Example | Fun API ================================================================ HTTP 416 Range Not Satisfiable The Range header asks for bytes that do not exist — typically an offset past the end of the resource. Defined in RFC 9110 §15.5.17 — 416 Range Not Satisfiable · MDN reference On this page - Where you meet HTTP 416 in production - Why you would test it - What your client should do about a 416 - 416 versus the codes it gets confused with - Endpoints that return 416 - Questions about HTTP 416 - Other client error codes Where you meet HTTP 416 in production Resumable downloads restarting from an offset past the end of a file, usually after the file was replaced by a shorter one. Why you would test it The edge case of resumable transfers. A client that resumes from a stale offset lands here, and should restart rather than retry. What your client should do about a 416 Re-read the current length from the Content-Range header on the 416 response, then either restart the transfer or request a valid range. Retrying the same range is guaranteed to fail again. 416 versus the codes it gets confused with - 416 vs 206 Partial Content — 206 is the success case for the same request shape. - 416 vs 400 Bad Request — A syntactically invalid Range header is a 400; a valid one that does not overlap the resource is a 416. Endpoints that return 416 2 endpoints in this playground answer with 416. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/storage/v1/objects/{key} — Invalid range (Object Storage API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 416 - What does the 416 response tell me?: A compliant server includes Content-Range: bytes */, which is the current size — exactly what you need to correct the request. - Can a server ignore Range and send 200?: Yes, and it is legal. Clients must handle a full-body response to a ranged request. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/417 TITLE: HTTP 417 Expectation Failed — Live Example | Fun API ================================================================ HTTP 417 Expectation Failed The server cannot meet the expectation in the request's Expect header — in practice, Expect: 100-continue. Defined in RFC 9110 §15.5.18 — 417 Expectation Failed · MDN reference On this page - Where you meet HTTP 417 in production - Why you would test it - What your client should do about a 417 - 417 versus the codes it gets confused with - Endpoints that return 417 - Questions about HTTP 417 - Other client error codes Where you meet HTTP 417 in production Proxies and older servers that do not implement 100-continue, answering large POSTs from curl, .NET's HttpClient and similar clients that send the header automatically. Why you would test it Relevant if your client sends Expect: 100-continue before large uploads (curl does by default above a size threshold). Test it falls back to sending the body without the expectation. What your client should do about a 417 Retry without the Expect header and send the body straight away. Most clients can be configured to stop sending it — curl with -H "Expect:", for example. 417 versus the codes it gets confused with - 417 vs 100 — 100 Continue is the success case of the same handshake: the server says "go ahead, send the body". - 417 vs 400 Bad Request — Some servers answer an unsupported Expect with a plain 400 instead. Endpoints that return 417 1 endpoint in this playground answers with 417. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 417 - What is Expect: 100-continue for?: Letting a client ask "will you accept this?" before sending a large body, so a request that will be rejected does not waste the upload. - How do I stop curl sending it?: Add -H "Expect:" with an empty value. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/418 TITLE: HTTP 418 I'm a Teapot — Live Example | Fun API Playground ================================================================ HTTP 418 I'm a Teapot From the 1998 April Fools' hypertext coffee-pot spec. It is a real, registered code, and a teapot cannot brew coffee. Defined in RFC 9110 §15.5.19 — 418 (Unused) · MDN reference · RFC 2324 §2.3.2 — Hyper Text Coffee Pot Control Protocol RFC 9110 reserves 418 rather than defining it. The teapot comes from RFC 2324 §2.3.2, an April Fools' joke from 1998 that made the code permanently unusable for anything serious. On this page - Where you meet HTTP 418 in production - Why you would test it - What your client should do about a 418 - 418 versus the codes it gets confused with - Endpoints that return 418 - Questions about HTTP 418 - Other client error codes Where you meet HTTP 418 in production Nowhere, deliberately. It came out of an April Fools' RFC for coffee pots and survives as the canonical joke status — which makes it genuinely useful as an unmistakable marker in tests and health checks. Why you would test it Genuinely useful as a canary: pick a code nothing in your stack handles specially, and assert it survives your client, your proxy and your logging untouched. What your client should do about a 418 Treat it as an unexpected status: log it loudly and fail. Its practical value in a test suite is that no real error path produces it, so a 418 in a log is always the thing you put there on purpose. 418 versus the codes it gets confused with - 418 vs 400 Bad Request — If you need a real "I will not do this" for a client error, 400 or 422 is the honest code. - 418 vs 451 Unavailable For Legal Reasons — 451, for content blocked on legal grounds, is the other famous specialty code — and that one is entirely serious. Endpoints that return 418 2 endpoints in this playground answer with 418. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/coffee/v1/teapot — Always. It is, in fact, a teapot. (Coffee Shop API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 418 - Is 418 a real HTTP status code?: It is registered, and it is a joke — from RFC 2324, the Hyper Text Coffee Pot Control Protocol. Attempts to remove it have been resisted with some feeling. - Should I use 418 in production?: Not for anything a real client has to interpret. As a deliberate sentinel in test infrastructure, it is ideal. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/421 TITLE: HTTP 421 Misdirected Request — Live Example | Fun API ================================================================ HTTP 421 Misdirected Request The request reached a server that is not able to answer for the host it asked about, typically because an HTTP/2 connection was reused for the wrong origin. Defined in RFC 9110 §15.5.20 — 421 Misdirected Request · MDN reference On this page - Where you meet HTTP 421 in production - Why you would test it - What your client should do about a 421 - 421 versus the codes it gets confused with - Endpoints that return 421 - Questions about HTTP 421 - Other client error codes Where you meet HTTP 421 in production HTTP/2 and HTTP/3 connection coalescing: a browser reuses one connection for two hostnames covered by the same certificate, but the server behind it only serves one of them. Why you would test it Shows up only with connection reuse across hostnames that share a certificate and IP. The test is whether your client retries on a new connection, as it should. What your client should do about a 421 Retry the request on a fresh connection to the host. Browsers do this automatically; custom clients and proxies sometimes need to be told. 421 versus the codes it gets confused with - 421 vs 404 Not Found — 404 means the server is right and the resource is missing. 421 means the server is wrong for this host. - 421 vs 400 Bad Request — Some servers answer a host mismatch with 400 or 403 instead. Endpoints that return 421 1 endpoint in this playground answers with 421. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 421 - Why is 421 related to HTTP/2?: HTTP/2 lets clients reuse a connection for several hostnames; 421 is how a server says "not on this connection". - Is it safe to retry a 421?: Yes, on a new connection — the server did not process the request. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/422 TITLE: HTTP 422 Unprocessable Content — Live Example | Fun API ================================================================ HTTP 422 Unprocessable Content The syntax is fine and the server understood the request, but the content is semantically wrong — a valid date in the past where a future one is required, a transfer that would overdraw an account. Defined in RFC 9110 §15.5.21 — 422 Unprocessable Content · MDN reference Defined for WebDAV in RFC 4918 §11.2 as "Unprocessable Entity", then generalised and renamed by RFC 9110. On this page - Where you meet HTTP 422 in production - Why you would test it - What your client should do about a 422 - 422 versus the codes it gets confused with - Endpoints that return 422 - Questions about HTTP 422 - Other client error codes Where you meet HTTP 422 in production Validation failures: an email that is not an email, an end date before a start date, a quantity of zero on an order line, a field that is fine in isolation and wrong in context. Why you would test it The distinction from 400 is the point: 400 means "I could not read this", 422 means "I read it, and no". Clients should surface them to users differently. What your client should do about a 422 Do not retry. Map the per-field errors onto the form the user is looking at — this is the one error class where the API can tell the client exactly what to fix, and a client that flattens it to "invalid input" throws that away. 422 versus the codes it gets confused with - 422 vs 400 Bad Request — The distinction worth holding: 400 means the request could not be understood, 422 means it was understood and rejected. If a parser threw, it is a 400. - 422 vs 409 Conflict — 422 is about the request in isolation. 409 is about the request against the current state. Endpoints that return 422 24 endpoints in this playground answer with 422. Every one is free, needs no signup, and can be called from the browser or with curl. - POST https://funapi.dev/api/bank/v1/accounts — Negative opening deposit (Bank API) Open & run this endpoint - POST https://funapi.dev/api/bank/v1/transfers — Amount is not a positive number (Bank API) Open & run this endpoint - POST https://funapi.dev/api/shop/v1/carts/{id}/checkout — Coupon invalid or expired (Shop API) Open & run this endpoint - POST https://funapi.dev/api/worldcup/v1/matches/{id}/simulate — Knockout pairing not decided (World Cup 2026 API) Open & run this endpoint - GET https://funapi.dev/api/worldcup/v1/players/top-scorers — Invalid limit (World Cup 2026 API) Open & run this endpoint - POST https://funapi.dev/api/worldcup/v1/tickets — Invalid category or quantity (World Cup 2026 API) Open & run this endpoint - POST https://funapi.dev/api/worldcup/v1/predictions — Unknown team (World Cup 2026 API) Open & run this endpoint - PUT https://funapi.dev/api/fiba/v1/teams/{id}/staff — Missing coach, or a captain from another squad (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/fiba/v1/games/{id}/simulate — Knockout pairing not decided yet (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/fiba/v1/games/{id}/challenge — team must be home or away (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/fiba/v1/games/{id}/highlights — seconds must be 60, 120 or 300 (FIBA World Cup API) Open & run this endpoint - GET https://funapi.dev/api/fiba/v1/players/leaders — Unknown stat, or limit outside 1–20 (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/fiba/v1/tickets — Invalid tier or quantity (FIBA World Cup API) Open & run this endpoint - POST https://funapi.dev/api/gta/v1/vehicles/{id}/respray — Missing color (GTA API) Open & run this endpoint - POST https://funapi.dev/api/gta/v1/missions/{id}/start — Prerequisite not completed (GTA API) Open & run this endpoint - POST https://funapi.dev/api/gta/v1/heists — Invalid approach or crew size (GTA API) Open & run this endpoint - POST https://funapi.dev/api/dragonball/v1/fighters/{id}/power-up — Invalid amount (Dragon Ball API) Open & run this endpoint - POST https://funapi.dev/api/formula1/v1/races/{id}/pit-stops — Invalid pit stop (Formula 1 API) Open & run this endpoint - POST https://funapi.dev/api/anime/v1/fighters/{id}/transform — Invalid multiplier (Anime Tournament API) Open & run this endpoint - PUT https://funapi.dev/api/storage/v1/objects/{key} — Invalid base64 (Object Storage API) Open & run this endpoint - PUT https://funapi.dev/api/faults/v1/config — Invalid profile (Fault Injection API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint - POST https://funapi.dev/api/data/v1/generate — Invalid schema (Fun Data Bridge API) Open & run this endpoint - POST https://funapi.dev/api/data/v1/jobs — Invalid job (Fun Data Bridge API) Open & run this endpoint Questions about HTTP 422 - Is 422 only for WebDAV?: It originated there (RFC 4918) but is now standard in RFC 9110 and used widely for validation across REST APIs. - What should a 422 body look like?: A list of field-level errors: which field, what rule, and what was received. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/423 TITLE: HTTP 423 Locked — Live Example | Fun API Playground ================================================================ HTTP 423 Locked The resource is locked, and this request would need the lock it does not hold. Defined in RFC 4918 §11.3 — 423 Locked · MDN reference On this page - Where you meet HTTP 423 in production - Why you would test it - What your client should do about a 423 - 423 versus the codes it gets confused with - Endpoints that return 423 - Questions about HTTP 423 - Other client error codes Where you meet HTTP 423 in production WebDAV servers where files are checked out, document editors with exclusive editing, and APIs that lock a record during a long-running job. Why you would test it Test the client's reaction to a resource someone else is editing: does it retry blindly, or tell the user who holds the lock and for how long? What your client should do about a 423 Do not hammer it. Wait for the lock to be released — the body often says by whom or until when — or ask for the lock first if the API supports it. 423 versus the codes it gets confused with - 423 vs 409 Conflict — 409 is a conflict with the resource's current state; 423 is specifically a lock held by someone else. - 423 vs 412 Precondition Failed — 412 means your conditional request failed because the version changed — optimistic locking. 423 is pessimistic locking. Endpoints that return 423 1 endpoint in this playground answers with 423. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 423 - Is 423 only for WebDAV?: It was defined by WebDAV, but any API with explicit locks can use it, and many do. - Pessimistic or optimistic locking?: 423 belongs to pessimistic locking (an explicit lock). Optimistic locking with ETags answers 412 instead. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/424 TITLE: HTTP 424 Failed Dependency — Live Example | Fun API ================================================================ HTTP 424 Failed Dependency This operation failed because another operation it depended on failed first. Defined in RFC 4918 §11.4 — 424 Failed Dependency · MDN reference On this page - Where you meet HTTP 424 in production - Why you would test it - What your client should do about a 424 - 424 versus the codes it gets confused with - Endpoints that return 424 - Questions about HTTP 424 - Other client error codes Where you meet HTTP 424 in production WebDAV batch operations, and batch APIs that run steps in order: if step two fails, step three is reported as 424 rather than attempted. Why you would test it Appears inside batch and multi-status responses. Test that your client distinguishes the item that actually failed from the ones that failed because of it. What your client should do about a 424 Find the root failure — usually a sibling result in the same response — and fix that. Retrying a 424 on its own changes nothing. 424 versus the codes it gets confused with - 424 vs 207 Multi-Status — 207 is the envelope that carries several outcomes; 424 is one possible outcome inside it. - 424 vs 409 Conflict — 409 is a conflict with this resource; 424 is a failure inherited from another. Endpoints that return 424 1 endpoint in this playground answers with 424. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 424 - Where would I see a 424?: Inside a 207 Multi-Status body, or as the result of one step in a batch, next to the step that actually failed. - Should I retry a 424?: Not by itself. Resolve the dependency that failed and retry the whole batch. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/425 TITLE: HTTP 425 Too Early — Live Example | Fun API Playground ================================================================ HTTP 425 Too Early The server will not process a request sent in TLS early data (0-RTT), because it could be replayed by an attacker. Defined in RFC 8470 §5.2 — 425 Too Early · MDN reference On this page - Where you meet HTTP 425 in production - Why you would test it - What your client should do about a 425 - 425 versus the codes it gets confused with - Endpoints that return 425 - Questions about HTTP 425 - Other client error codes Where you meet HTTP 425 in production CDNs and servers that support TLS 1.3 0-RTT but refuse non-idempotent requests in early data — a replayed POST could charge a card twice. Why you would test it Only reachable with TLS 1.3 early data enabled. The test is that the client retries after the full handshake, which most do automatically. What your client should do about a 425 Retry the same request after the TLS handshake completes, outside early data. Browsers and well-behaved clients do this transparently; a custom client has to do it itself. 425 versus the codes it gets confused with - 425 vs 429 Too Many Requests — Neither is about the request being wrong, but 429 is rate limiting; 425 is about replay risk in 0-RTT data. - 425 vs 400 Bad Request — A server without 425 support might return 400 for the same situation. Endpoints that return 425 1 endpoint in this playground answers with 425. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 425 - What is TLS early data?: A TLS 1.3 feature letting a returning client send its first request before the handshake finishes, saving a round trip — at the cost of possible replay. - Do I need to handle 425 myself?: Rarely. Clients that send early data are required to retry after a 425. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/426 TITLE: HTTP 426 Upgrade Required — Live Example | Fun API ================================================================ HTTP 426 Upgrade Required The server refuses to serve this request over the current protocol and names the one to switch to in the Upgrade header. Defined in RFC 9110 §15.5.22 — 426 Upgrade Required · MDN reference On this page - Where you meet HTTP 426 in production - Why you would test it - What your client should do about a 426 - 426 versus the codes it gets confused with - Endpoints that return 426 - Questions about HTTP 426 - Other client error codes Where you meet HTTP 426 in production WebSocket endpoints receiving a normal HTTP request, servers that require a newer HTTP version, and services that refuse plaintext and require TLS. Why you would test it Useful for checking that clients pinned to an old protocol fail clearly, and that a WebSocket endpoint answers plain HTTP with something more useful than 400. What your client should do about a 426 Switch to the protocol in the Upgrade header and try again. For a WebSocket endpoint that means connecting with a WebSocket client, not fetch(). 426 versus the codes it gets confused with - 426 vs 505 HTTP Version Not Supported — 505 is "I do not speak your HTTP version". 426 is "I could, but I insist you switch". - 426 vs 101 — 101 Switching Protocols is the success of an upgrade; 426 is the server demanding one. Endpoints that return 426 1 endpoint in this playground answers with 426. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 426 - Why does my WebSocket URL return 426?: You requested it with plain HTTP. Open it with a WebSocket client so the Upgrade handshake happens. - Does 426 include the protocol to use?: Yes — the Upgrade response header lists it. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/428 TITLE: HTTP 428 Precondition Required — Live Example | Fun API ================================================================ HTTP 428 Precondition Required The server requires this request to be conditional — to carry If-Match or similar — so that a write cannot overwrite a change it has not seen. Defined in RFC 6585 §3 — 428 Precondition Required · MDN reference On this page - Where you meet HTTP 428 in production - Why you would test it - What your client should do about a 428 - 428 versus the codes it gets confused with - Endpoints that return 428 - Questions about HTTP 428 - Other client error codes Where you meet HTTP 428 in production APIs that enforce optimistic concurrency on every write: configuration stores, CMS records, collaborative documents — anywhere a lost update is expensive. Why you would test it Send a PUT with no If-Match and expect 428; send it with a stale ETag and expect 412. Testing both proves the server enforces optimistic concurrency rather than merely supporting it. What your client should do about a 428 Read the resource first, take its ETag, and send it back in If-Match on the write. Do not invent an ETag or send If-Match: * just to get past the check — that disables the protection it exists for. 428 versus the codes it gets confused with - 428 vs 412 Precondition Failed — 412 means you sent a condition and it failed. 428 means you did not send one at all. - 428 vs 409 Conflict — 409 is a conflict the server detected by itself; 428 requires you to declare the version you expect. Endpoints that return 428 1 endpoint in this playground answers with 428. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 428 - What header satisfies a 428?: Usually If-Match with the ETag you last read. Some APIs also accept If-Unmodified-Since. - 428 or 412?: 428 for a missing precondition, 412 for a precondition that was present but no longer true. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/429 TITLE: HTTP 429 Too Many Requests — Live Example | Fun API ================================================================ HTTP 429 Too Many Requests You are being rate limited. The response should carry Retry-After, and usually X-RateLimit-Limit, -Remaining and -Reset. Defined in RFC 6585 §4 — 429 Too Many Requests · MDN reference On this page - Where you meet HTTP 429 in production - Why you would test it - What your client should do about a 429 - 429 versus the codes it gets confused with - Endpoints that return 429 - Questions about HTTP 429 - Other client error codes Where you meet HTTP 429 in production Any API with a quota — and it usually arrives all at once, when a deploy, a retry storm or a batch job pushes a normally quiet client over the line. Why you would test it Test that your client backs off on Retry-After rather than retrying immediately — an aggressive retry on a 429 is how a slowdown becomes an outage. What your client should do about a 429 Honour Retry-After. If it is absent, back off exponentially with jitter — synchronised retries from many clients recreate exactly the spike the limit exists to prevent. Cap the number of attempts, and never retry a 429 in a tight loop. The X-RateLimit-Remaining and -Reset headers, where present, let you slow down before you are told to. 429 versus the codes it gets confused with - 429 vs 503 Service Unavailable — Both mean "come back later". 429 is about you specifically — you are over your allowance. 503 is about the server being unable to serve anyone right now. - 429 vs 402 Payment Required — 402 is a quota that resets with a payment, not with time. Endpoints that return 429 2 endpoints in this playground answer with 429. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/coffee/v1/rush-hour — Too many requests — wait for Retry-After seconds (Coffee Shop API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 429 - What does Retry-After contain?: Either a number of seconds or an HTTP date. Both forms are valid and a client has to handle each. - Does a failed request count towards the limit?: Usually yes. Rate limits are typically counted on requests received, not on requests that succeeded. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/431 TITLE: HTTP 431 Request Header Fields Too Large | Fun API ================================================================ HTTP 431 Request Header Fields Too Large The request's headers are too large — all together, or one of them on its own — for the server to process. Defined in RFC 6585 §5 — 431 Request Header Fields Too Large · MDN reference On this page - Where you meet HTTP 431 in production - Why you would test it - What your client should do about a 431 - 431 versus the codes it gets confused with - Endpoints that return 431 - Questions about HTTP 431 - Other client error codes Where you meet HTTP 431 in production Bloated cookies accumulated across subdomains, oversized JWTs carrying too many claims or roles, and tracing headers that grow with every hop. Why you would test it Grow the cookie jar or an Authorization token until something breaks. The limit is usually hit at a proxy, so test through the same chain production uses. What your client should do about a 431 Shrink the headers: clear cookies for the domain, slim the token (put claims behind an ID rather than inline), or remove redundant headers. Retrying unchanged will fail identically. 431 versus the codes it gets confused with - 431 vs 414 URI Too Long — 414 is the URL being too long. 431 is the headers, which includes cookies. - 431 vs 413 Content Too Large — 413 is the body. Endpoints that return 431 1 endpoint in this playground answers with 431. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 431 - Why does clearing cookies fix a 431?: Cookies travel in the Cookie header. Too many, or too large, push the request headers past the server's limit. - How large can headers be?: Limits vary by server: 8 KB in total is common, 16 KB to 64 KB in some, and individual header limits can be lower. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/451 TITLE: HTTP 451 Unavailable For Legal Reasons | Fun API ================================================================ HTTP 451 Unavailable For Legal Reasons The server will not serve this resource for legal reasons — a court order, a government block or a takedown that applies to the requester. Defined in RFC 7725 §3 — 451 Unavailable For Legal Reasons · MDN reference On this page - Where you meet HTTP 451 in production - Why you would test it - What your client should do about a 451 - 451 versus the codes it gets confused with - Endpoints that return 451 - Questions about HTTP 451 - Other client error codes Where you meet HTTP 451 in production Content blocked in particular countries, takedowns under copyright law and court orders. The number is a nod to Ray Bradbury's Fahrenheit 451. Why you would test it Mainly a test of messaging: does your client tell the user the content is legally unavailable, rather than reporting a generic error or offering a retry? What your client should do about a 451 Do not retry; it will not change. Show the explanation from the body. The response may name the blocking entity in a Link header with rel="blocked-by". 451 versus the codes it gets confused with - 451 vs 403 Forbidden — 403 means the server will not let you, for its own reasons. 451 says a legal demand is the reason. - 451 vs 404 Not Found — Some services return 404 to avoid acknowledging that the content exists at all. Endpoints that return 451 1 endpoint in this playground answers with 451. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 451 - Why 451?: A reference to Ray Bradbury's Fahrenheit 451, the novel about censorship, suggested when the code was proposed. - Who sees a 451?: Often only requesters in a particular jurisdiction; the same URL can answer 200 elsewhere. Other client error codes - 400 Bad Request - 401 Unauthorized - 402 Payment Required - 403 Forbidden - 404 Not Found - 405 Method Not Allowed - 406 Not Acceptable - 407 Proxy Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/500 TITLE: HTTP 500 Internal Server Error — Live Example | Fun API ================================================================ HTTP 500 Internal Server Error The server failed and cannot say anything more useful. Nothing about the request needs to be wrong. Defined in RFC 9110 §15.6.1 — 500 Internal Server Error · MDN reference On this page - Where you meet HTTP 500 in production - Why you would test it - What your client should do about a 500 - 500 versus the codes it gets confused with - Endpoints that return 500 - Questions about HTTP 500 - Other server error codes Where you meet HTTP 500 in production An unhandled exception, a null dereference, a failed database call with no catch around it — the code that means the server hit something it did not plan for. Why you would test it Nearly impossible to provoke on demand against a healthy API, which is why retry, fallback and error-reporting paths so often ship untested. What your client should do about a 500 A single retry is defensible for an idempotent request. For anything that writes, retrying a 500 risks doing the work twice, because a 500 does not tell you whether the operation completed before the failure — send an Idempotency-Key so the retry is safe, or do not retry at all. 500 versus the codes it gets confused with - 500 vs 502 Bad Gateway — 502 means an upstream server gave an invalid response. 500 means this server failed on its own. - 500 vs 503 Service Unavailable — 503 is a deliberate, temporary refusal. 500 is an accident. Endpoints that return 500 3 endpoints in this playground answer with 500. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/pizza/v1/oven/status — Always. The oven is on fire. (Pizza Orders API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/target — Configured failure (Fault Injection API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 500 - Should a 500 body include the stack trace?: Never in production. A correlation id the caller can quote to support is the useful thing to return. - Is it safe to retry a 500?: Only if the request is idempotent, or carries an idempotency key. Otherwise a retry can duplicate a completed write. Other server error codes - 501 Not Implemented - 502 Bad Gateway - 503 Service Unavailable - 504 Gateway Timeout - 505 HTTP Version Not Supported - 507 Insufficient Storage - 508 Loop Detected - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/501 TITLE: HTTP 501 Not Implemented — Live Example | Fun API Playground ================================================================ HTTP 501 Not Implemented The server does not support the functionality required — usually the HTTP method itself — for any resource. Defined in RFC 9110 §15.6.2 — 501 Not Implemented · MDN reference On this page - Where you meet HTTP 501 in production - Why you would test it - What your client should do about a 501 - 501 versus the codes it gets confused with - Endpoints that return 501 - Questions about HTTP 501 - Other server error codes Where you meet HTTP 501 in production Unimplemented methods on simple servers, features stubbed out in an API before launch, and proxies that do not understand a newer method. Why you would test it Send a method nothing implements (PROPFIND, or a made-up one) and check your client reports "unsupported" rather than "server down". What your client should do about a 501 Do not retry; the server is telling you the capability does not exist. Fall back to a supported method or feature. 501 versus the codes it gets confused with - 501 vs 405 Method Not Allowed — 405 means this resource does not allow the method, but others might. 501 means the server does not implement it anywhere. - 501 vs 503 Service Unavailable — 503 is temporary. 501 is permanent until the server changes. Endpoints that return 501 1 endpoint in this playground answers with 501. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 501 - Is 501 a server error?: It is in the 5xx class, but it describes a missing capability rather than a failure — retrying will not help. - 501 or 405?: 405 when the server knows the method but this resource does not allow it; 501 when it does not support the method at all. Other server error codes - 500 Internal Server Error - 502 Bad Gateway - 503 Service Unavailable - 504 Gateway Timeout - 505 HTTP Version Not Supported - 507 Insufficient Storage - 508 Loop Detected - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/502 TITLE: HTTP 502 Bad Gateway — Live Example | Fun API Playground ================================================================ HTTP 502 Bad Gateway A gateway or proxy got an invalid response from the server behind it — a crash, a closed connection, garbage instead of HTTP. Defined in RFC 9110 §15.6.3 — 502 Bad Gateway · MDN reference On this page - Where you meet HTTP 502 in production - Why you would test it - What your client should do about a 502 - 502 versus the codes it gets confused with - Endpoints that return 502 - Questions about HTTP 502 - Other server error codes Where you meet HTTP 502 in production Load balancers and reverse proxies (nginx, a cloud load balancer, a CDN) in front of an application that crashed, restarted, ran out of memory or closed the connection mid-response. Why you would test it The upstream failure your monitoring confuses with your own. Test that clients retry idempotent requests with backoff, and that error pages do not blame the user. What your client should do about a 502 Retry idempotent requests with exponential backoff; a 502 is often transient during deploys. For writes, retry only with an idempotency key — the upstream may have processed the request before failing. 502 versus the codes it gets confused with - 502 vs 504 Gateway Timeout — 504 means the upstream did not answer in time. 502 means it answered, but with something invalid, or dropped the connection. - 502 vs 503 Service Unavailable — 503 is the server saying it is unavailable. 502 is a proxy reporting a broken upstream. Endpoints that return 502 1 endpoint in this playground answers with 502. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 502 - Is a 502 my code or the proxy?: Usually your application: the proxy is reporting that the application behind it failed to give a valid response. - Why do 502s appear during deploys?: The proxy routes to an instance that is shutting down or not yet ready, and gets a refused or reset connection. Other server error codes - 500 Internal Server Error - 501 Not Implemented - 503 Service Unavailable - 504 Gateway Timeout - 505 HTTP Version Not Supported - 507 Insufficient Storage - 508 Loop Detected - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/503 TITLE: HTTP 503 Service Unavailable — Live Example | Fun API ================================================================ HTTP 503 Service Unavailable The server is temporarily unable to handle the request — overloaded, or down for maintenance. Often accompanied by Retry-After. Defined in RFC 9110 §15.6.4 — 503 Service Unavailable · MDN reference On this page - Where you meet HTTP 503 in production - Why you would test it - What your client should do about a 503 - 503 versus the codes it gets confused with - Endpoints that return 503 - Questions about HTTP 503 - Other server error codes Where you meet HTTP 503 in production Planned maintenance, a deploy in progress, a dependency that is down, or a load shedder deliberately turning traffic away to protect what is left. Why you would test it Unlike a 500, a 503 is explicitly retryable. Test that your client treats them differently instead of collapsing both into "error". What your client should do about a 503 Retry with backoff, and honour Retry-After when the server sends one — a 503 with a Retry-After is a server telling you precisely when to come back, and ignoring it is how a recovering service is pushed back over. Fail open or degrade gracefully where the call is not essential. 503 versus the codes it gets confused with - 503 vs 500 Internal Server Error — 500 is unplanned. 503 usually is not — it often means someone chose to return it. - 503 vs 429 Too Many Requests — 429 limits you. 503 affects everyone. Endpoints that return 503 3 endpoints in this playground answer with 503. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/protocol/v1/maintenance — Always, with a Retry-After header. Good retry/backoff practice. (Protocol Lab API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/target — Configured outage (Fault Injection API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 503 - Should maintenance pages be 503?: Yes. A maintenance page served as 200 tells search engines the thin page is the real content. - How long should I wait?: As long as Retry-After says. Without it, exponential backoff with jitter and an overall deadline. Other server error codes - 500 Internal Server Error - 501 Not Implemented - 502 Bad Gateway - 504 Gateway Timeout - 505 HTTP Version Not Supported - 507 Insufficient Storage - 508 Loop Detected - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/504 TITLE: HTTP 504 Gateway Timeout — Live Example | Fun API Playground ================================================================ HTTP 504 Gateway Timeout An upstream server did not respond in time. The failure is in the chain behind the endpoint, not at the endpoint itself. Defined in RFC 9110 §15.6.5 — 504 Gateway Timeout · MDN reference On this page - Where you meet HTTP 504 in production - Why you would test it - What your client should do about a 504 - 504 versus the codes it gets confused with - Endpoints that return 504 - Questions about HTTP 504 - Other server error codes Where you meet HTTP 504 in production A gateway or load balancer giving up on an upstream that did not answer in time — most often a slow query, a saturated pool, or a downstream call with no timeout of its own. Why you would test it Test what your own timeout does when it is shorter than the gateway's — you will get a client-side abort rather than the 504, and your logs will disagree with theirs. What your client should do about a 504 The critical thing about a 504 is that the work may still be running. The gateway stopped waiting; the upstream did not necessarily stop working. Retrying a write after a 504 can duplicate it, so make it idempotent or check the state before retrying. Set a client timeout shorter than the gateway's so you keep control of the deadline. 504 versus the codes it gets confused with - 504 vs 502 Bad Gateway — 502 means the upstream answered with something invalid. 504 means it did not answer at all in time. - 504 vs 503 Service Unavailable — 503 means the service declined to serve. 504 means something in front of it stopped waiting. Endpoints that return 504 2 endpoints in this playground answer with 504. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/protocol/v1/gateway-timeout — Always, after ~3 seconds. Pair it with a 2s client timeout. (Protocol Lab API) Open & run this endpoint - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 504 - Is a 504 the client's fault?: Rarely — but a client that retries aggressively into a struggling upstream makes it considerably worse. - Did my request go through?: A 504 cannot tell you. That ambiguity is the reason idempotency keys exist. Other server error codes - 500 Internal Server Error - 501 Not Implemented - 502 Bad Gateway - 503 Service Unavailable - 505 HTTP Version Not Supported - 507 Insufficient Storage - 508 Loop Detected - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/505 TITLE: HTTP 505 HTTP Version Not Supported — Live Example | Fun API ================================================================ HTTP 505 HTTP Version Not Supported The server does not support the major HTTP version used in the request. Defined in RFC 9110 §15.6.6 — 505 HTTP Version Not Supported · MDN reference On this page - Where you meet HTTP 505 in production - Why you would test it - What your client should do about a 505 - 505 versus the codes it gets confused with - Endpoints that return 505 - Questions about HTTP 505 - Other server error codes Where you meet HTTP 505 in production Malformed request lines from hand-rolled clients and scripts, very old servers receiving newer protocol versions, and misconfigured proxies mangling the version string. Why you would test it Hard to provoke with a normal client, which is why it is worth simulating: a client that assumes every 5xx is transient will retry a 505 forever. What your client should do about a 505 Do not retry unchanged — the same version fails the same way. Switch the client to a version the server supports, which is usually HTTP/1.1. 505 versus the codes it gets confused with - 505 vs 426 Upgrade Required — 426 asks you to upgrade to another protocol. 505 refuses the version you used. - 505 vs 400 Bad Request — A malformed request line is often answered with 400 instead. Endpoints that return 505 1 endpoint in this playground answers with 505. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 505 - Can a browser get a 505?: Practically never; browsers negotiate HTTP versions properly. It comes from custom clients and tools. - Is a 505 transient?: No. The same request with the same version will fail the same way. Other server error codes - 500 Internal Server Error - 501 Not Implemented - 502 Bad Gateway - 503 Service Unavailable - 504 Gateway Timeout - 507 Insufficient Storage - 508 Loop Detected - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/507 TITLE: HTTP 507 Insufficient Storage — Live Example | Fun API ================================================================ HTTP 507 Insufficient Storage The server cannot store the representation needed to complete the request — it has run out of space. Defined in RFC 4918 §11.5 — 507 Insufficient Storage · MDN reference On this page - Where you meet HTTP 507 in production - Why you would test it - What your client should do about a 507 - 507 versus the codes it gets confused with - Endpoints that return 507 - Questions about HTTP 507 - Other server error codes Where you meet HTTP 507 in production WebDAV and file storage servers with full disks or per-user quotas, and upload services that report quota exhaustion this way. Why you would test it Simulates a full disk or an exhausted quota on upload. Check that the client keeps the user's data and explains the problem, rather than discarding the upload. What your client should do about a 507 Retrying immediately will fail. Free space or ask for more quota, then retry. Keep the data client-side so it is not lost. 507 versus the codes it gets confused with - 507 vs 413 Content Too Large — 413 means this request is too large. 507 means the server has no room, whatever the size. - 507 vs 503 Service Unavailable — 503 is general unavailability; 507 names storage as the cause. Endpoints that return 507 1 endpoint in this playground answers with 507. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 507 - Is 507 my fault or the server's?: The server's capacity, or your quota on it — not the request's format. - Is 507 only for WebDAV?: It was defined by WebDAV, but storage APIs use it for quota exhaustion too. Other server error codes - 500 Internal Server Error - 501 Not Implemented - 502 Bad Gateway - 503 Service Unavailable - 504 Gateway Timeout - 505 HTTP Version Not Supported - 508 Loop Detected - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/508 TITLE: HTTP 508 Loop Detected — Live Example | Fun API Playground ================================================================ HTTP 508 Loop Detected The server stopped processing because it detected an infinite loop — typically a resource that, directly or indirectly, includes itself. Defined in RFC 5842 §7.2 — 508 Loop Detected · MDN reference On this page - Where you meet HTTP 508 in production - Why you would test it - What your client should do about a 508 - 508 versus the codes it gets confused with - Endpoints that return 508 - Questions about HTTP 508 - Other server error codes Where you meet HTTP 508 in production WebDAV servers walking bindings that contain themselves, and some hosting platforms that report a request bouncing between their own services. Why you would test it A useful check that your client does not retry indefinitely on a server error that will never resolve on its own. What your client should do about a 508 Do not retry; the loop is in the server's data or configuration. Fix the cycle — a binding, a self-referencing configuration, or a proxy forwarding to itself. 508 versus the codes it gets confused with - 508 vs 502 Bad Gateway — Proxies forwarding to each other in a circle usually surface as 502 or 504 when one gives up. 508 is a server that noticed the loop itself. - 508 vs 500 Internal Server Error — A generic 500 is what most servers return for the same problem. Endpoints that return 508 1 endpoint in this playground answers with 508. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 508 - Is 508 a redirect loop?: No. Redirect loops are detected by clients. 508 is a loop the server detected while processing. - Where is 508 defined?: In the WebDAV binding extension, RFC 5842. Other server error codes - 500 Internal Server Error - 501 Not Implemented - 502 Bad Gateway - 503 Service Unavailable - 504 Gateway Timeout - 505 HTTP Version Not Supported - 507 Insufficient Storage - 511 Network Authentication Required All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/status/511 TITLE: HTTP 511 Network Authentication Required | Fun API ================================================================ HTTP 511 Network Authentication Required The client has to authenticate to gain network access — the response comes from a captive portal, not from the server you asked for. Defined in RFC 6585 §6 — 511 Network Authentication Required · MDN reference On this page - Where you meet HTTP 511 in production - Why you would test it - What your client should do about a 511 - 511 versus the codes it gets confused with - Endpoints that return 511 - Questions about HTTP 511 - Other server error codes Where you meet HTTP 511 in production Hotel, airport, café and guest Wi-Fi portals that intercept every request a device makes until the user accepts the terms or logs in. Why you would test it Mostly a test of resilience: an app on hotel or airport Wi-Fi receives HTML from a portal instead of JSON. Check it says "sign in to the network" instead of crashing on a parse error. What your client should do about a 511 Do not parse the body as your API's response — it is not. Prompt the user to open a browser and sign in to the network, then retry. 511 versus the codes it gets confused with - 511 vs 407 Proxy Authentication Required — 407 asks for proxy credentials in a header. 511 asks a person to log in through a web page. - 511 vs 401 Unauthorized — 401 comes from the actual server you called. Endpoints that return 511 1 endpoint in this playground answers with 511. Every one is free, needs no signup, and can be called from the browser or with curl. - GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint Questions about HTTP 511 - Why did my API return HTML?: A captive portal intercepted the request. 511 is the status a well-behaved portal uses to say so. - Should my server ever send 511?: No — it is intended for network operators' portals, not for origin servers. Other server error codes - 500 Internal Server Error - 501 Not Implemented - 502 Bad Gateway - 503 Service Unavailable - 504 Gateway Timeout - 505 HTTP Version Not Supported - 507 Insufficient Storage - 508 Loop Detected All HTTP status codes · All 39 mock REST APIs · Getting started guide Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary TITLE: API Testing Glossary — Fun API Playground ================================================================ API testing glossary The concepts these APIs exercise, each defined in a paragraph and then demonstrated by an endpoint you can call. Every entry names the misconception people actually hold about it, because that is usually the part standing between reading the definition and getting it right. - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. - HMAC signature — A keyed hash proving a payload came from someone holding the shared secret and has not been altered. - Content negotiation — Client and server agreeing on the format of a response, through headers rather than separate URLs. - Safe and idempotent methods — Two independent properties of HTTP methods that decide what a client is allowed to retry. - CORS — The browser rule that decides whether JavaScript on one origin may read a response from another. - API endpoint — One URL plus one HTTP method — the smallest unit of an API that a client can call. - HTTP status codes — The three-digit number at the start of every HTTP response that says, before the body, what happened. - PUT vs PATCH — PUT replaces a resource with the representation you send; PATCH applies a set of changes to it. - Query parameters — The key=value pairs after the ? in a URL, used to filter, sort, page or shape what an endpoint returns. - Path parameters — A variable segment of a URL path, such as the 42 in /orders/42, that identifies one specific resource. - HTTP headers — Name–value metadata sent with every request and response, separate from the body. - OpenAPI — A machine-readable description of an HTTP API — its paths, parameters, bodies and responses — in JSON or YAML. - Postman collection — A saved, shareable group of API requests — with their headers, bodies, variables and tests — in Postman's JSON format. - GraphQL — A query language for APIs where the client names exactly the fields it wants, usually through a single endpoint. - OAuth 2.0 — The standard framework for letting an application get a limited access token, instead of handling the user's password. - Client credentials grant — The OAuth flow for one service calling another: the client trades its own ID and secret for an access token. - PKCE — Proof Key for Code Exchange — a one-time secret that stops a stolen OAuth authorization code from being redeemed by anyone else. - Refresh token — A long-lived credential used only to obtain new short-lived access tokens, without asking the user to log in again. - OpenID Connect — An identity layer on top of OAuth 2.0 that tells the client who the user is, in a signed ID token. - API key — A static secret string that identifies the calling application, sent with each request. - Basic authentication — Sending a username and password with every request, Base64-encoded in the Authorization header. - Authentication vs authorization — Authentication proves who you are; authorization decides what you are allowed to do. - OAuth scopes — Named permissions attached to an access token that limit what it can be used for. - JWKS — A JSON Web Key Set — the public keys an issuer publishes so that anyone can verify the tokens it signs. - Retry-After — A response header telling the client how long to wait before trying again, in seconds or as a date. - Exponential backoff — A retry strategy where each wait is longer than the last, with randomness added so clients do not retry in sync. - Request timeout — The maximum time a client will wait for a response before abandoning the request. - Contract testing — Testing that an API and its consumers agree on the shape of requests and responses, without running them together. - JSON Schema — A JSON vocabulary for describing what a valid JSON document looks like, so documents can be validated automatically. - API versioning — Running more than one version of an API side by side, so breaking changes do not break existing clients. - Deprecation and Sunset headers — Response headers that warn a client an endpoint is on its way out, and when it will stop working. - Cache-Control — The header that tells browsers, CDNs and proxies whether a response may be stored, by whom and for how long. - Range requests — Asking for only part of a resource — a byte range — so downloads can resume and media can seek. - multipart/form-data — The request body format for uploading files alongside form fields in a single request. - Media type (Content-Type) — The label — such as application/json — that says what format a body is in, carried in Content-Type. - Server-Sent Events (SSE) — A one-way stream of events from server to client over an ordinary HTTP response that stays open. - JSON Patch — A standard format (RFC 6902) for describing changes to a JSON document as a list of operations. - Soft delete — Marking a record as deleted instead of erasing it, so the API can say it is gone rather than that it never existed. - Batch requests — One request that carries many operations, answered with one result per operation. - Resource state machine — A resource that moves through defined states — created, shipped, delivered — where only some transitions are allowed. - Fault injection — Deliberately introducing failures — errors, latency, garbage responses — to test how a system copes. - Mocks, stubs and fakes — Three kinds of test double — stand-ins for a real dependency — that differ in what they do and what they check. - Test fixture — The known data and state a test starts from, set up the same way on every run. - API sandbox — An isolated copy of an API where calls have no real-world effect and data can be reset. - cURL — The command-line tool for making HTTP requests, and the lingua franca for sharing an exact API call. - Request ID (correlation ID) — A unique identifier attached to a request and its logs, so one call can be traced across every service it touched. - Flaky tests — A test that sometimes passes and sometimes fails without any change to the code it tests. - API gateway — A single entry point in front of one or more services that handles routing, authentication, rate limiting and logging. - Boundary value analysis — Choosing test inputs at and around the edges of what is allowed, where off-by-one bugs live. - Smoke testing — A small, fast set of checks that the most important paths work at all, run before anything more thorough. Testing techniques · Every HTTP status code · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare TITLE: Free Mock API Tools Compared — Fun API Playground ================================================================ Free mock APIs compared Honest comparisons with the other free mock APIs, including what each of them does better. Most of the disappointment with tools in this space comes from a tool being asked to do a job it was never for, so each page starts with what the other one is actually built to do. The free options fall into three groups. Fixed public datasets — JSONPlaceholder, reqres — hand you a body to render and quietly discard your writes. Protocol reflectors — httpbin, Postman Echo — tell you exactly what your client sent but have no domain behind them, so there is nothing to conflict with. Configurable mock servers — Mockoon, WireMock, Beeceptor, Prism — let you declare the responses yourself, which is ideal for reproducing one specific contract and useless for discovering how your client copes with rules you did not write. This playground is a fourth thing: a simulated API with per-caller state and constraints that push back. You do not configure the responses, which is the point — a seat that is already taken, a version that moved under you and a rate limit you actually exceeded are failures with a cause, and those are the ones worth rehearsing before production supplies them. - A JSONPlaceholder alternative that keeps what you write — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - An httpbin alternative with resources, not just reflections — httpbin shows you the request. This shows you an API. They answer different questions. - A reqres alternative with more than users and a login — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - A json-server alternative with behaviour, not just CRUD — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - A WireMock alternative for practice, not for stubbing a contract — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - A Mockoon alternative with nothing to design — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - A Beeceptor alternative with realistic behaviour built in — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - A DummyJSON alternative where writes are real — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - A Postman mock server alternative with state — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - A PokeAPI alternative for practising writes and errors — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - A SWAPI alternative with writes, auth and errors — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - Free mock APIs compared: which one for which job — Six free options, what each is genuinely for, and how to tell which one your problem needs. API testing glossary · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tools TITLE: Free API Testing Tools — Fun API Playground ================================================================ API testing tools Three small utilities that run entirely in the page. No signup, no upload, no request to a server — which for two of them is the point rather than a nicety, because people paste live credentials and signing secrets into tools like these. They exist because the playground already had the hard parts. It generates request code in nine languages, issues real signed JWTs from its auth endpoints, and signs every webhook delivery with an HMAC you are meant to verify. These take those three capabilities out of the docs pages and make each one usable on its own, against your own input. - Convert a curl command to code — Paste a curl command, get the same request in nine languages — fetch, axios, Python, Go, C#, RestAssured, Playwright, k6 and HTTPie. - Decode a JWT and read its claims — Paste a JSON Web Token to read its header and claims, and see whether it has expired. Nothing leaves the page. - Verify an HMAC webhook signature — Check a webhook signature against the payload and the shared secret, with HMAC-SHA256, SHA-1 or SHA-512. Nothing leaves the page. API testing glossary · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary TITLE: API Testing Glossary — Fun API Playground ================================================================ API testing glossary The concepts these APIs exercise, each defined in a paragraph and then demonstrated by an endpoint you can call. Every entry names the misconception people actually hold about it, because that is usually the part standing between reading the definition and getting it right. - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. - HMAC signature — A keyed hash proving a payload came from someone holding the shared secret and has not been altered. - Content negotiation — Client and server agreeing on the format of a response, through headers rather than separate URLs. - Safe and idempotent methods — Two independent properties of HTTP methods that decide what a client is allowed to retry. - CORS — The browser rule that decides whether JavaScript on one origin may read a response from another. - API endpoint — One URL plus one HTTP method — the smallest unit of an API that a client can call. - HTTP status codes — The three-digit number at the start of every HTTP response that says, before the body, what happened. - PUT vs PATCH — PUT replaces a resource with the representation you send; PATCH applies a set of changes to it. - Query parameters — The key=value pairs after the ? in a URL, used to filter, sort, page or shape what an endpoint returns. - Path parameters — A variable segment of a URL path, such as the 42 in /orders/42, that identifies one specific resource. - HTTP headers — Name–value metadata sent with every request and response, separate from the body. - OpenAPI — A machine-readable description of an HTTP API — its paths, parameters, bodies and responses — in JSON or YAML. - Postman collection — A saved, shareable group of API requests — with their headers, bodies, variables and tests — in Postman's JSON format. - GraphQL — A query language for APIs where the client names exactly the fields it wants, usually through a single endpoint. - OAuth 2.0 — The standard framework for letting an application get a limited access token, instead of handling the user's password. - Client credentials grant — The OAuth flow for one service calling another: the client trades its own ID and secret for an access token. - PKCE — Proof Key for Code Exchange — a one-time secret that stops a stolen OAuth authorization code from being redeemed by anyone else. - Refresh token — A long-lived credential used only to obtain new short-lived access tokens, without asking the user to log in again. - OpenID Connect — An identity layer on top of OAuth 2.0 that tells the client who the user is, in a signed ID token. - API key — A static secret string that identifies the calling application, sent with each request. - Basic authentication — Sending a username and password with every request, Base64-encoded in the Authorization header. - Authentication vs authorization — Authentication proves who you are; authorization decides what you are allowed to do. - OAuth scopes — Named permissions attached to an access token that limit what it can be used for. - JWKS — A JSON Web Key Set — the public keys an issuer publishes so that anyone can verify the tokens it signs. - Retry-After — A response header telling the client how long to wait before trying again, in seconds or as a date. - Exponential backoff — A retry strategy where each wait is longer than the last, with randomness added so clients do not retry in sync. - Request timeout — The maximum time a client will wait for a response before abandoning the request. - Contract testing — Testing that an API and its consumers agree on the shape of requests and responses, without running them together. - JSON Schema — A JSON vocabulary for describing what a valid JSON document looks like, so documents can be validated automatically. - API versioning — Running more than one version of an API side by side, so breaking changes do not break existing clients. - Deprecation and Sunset headers — Response headers that warn a client an endpoint is on its way out, and when it will stop working. - Cache-Control — The header that tells browsers, CDNs and proxies whether a response may be stored, by whom and for how long. - Range requests — Asking for only part of a resource — a byte range — so downloads can resume and media can seek. - multipart/form-data — The request body format for uploading files alongside form fields in a single request. - Media type (Content-Type) — The label — such as application/json — that says what format a body is in, carried in Content-Type. - Server-Sent Events (SSE) — A one-way stream of events from server to client over an ordinary HTTP response that stays open. - JSON Patch — A standard format (RFC 6902) for describing changes to a JSON document as a list of operations. - Soft delete — Marking a record as deleted instead of erasing it, so the API can say it is gone rather than that it never existed. - Batch requests — One request that carries many operations, answered with one result per operation. - Resource state machine — A resource that moves through defined states — created, shipped, delivered — where only some transitions are allowed. - Fault injection — Deliberately introducing failures — errors, latency, garbage responses — to test how a system copes. - Mocks, stubs and fakes — Three kinds of test double — stand-ins for a real dependency — that differ in what they do and what they check. - Test fixture — The known data and state a test starts from, set up the same way on every run. - API sandbox — An isolated copy of an API where calls have no real-world effect and data can be reset. - cURL — The command-line tool for making HTTP requests, and the lingua franca for sharing an exact API call. - Request ID (correlation ID) — A unique identifier attached to a request and its logs, so one call can be traced across every service it touched. - Flaky tests — A test that sometimes passes and sometimes fails without any change to the code it tests. - API gateway — A single entry point in front of one or more services that handles routing, authentication, rate limiting and logging. - Boundary value analysis — Choosing test inputs at and around the edges of what is allowed, where off-by-one bugs live. - Smoke testing — A small, fast set of checks that the most important paths work at all, run before anything more thorough. Testing techniques · Every HTTP status code · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/mock-api TITLE: What is a mock API? — Fun API Playground ================================================================ Mock API A mock API answers requests the way a real service would — same URLs, same status codes, same response shapes — without any of the system the real one depends on. It exists so that a client can be built, demonstrated or tested before the real service is ready, or when calling the real one would be slow, expensive, rate-limited or destructive. How it works Mocks come in three broad shapes. A static mock always returns the same canned payload. A configurable mock lets you declare, per endpoint, what to return. A simulated mock — which is what this playground is — actually keeps state: a POST creates something a later GET can find, a DELETE removes it, and constraints such as stock levels, seat availability and version conflicts are enforced rather than described. The misconception The common assumption is that a mock cannot exercise error handling, because a mock always succeeds. That is a property of most mocks, not of mocking. It is precisely the failure paths — 409, 412, 429, 503 — that are hardest to provoke against a real service and most valuable to rehearse, which is why an API that only ever returns 200 makes for a weak practice target. Try it here Every API here runs both ways: entirely in your browser with no network at all, or against a live backend over HTTPS. The browser engine is the same code, so the responses match. Related - Negative testing: every error code on demand - How this playground is actually served Other terms - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/rest-api TITLE: What is a REST API? — Fun API Playground ================================================================ REST API REST is an architectural style, not a specification. What makes an API RESTful in practice: things in the system have URLs, the HTTP method says what you want done to them, the status code says what happened, and the server keeps no per-client session between requests. Everything the server needs to handle a request arrives with that request. How it works A collection lives at a path — /characters — and an item within it at /characters/1. GET reads, POST creates, PUT replaces, PATCH modifies, DELETE removes. Filtering, sorting and pagination ride on the query string. Representation is negotiated with Accept and Content-Type rather than baked into the URL. The response status is the primary result: a client that reads only the body is throwing away half the answer. The misconception That REST means JSON over HTTP. It does not — REST says nothing about JSON, and plenty of JSON-over-HTTP APIs are not RESTful at all (a single /api endpoint taking an action name in the body is RPC wearing REST's clothes). The distinguishing property is that resources are addressable and the method carries the verb. Try it here The catalog is 39 REST APIs with 338 endpoints between them. Any of them will do for the basics; the Protocol Lab is the one built specifically around the parts of HTTP that most mock APIs skip. Related - Getting started guide - Safe and idempotent methods Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/etag TITLE: What is an ETag? — Fun API Playground ================================================================ ETag An ETag is a string the server attaches to a response that identifies that particular version of that particular representation. It is opaque: it might be a hash, a version number or a timestamp, and a client must never try to interpret it — only send it back. How it works On a read, the client returns the ETag in If-None-Match; if it still matches, the server answers 304 Not Modified with no body and the client uses its cached copy. On a write, the client sends it in If-Match; if it no longer matches, the server answers 412 Precondition Failed and the write is refused. Same value, two headers, two entirely different jobs — one saves bandwidth, the other prevents a lost update. The misconception That an ETag mismatch means something went wrong. A 412 is the mechanism working: it means somebody else changed the resource since you read it, and your write would have silently overwritten theirs. The correct response is to re-read, reconcile, and try again with the new ETag — not to retry with the old one, which will fail identically forever. Try it here The Football and FIBA standings endpoints answer conditional reads with 304. The character, hero and movie writes accept If-Match and produce a real 412 when the version is stale. Related - Testing optimistic concurrency with ETag and If-Match - HTTP 412 Precondition Failed - HTTP 304 Not Modified Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/hateoas TITLE: What is HATEOAS? — Fun API Playground ================================================================ HATEOAS HATEOAS is the constraint that a client should discover what it can do from the responses it receives, rather than from URLs hard-coded against documentation. Each representation carries links, and those links are what drives the client from one state to the next. How it works A response includes a links structure — commonly `_links` — naming the available transitions and their URLs: self, next, cancel, approve. A client follows the link named for what it wants to do. Because the available links depend on the current state, an order that has shipped simply does not carry a cancel link, and the client needs no rule of its own about when cancelling is allowed. The misconception That HATEOAS is academic and nobody ships it. Partial HATEOAS is everywhere: the `next` URL in a paginated response is exactly this idea, and a client that follows it rather than incrementing a page counter is already benefiting — it keeps working when the server moves to cursor pagination. Try it here The Protocol Lab document endpoints attach `_links` to every item. The Bank transaction list uses a cursor the client is meant to follow rather than construct. Related - Testing pagination against a real API - What a REST API is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/bearer-token TITLE: What is a bearer token? — Fun API Playground ================================================================ Bearer token A bearer token is sent in an Authorization header as `Authorization: Bearer ` and authorises the request purely by being presented. There is no signature over the request, no proof the sender is the party the token was issued to: the token is the whole credential, which is what "bearer" means. How it works The server validates the token — by looking it up, or by verifying a signature if it is self-contained like a JWT — and derives the caller's identity and permissions from it. A missing or invalid token is a 401. A valid token whose holder is not allowed to do this particular thing is a 403; the difference matters, because only one of them can be fixed by getting a new token. The misconception That a bearer token is safe to put in a URL because it expires. Anything in a URL ends up in server logs, browser history, referrer headers and analytics. Bearer tokens belong in a header, over TLS, with a short lifetime and a refresh mechanism. Try it here Every endpoint marked with a lock takes `qa-admin-token` or `qa-viewer-token`. Using the viewer token on a DELETE is the cleanest way to see the 401/403 distinction: the token is valid, and the answer is still no. Related - Testing OAuth 2.0, JWTs and token expiry - HTTP 401 Unauthorized - HTTP 403 Forbidden Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/jwt TITLE: What is a JWT? — Fun API Playground ================================================================ JWT (JSON Web Token) A JWT is three base64url-encoded segments separated by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. Because the signature proves the payload has not been altered, the server can trust the claims inside it without storing any session state. How it works The client sends it as a bearer token. The server verifies the signature with the key, then reads the claims — `sub` for the subject, `exp` for expiry, `iat` for issue time, plus whatever roles or scopes the issuer chose to include. Expiry is enforced by the server checking `exp`, not by anything in the token stopping it from being sent. The misconception That a JWT is encrypted. It is signed, not encrypted: anybody holding the token can decode the payload and read every claim in it. Nothing secret belongs in a JWT. The second misconception is that a JWT can be revoked — a stateless token stays valid until it expires, which is why short lifetimes and refresh tokens exist. Try it here `POST /auth/v1/login` with admin/admin123 issues a genuinely signed JWT. Decode the middle segment and read your own claims; then wait for it to expire and watch the 401 arrive. Related - Testing OAuth 2.0, JWTs and token expiry - What a bearer token is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/webhook TITLE: What is a webhook? — Fun API Playground ================================================================ Webhook A webhook inverts the usual direction. Rather than the client asking repeatedly whether anything has changed, it registers a URL of its own, and the server makes an HTTP request to that URL when an event occurs. The client becomes, for those requests, a server. How it works You subscribe by giving the provider a URL and usually receiving a shared secret. When an event fires, the provider POSTs a payload to that URL, signing it — typically an HMAC over the raw body, in a header. Your endpoint verifies the signature, responds quickly with a 2xx, and does the actual work afterwards. Providers retry non-2xx responses, so deliveries can and will arrive more than once. The misconception That receiving a webhook means the event is true. An unverified webhook endpoint is a public URL anybody can POST anything to. The signature is not optional, and it must be computed over the exact raw bytes received — parsing and re-serialising the JSON first is the single most common reason a correct implementation fails to verify. Try it here The Webhooks API lets you subscribe, trigger a delivery, read the `x-funapi-signature` header and verify it — then tamper with the payload and watch verification fail. Related - Testing webhooks and HMAC signature verification - What an HMAC signature is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/hmac-signature TITLE: What is an HMAC signature? — Fun API Playground ================================================================ HMAC signature HMAC — hash-based message authentication code — combines a secret key with a message under a hash function to produce a short value that can only be reproduced by someone who has the same key and the same message. It gives you authenticity and integrity together, without public-key cryptography. How it works The sender computes HMAC(secret, body) and puts the result in a header. The receiver computes the same thing over the body it received and compares. If either the body or the key differs, the values do not match. The comparison must be constant-time: a normal string comparison returns early on the first differing byte, which leaks enough timing information to reconstruct a valid signature given enough attempts. The misconception That a signature proves freshness. It does not — a valid signed payload stays valid forever, so an attacker who captures one can replay it. That is why signatures are normally computed over a timestamp as well as the body, and why receivers reject anything older than a few minutes. Try it here Trigger a webhook delivery and verify `x-funapi-signature` against the secret you were given at subscription time. Change one byte of the payload and the verification fails, which is the whole point. Related - Testing webhooks and HMAC signature verification - What a webhook is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/content-negotiation TITLE: What is content negotiation? — Fun API Playground ================================================================ Content negotiation Content negotiation is how one URL can serve several representations. The client states what it can accept; the server picks from what it can produce; the response says which was chosen. The resource is the same either way — only its rendering differs. How it works The client sends Accept with the media types it wants, optionally weighted with q-values. The server replies with Content-Type naming what it actually sent, and should send Vary: Accept so caches do not serve a JSON response to a client that asked for CSV. If nothing the client will accept can be produced, the answer is 406 Not Acceptable. The mirror case — the client sending a body in a type the server will not parse — is 415 Unsupported Media Type. The misconception That Accept is advisory and can be ignored. Many APIs do ignore it and always return JSON, which works until a client genuinely needs something else and gets JSON with a 200, silently. The honest answer to an unsatisfiable Accept header is a 406. Try it here The Protocol Lab negotiates for real: `GET /protocol/v1/export/documents` will produce JSON, CSV or XML depending on your Accept header, sets Content-Type to whatever it chose, and answers 406 rather than silently falling back when you ask for something it cannot make. The Friends API pairs it with a 415 on the way in. Related - HTTP 406 Not Acceptable - HTTP 415 Unsupported Media Type Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/safe-and-idempotent-methods TITLE: Safe vs idempotent HTTP methods — Fun API Playground ================================================================ Safe and idempotent methods A method is safe if it does not change server state: GET, HEAD and OPTIONS. A method is idempotent if making the same request many times has the same effect as making it once: GET, HEAD, OPTIONS, PUT and DELETE. Every safe method is idempotent; the reverse is not true, because a DELETE changes state and is still idempotent. How it works These properties are what make automatic retries possible. A proxy, a browser or an HTTP library may retry an idempotent request after a timeout without asking, because repeating it cannot make things worse. POST and PATCH are neither safe nor idempotent, which is why nothing retries them for you — and why an Idempotency-Key header exists, to give a POST the property it lacks by nature. The misconception That idempotent means "returns the same response". It means the same *effect* on the server. A second DELETE of the same resource is idempotent even though the first returns 204 and the second returns 404: the end state — the thing is gone — is identical. Try it here `GET /starfleet/v1/tribbles` is a deliberate anti-pattern: a GET that doubles the count every time you read it. It is the clearest demonstration here of what "safe" is protecting you from. Related - Testing idempotency keys and safe retries - What a REST API is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/cors TITLE: What is CORS? — Fun API Playground ================================================================ CORS Cross-Origin Resource Sharing is a browser security mechanism. By default a page may send a request to another origin but not read the response. CORS is the set of response headers by which the target server opts in, telling the browser that this particular origin is allowed to see the result. How it works For simple requests the browser sends the request, then withholds the response from the page unless Access-Control-Allow-Origin matches. For anything else — a custom header, a JSON content type, a method beyond GET/POST/HEAD — the browser first sends an OPTIONS preflight and only proceeds if the answer permits the method and headers it intends to use. Credentials require both Access-Control-Allow-Credentials and a specific origin, never the wildcard. The misconception That a CORS error means the request failed. Usually it succeeded — the server received it, acted on it and answered — and the browser refused to hand the response to your code. A "CORS error" on a POST can mean the record was created and you simply cannot see the confirmation. It is also not a server-side protection: anything that is not a browser ignores CORS entirely. Try it here Run any request in Live API mode from your own page and watch the preflight. A missing OPTIONS handler surfaces as a CORS failure in the console and a plain 405 in the network tab. Related - HTTP 405 Method Not Allowed - How the live API is served Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/api-endpoint TITLE: What is an API endpoint? — Fun API Playground ================================================================ API endpoint An endpoint is the combination of an HTTP method and a URL path that a server answers: GET /orders and POST /orders are two endpoints on the same resource. Documentation, access rules, rate limits and tests are all usually organised per endpoint, which makes it the unit people count when they size an API. How it works The path names the resource, path parameters pick out one instance (/orders/{id}), the query string narrows or shapes the result, and the method says what to do with it. The server routes each incoming request to the handler registered for that method and path pattern, and a request that matches a path but not a method is answered with 405 rather than 404. The misconception That an endpoint is a URL. The same URL with a different method is a different endpoint with different rules — GET /orders/7 may be public while DELETE /orders/7 needs an admin token. Testing one method and assuming the others behave alike is how authorization gaps survive review. Try it here Every docs page lists its endpoints with method, path and the status codes each can return; the Pizza API's DELETE /menu is a path that exists for GET but answers every DELETE with 405. Related - What a REST API is - HTTP 405 Method Not Allowed Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/http-status-codes TITLE: What are HTTP status codes? — Fun API Playground ================================================================ HTTP status codes A status code is the server's summary of the outcome of a request, in a form a program can act on without reading the body. The first digit is the class: 2xx succeeded, 3xx means look elsewhere, 4xx means the request was wrong, 5xx means the server failed. The remaining digits refine the meaning within that class. How it works Clients branch on the class first and the exact code second: a 2xx is processed, a 3xx is followed, a 4xx is reported back to whoever built the request, and a 5xx may be retried if the request was idempotent. Specific codes then carry specific instructions — 401 means authenticate, 429 means slow down, 412 means re-read before writing. The misconception That the body is the real answer and the code is decoration. Caches, proxies, retry logic, monitoring and browsers all act on the status line without reading the body; an API that returns 200 with {"error": …} is invisible to every one of them, and so is its failure rate. Try it here The status code index links one page per code this playground returns, each with endpoints that produce it. GET /faults/v1/status/{code} returns any code from 200 to 599 on request. Related - Every HTTP status code, with a live example - Negative testing: every error code on demand Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/put-vs-patch TITLE: PUT vs PATCH: what is the difference? — Fun API Playground ================================================================ PUT vs PATCH Both methods modify an existing resource, and they differ in what the body means. A PUT body is the complete new state: fields you leave out are, in principle, removed or reset. A PATCH body is a description of changes, in a format the server documents — a partial object, or a list of operations as in JSON Patch. How it works PUT is idempotent by definition: sending the same full representation twice leaves the same result. PATCH is not guaranteed to be, because an operation like "append to this list" or "increment" applied twice does something different from applying it once. That is why PATCH requests in particular benefit from If-Match, so a retried patch can be refused instead of doubled. The misconception That PATCH is just "PUT without the fields you did not change". Many APIs implement it that way, but nothing about the method says so — a merge-style PATCH and a JSON Patch document are both PATCH, with very different semantics. And many "PUT" endpoints in practice merge rather than replace, so test what yours actually does with a missing field. Try it here The Pizza API takes a partial update on PATCH /pizza/v1/orders/{id}, and the Protocol Lab accepts an RFC 6902 JSON Patch on PATCH /protocol/v1/documents/{id}; the character PUT endpoints replace and check If-Match. Related - What JSON Patch is - Safe and idempotent methods Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/query-parameters TITLE: What are query parameters? — Fun API Playground ================================================================ Query parameters Query parameters are the part of a URL after the question mark — ?status=open&sort=-created&limit=20. They do not identify a different resource; they modify the request for the one the path names, which is why they are the conventional home for filtering, sorting, pagination, search terms and output options. How it works Pairs are separated by & and each value is percent-encoded, so a space becomes %20 and an ampersand inside a value becomes %26. Repeated keys (?tag=a&tag=b) are legal but have no standard meaning — frameworks variously keep the first, the last or all of them. Because they are part of the URL, they end up in logs, browser history and caches. The misconception That unknown query parameters are harmless. Many APIs silently ignore a misspelled filter — ?stauts=open — and return everything, which looks like success and is a bug in the client. A strict API answers 400 instead; a test should check which kind yours is. Try it here The Search & Facets API rejects unknown query parameters on GET /search/v1/items, as does the Friends v1 character list. The Movies API combines filtering, sorting and pagination on GET /movies/v1/movies. Related - Testing pagination against a real API - HTTP 400 Bad Request Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/path-parameters TITLE: What is a path parameter? — Fun API Playground ================================================================ Path parameters A path parameter is a placeholder in an endpoint's path template — /orders/{id} — that the client fills in to address one instance. Unlike a query parameter it is part of the resource's identity: /orders/42 and /orders/43 are different resources, while /orders?status=open is a view of one. How it works The server matches the path against its templates, extracts the segment and validates it: a non-numeric id where a number is expected should be a 400, and a well-formed id with nothing behind it a 404. Values must be percent-encoded — a slash inside a value would otherwise split the path into a different route. The misconception That a 404 always means a typo in the URL. For a path parameter it more often means the resource was deleted, never existed, or exists but the caller may not know that — some APIs deliberately answer 404 instead of 403 so as not to confirm an id is real. Try it here Every API takes ids in the path. The Voxel Worlds API takes three at once on GET /voxel/v1/worlds/{id}/blocks/{x}/{y}/{z}, and the World Cup API uses a letter rather than a number on GET /worldcup/v1/groups/{letter}/standings. Related - HTTP 404 Not Found - Query parameters Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/http-headers TITLE: What are HTTP headers? — Fun API Playground ================================================================ HTTP headers Headers carry everything about a message that is not its content: who is calling (Authorization), what format the body is in (Content-Type), what format the client wants back (Accept), how long it may be cached (Cache-Control), which version it is (ETag) and when to try again (Retry-After). Names are case-insensitive; values are text. How it works A request or response is a start line, then headers one per line, then an empty line, then the body. Intermediaries read and add headers without touching the body — a proxy adds Via, a load balancer X-Forwarded-For, a CDN its own cache status. Many behaviours that look like API features are really header conventions. The misconception That asserting on the body is enough. Some of the most consequential bugs live only in headers: a missing Location after a 201, a Cache-Control that lets a private response be cached by a CDN, a Content-Type of text/html on a JSON body. They pass every body assertion. Try it here Every response in the docs panel shows its headers next to the body, and the assertion language reads them with headers. — try headers.etag exists on GET /football/v1/standings. Related - Content negotiation - What an ETag is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/openapi TITLE: What is OpenAPI? — Fun API Playground ================================================================ OpenAPI The OpenAPI Specification is a standard format for describing an HTTP API so that tools, not just people, can read it. One document lists every path and method, the parameters each takes, the request and response bodies as JSON Schema, the status codes and the authentication schemes. Swagger was its original name; OpenAPI 3.1 is the current major version. How it works From one document, tools generate interactive reference docs, client SDKs in many languages, server stubs, mock servers and contract tests. The same file can be checked in CI against the running API, so the description and the implementation cannot drift apart without a build failing. The misconception That an OpenAPI file proves the API behaves as described. It is a claim, not a test: nothing stops a handler from returning a field the spec never mentions or a status it never lists. Its value comes from being checked against real responses, which is what contract testing does. Try it here Every API here publishes its own OpenAPI 3.1 document at /docs/{api-id}/openapi.json, and /openapi.json covers the whole catalog; both are generated from the same definitions the docs pages render. Related - Contract testing - JSON Schema Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/postman-collection TITLE: What is a Postman collection? — Fun API Playground ================================================================ Postman collection A collection is the unit Postman organises work in: a folder tree of requests, each with its method, URL, headers, body and optional scripts, plus variables shared across them. Exported, it is a JSON file that another person, a CI job or Newman (Postman's command-line runner) can open and run. How it works Requests reference variables such as {{baseUrl}} and {{token}}, which come from an environment, so the same collection runs against local, staging and production. Test scripts attached to a request assert on its response and can set variables for the next one — capturing a token from a login, then using it in every later call. The misconception That a collection is documentation. It records what someone once sent, not what the API accepts; a collection can be months out of date and still run green if nobody added the request that would fail. Generating it from the API's OpenAPI document keeps it honest. Try it here Every docs page exports a Postman collection for that API, generated from the same definitions as its OpenAPI document. The workspace here works the same way: variables, captures and assertions per saved request. Related - What OpenAPI is - Getting started guide Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/graphql TITLE: What is GraphQL? — Fun API Playground ================================================================ GraphQL GraphQL replaces many resource URLs with one endpoint and a typed schema. The client sends a query describing the shape of the data it needs — this user, their last three orders, each order's total — and receives exactly that shape back. Writes are mutations, sent the same way. How it works The server validates each query against its schema before running it, then resolves each field, possibly from different data sources. Requests are usually POSTs with the query in a JSON body. Errors are reported in an errors array alongside whatever data could be resolved, typically with a 200 status for the HTTP request as a whole. The misconception That GraphQL replaces HTTP status codes. Because a partially failed query still returns 200, a client that checks only the status will miss field-level errors entirely; the errors array has to be inspected on every response. The same flexibility also means a single query can be very expensive, which is why production servers limit depth and complexity. Try it here POST https://funapi.dev/graphql runs queries and mutations over the Friends characters, with a GraphiQL explorer at the same URL; the Friends API docs page also runs it as POST /graphql in the Try it out panel. Related - What a REST API is - Friends API docs Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/oauth-2 TITLE: What is OAuth 2.0? — Fun API Playground ================================================================ What is OAuth 2.0? — Fun API Playground The standard framework for letting an application get a limited access token, instead of handling the user's password. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/client-credentials-grant TITLE: What is the OAuth client credentials grant? — Fun API ================================================================ Client credentials grant The client credentials grant is the OAuth 2.0 flow with no user in it. A backend service authenticates to the authorization server as itself, with a client ID and secret, and receives an access token representing the service's own permissions. It is the standard way for machines to call APIs on their own behalf. How it works The client POSTs grant_type=client_credentials, its credentials and optionally the scopes it wants to the token endpoint. The response contains an access token and its lifetime in expires_in. The client caches the token, uses it in an Authorization: Bearer header until shortly before it expires, then requests a new one — there is no refresh token in this flow. The misconception That it is safe in a browser or mobile app. The flow relies on the client keeping its secret, and anything shipped to a user's device cannot. Public clients use the authorization code flow with PKCE instead. Try it here POST /auth/v1/oauth/token with grantType client_credentials, clientId demo-client and clientSecret demo-secret returns a token that expires after 15 seconds. Use it on GET /auth/v1/oauth/protected-resource, capturing it with a variable to chain the two requests. Related - OAuth 2.0 - What a bearer token is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/pkce TITLE: What is PKCE? — Fun API Playground ================================================================ PKCE PKCE (pronounced "pixie") is an extension to the OAuth authorization code flow for clients that cannot keep a secret, such as single-page apps and mobile apps. It binds the authorization code to the client that requested it, so intercepting the code on its way back is not enough to exchange it for a token. How it works Before redirecting the user, the client generates a random code_verifier and sends only its SHA-256 hash, the code_challenge, with the authorization request. When it later exchanges the code for a token, it sends the original verifier. The server hashes it, compares it with the stored challenge and issues a token only if they match. The misconception That PKCE is only for mobile apps. Current OAuth security guidance recommends it for every client using the authorization code flow, confidential server-side ones included, because it also defends against authorization code injection. Try it here The Modern Identity API implements real S256 PKCE: POST /identity/v1/authorize with a codeChallenge, then POST /identity/v1/token with the codeVerifier — a verifier that does not hash to the challenge is refused with 400 invalid_grant. Related - OAuth 2.0 - Modern Identity API docs Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/refresh-token TITLE: What is a refresh token? — Fun API Playground ================================================================ Refresh token Access tokens are deliberately short-lived, so a stolen one is useful only briefly. A refresh token is the counterpart that lives longer: the client keeps it, never sends it to resource servers, and presents it to the authorization server alone when it needs a fresh access token. How it works When an API answers 401 because the access token expired — or just before it would — the client POSTs grant_type=refresh_token to the token endpoint and receives a new access token, often with a new refresh token that replaces the old one (rotation). Reusing a rotated refresh token is a signal of theft, and well-designed servers then revoke the whole chain. The misconception That refreshing on every 401 is correct. A 401 caused by a revoked or invalid token will fail again after a refresh; a client that refreshes and retries without a limit turns a logout into an infinite loop. Refresh once, retry once, and send the user to log in if that fails. Try it here POST /auth/v1/oauth/token issues a refresh token in the authorization code flow and accepts grantType refresh_token with that refreshToken to get a new access token. Access tokens here expire after 15 seconds, so the refresh path is reached quickly. Related - Testing auth tokens: expiry, refresh and roles - HTTP 401 Unauthorized Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/openid-connect TITLE: What is OpenID Connect? — Fun API Playground ================================================================ OpenID Connect OpenID Connect (OIDC) adds authentication to OAuth 2.0. Alongside the access token, the authorization server issues an ID token — a JWT whose claims identify the user (subject, issuer, audience, issue and expiry time) and that the client can verify with the provider's public keys. "Sign in with Google" and most enterprise single sign-on are OIDC. How it works A client discovers a provider's endpoints and capabilities from its discovery document at /.well-known/openid-configuration, requests the openid scope in an authorization code flow, receives an ID token, and validates its signature against the keys published at the provider's JWKS URL. It must also check the issuer, the audience and the expiry. The misconception That decoding the ID token is the same as validating it. Anyone can decode a JWT; trusting its claims requires checking the signature with the right key and confirming it was issued by the expected provider, for this client, and has not expired. Try it here The Modern Identity API serves a discovery document on GET /identity/v1/.well-known/openid-configuration and a key set on GET /identity/v1/jwks; the JWT decoder in the tools section shows what a token carries. Related - What a JWT is - JWT decoder Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/api-key TITLE: What is an API key? — Fun API Playground ================================================================ API key An API key is the simplest credential an API can issue: a long random string tied to an account or project, sent with every request — usually in a header such as X-API-Key, sometimes in the query string. It identifies who is calling, for billing, quotas and access control, but carries no expiry or scope of its own unless the server attaches them. How it works The server looks the key up on each request, rejects unknown ones with 401 and applies that key's quota and permissions. Keys are typically created in a dashboard, can be rotated by issuing a new one before revoking the old, and are often restricted to particular IP ranges, referrers or endpoints. The misconception That a key in a query string is as safe as one in a header. URLs are written to server logs, proxy logs and browser history and can leak through the Referer header; a header is not secret either, but it does not end up in nearly as many places. Try it here The Cargo Tracking API requires X-API-Key on its writes — POST /cargo/v1/shipments and the state-machine transitions — while its reads are open, so the same API shows both sides. Related - What a bearer token is - Cargo Tracking API docs Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/basic-authentication TITLE: What is HTTP Basic authentication? — Fun API Playground ================================================================ Basic authentication Basic authentication is the oldest HTTP authentication scheme. The client joins username and password with a colon, Base64-encodes the result and sends it as Authorization: Basic followed by that string. The server decodes it and checks the credentials on every request; there is no token and no session. How it works A server that wants credentials answers 401 with a WWW-Authenticate: Basic header, which is what makes a browser show its native login prompt. Because the credentials are on every request, the scheme is only acceptable over HTTPS, and it is still common for internal tools, CI webhooks, package registries and service-to-service calls with dedicated accounts. The misconception That Base64 is encryption. It is an encoding anyone can reverse in one line; over plain HTTP, Basic authentication sends the password in the clear. Its security comes entirely from TLS. Try it here This playground uses bearer tokens rather than Basic, which makes the contrast easy to see: compare GET /auth/v1/me with qa-admin-token, and decode a Basic header yourself in your browser console with atob(). Related - What a bearer token is - HTTP 401 Unauthorized Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/authentication-vs-authorization TITLE: Authentication vs authorization, explained — Fun API ================================================================ Authentication vs authorization Authentication (authn) establishes the identity of the caller — a password check, a verified token signature, a client certificate. Authorization (authz) takes that identity and decides whether this particular action on this particular resource is permitted. Every protected request goes through both, in that order. How it works HTTP gives each its own failure: 401 Unauthorized means authentication is missing or failed, so the client should obtain or refresh credentials; 403 Forbidden means the caller is known and the answer is still no, so trying again with the same identity is pointless. Roles, scopes and resource ownership are all authorization inputs. The misconception That 401 and 403 are interchangeable. The names are misleading — 401 is really "unauthenticated" — but the distinction drives client behaviour: a client that sends a user back to the login page on a 403 loops them through a login that cannot help. Try it here Use qa-viewer-token on any DELETE in the catalog to get a 403 from a known but under-privileged caller, and send no token at all to get the 401 — same endpoint, two different failures. Related - HTTP 401 Unauthorized - HTTP 403 Forbidden Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/oauth-scopes TITLE: What are OAuth scopes? — Fun API Playground ================================================================ OAuth scopes A scope is a string — read, orders:write, openid — that names a slice of access. A client asks for the scopes it needs, the user or policy grants some or all of them, and the issued token carries the granted set. Resource servers check the token's scopes before acting, so a token minted for reading cannot be used to delete. How it works Scopes travel in the scope parameter of the authorization or token request as a space-separated list, and come back in the token response — possibly narrower than requested. A JWT access token usually carries them in a scope or scp claim; an opaque token's scopes are found through introspection. The misconception That a token has the scopes you asked for. The server may grant fewer, and a client that assumes otherwise fails later, far from the cause. Read the scope field in the token response, and test what happens when a call needs a scope the token lacks. Try it here The token response from POST /auth/v1/oauth/token states the granted scope — read for client credentials, read write for the authorization code flow — and POST /identity/v1/introspect reports the scope of an Identity API token. Related - OAuth 2.0 - HTTP 403 Forbidden Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/jwks TITLE: What is a JWKS? — Fun API Playground ================================================================ JWKS A JWKS is a JSON document with a keys array, each entry a public key in JWK format with an identifier (kid), a key type and algorithm, and the key material. Identity providers publish one at a well-known URL so that every API receiving their tokens can verify signatures without sharing any secret. How it works A signed JWT names the key it was signed with in the kid field of its header. The verifier fetches the issuer's JWKS (usually found through the OpenID discovery document), picks the key with that kid, and checks the signature. Keys are rotated by publishing the new one alongside the old before switching, so verifiers should cache the set but refetch on an unknown kid. The misconception That the key set can be fetched once and baked into configuration. Providers rotate keys; a verifier with a hard-coded key starts rejecting every valid token on rotation day. The opposite mistake — fetching on every request — makes the identity provider a dependency of every call. Try it here GET /identity/v1/jwks returns the Modern Identity API's demo key set, and its discovery document at GET /identity/v1/.well-known/openid-configuration points to it, the way a real provider's does. Related - What a JWT is - OpenID Connect Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/retry-after TITLE: What is the Retry-After header? — Fun API Playground ================================================================ Retry-After Retry-After is the server's explicit instruction for when a retry may succeed. It accompanies 429 Too Many Requests, 503 Service Unavailable and some redirects, and holds either a number of seconds (Retry-After: 30) or an HTTP date. Honouring it is the difference between a client that recovers and one that prolongs the outage it is waiting out. How it works The client parses the value — both forms are valid and both occur — and schedules the retry no earlier than that. Where the header is absent, the client falls back to its own backoff policy. Good clients also cap the wait, so a misconfigured server cannot park them for a day. The misconception That a retry loop with a fixed one-second sleep is "handling 429". Every client doing that hits the server again in lockstep the moment the window opens. Retry-After, where present, already tells you the right number; where absent, use backoff with jitter. Try it here GET /coffee/v1/rush-hour allows three requests per ten seconds and answers the fourth with 429 and Retry-After; GET /protocol/v1/maintenance answers every request with 503 and Retry-After: 30. Related - Testing rate limiting and Retry-After - HTTP 429 Too Many Requests Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/exponential-backoff TITLE: What is exponential backoff with jitter? — Fun API ================================================================ Exponential backoff Exponential backoff spaces retries out by doubling the delay each time — 0.5 s, 1 s, 2 s, 4 s — up to a cap, giving a struggling server room to recover. Jitter randomises each delay, because without it every client that failed at the same moment retries at the same moment, recreating the spike that caused the failure. How it works A typical policy: wait a random time between zero and base × 2^attempt, capped at a maximum, and give up after a fixed number of attempts or total time. Only retry what is safe to retry — idempotent methods, or writes protected by an idempotency key — and only on failures that might be transient: timeouts, 429, 502, 503, 504. The misconception That more retries means more reliability. Unbounded retries amplify an outage: each layer that retries three times multiplies the load on the layer below. Retry budgets, caps and circuit breakers exist because retrying is itself a source of failure. Try it here Configure the Fault Injection API with PUT /faults/v1/config — say a failureRate of 0.5 and status 503 — then call GET /faults/v1/target repeatedly to watch your retry policy cope with a flaky dependency. Related - Retry-After - Fault injection Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/request-timeout TITLE: What is a request timeout? — Fun API Playground ================================================================ Request timeout A timeout is the client's own deadline. Without one, a request to a server that never answers can hold a connection, a thread and the user's patience indefinitely. Timeouts usually come in parts: how long to wait to connect, how long to wait for the first byte, and how long the whole exchange may take. How it works When the deadline passes, the client aborts and reports an error — in the browser through AbortController, in most libraries as a timeout exception. Every hop has its own: browser, CDN, load balancer, gateway and application. When an inner timeout is longer than an outer one, the outer layer gives up first and the work inside carries on with nobody waiting for it. The misconception That a timed-out request did not happen. The server may have received it and completed it after the client stopped listening; a timed-out POST may have created the order. Treat a timeout as "unknown outcome", and make writes safe to retry with an idempotency key. Try it here GET /protocol/v1/gateway-timeout waits about three seconds before answering 504, and GET /pizza/v1/oven/preheat takes about three seconds before succeeding — set a two-second client timeout and compare what each one does. Related - HTTP 504 Gateway Timeout - HTTP 408 Request Timeout Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/contract-testing TITLE: What is contract testing? — Fun API Playground ================================================================ Contract testing A contract is the set of interactions a consumer relies on: these requests, answered with responses of this shape and these status codes. Contract testing checks each side against that contract separately — the consumer against a mock built from it, the provider against the requests recorded in it — so incompatibilities are found before deployment rather than in an end-to-end environment. How it works In consumer-driven contract testing (Pact is the best-known tool), each consumer's tests produce a contract file; the provider's build replays every contract against the real service and fails if any expectation breaks. In schema-based contract testing, responses are validated against the API's OpenAPI document instead. The misconception That contract tests check behaviour. They check shape and protocol — that a field exists, has a type, comes with a status. Whether the price in that field is correct is a functional test's job. Teams that replace functional tests with contract tests ship well-formed wrong answers. Try it here Download any API's OpenAPI document from its docs page and validate the responses you get from Try it out against it; the assertion language can also pin a contract point by point, such as body.data.0.id exists. Related - What OpenAPI is - JSON Schema Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/json-schema TITLE: What is JSON Schema? — Fun API Playground ================================================================ JSON Schema A JSON Schema is itself a JSON document that states the rules another document must follow: its type, which properties it has, which are required, what types and formats their values take, how long strings and arrays may be. Validators in every major language check a document against a schema and report each violation. How it works Keywords such as type, properties, required, items, enum, format and pattern combine to describe a shape; $ref reuses definitions. OpenAPI 3.1 uses JSON Schema (draft 2020-12) for its request and response bodies, so an API description is also a set of validators for its own traffic. The misconception That additionalProperties defaults to false. By default a schema allows properties it does not mention, which means a response full of unexpected fields still validates. Strict contract checks have to say additionalProperties: false — or accept that extra fields are not being caught. Try it here Each API's OpenAPI document embeds JSON Schemas for its bodies; paste a response from Try it out into the sibling site's JSON to JSON Schema generator to get a schema inferred from the data itself. Related - What OpenAPI is - JSON to JSON Schema generator (fundata.dev) Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/api-versioning TITLE: What is API versioning? — Fun API Playground ================================================================ API versioning A breaking change — a renamed field, a removed endpoint, a different error shape — would fail every client built against the old behaviour. Versioning lets the provider ship the new behaviour as a new version while the old one keeps working, and gives clients a period in which to migrate. How it works The version is usually carried in the URL path (/v1/, /v2/), sometimes in a header or the Accept media type, occasionally as a date. Non-breaking changes — new optional fields, new endpoints — ship within a version. When an old version is retired, the provider announces it in advance, often with Deprecation and Sunset headers on its responses. The misconception That adding a field is always safe. It is for clients that ignore unknown fields, and breaks those with strict deserialisers or snapshot tests. What counts as "breaking" depends on what clients actually do, which is why providers publish their compatibility rules. Try it here The Friends API runs both versions: GET /friends/v1/characters is marked deprecated, and GET /friends/v2/characters renames job to occupation and re-wraps the list; GET /friends/version lists what is supported. Related - Deprecation and Sunset headers - Friends API docs Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/deprecation-and-sunset TITLE: What are the Deprecation and Sunset headers? — Fun API ================================================================ Deprecation and Sunset headers Deprecation tells a client that the endpoint it just called is deprecated — it still works, but should no longer be used. Sunset gives the date after which it may stop responding. Together with a Link header pointing at the replacement, they let an API announce a retirement inside the traffic itself, where client code can notice it. How it works Clients and gateways can log or alert when either header appears, so a team learns it depends on a retiring endpoint while there is still time. Sunset holds an HTTP date. A Link header with rel="successor-version" or rel="deprecation" points to the replacement or to migration documentation. The misconception That deprecation notices in a changelog are enough. Nobody reads the changelog of every API they call; headers on the responses reach the code that is actually affected, and a test asserting their absence will fail the day they appear. Try it here GET /friends/v1/characters answers with Deprecation, Sunset and a Link header pointing at the v2 endpoint; assert on them in the Expectations editor with headers.deprecation exists. Related - API versioning - HTTP headers Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/cache-control TITLE: What is the Cache-Control header? — Fun API Playground ================================================================ Cache-Control Cache-Control carries caching instructions as comma-separated directives. max-age=60 says the response is fresh for a minute; no-store forbids storing it at all; private allows only the user's own browser to keep it; public allows shared caches; no-cache allows storing but requires revalidation before every reuse. How it works A cache serves a fresh response without contacting the server. Once it is stale, the cache revalidates with a conditional request — If-None-Match with the stored ETag — and the server answers 304 Not Modified if nothing changed, saving the body. s-maxage sets a separate lifetime for shared caches such as CDNs. The misconception That no-cache means "do not cache". It means "check with me before using a cached copy"; the directive that forbids storage is no-store. Mixing them up either leaks private data into shared caches or throws away caching that was safe. Try it here GET /football/v1/standings and GET /bank/v1/exchange-rates both send Cache-Control with an ETag; repeat the request with If-None-Match set to that ETag and the answer is a bodiless 304. Related - What an ETag is - HTTP 304 Not Modified Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/range-requests TITLE: What is an HTTP range request? — Fun API Playground ================================================================ Range requests A range request adds a Range header such as bytes=0-1023 to a GET. A server that supports ranges answers 206 Partial Content with just those bytes and a Content-Range header saying which part of the whole they are. Servers advertise support with Accept-Ranges: bytes; one that ignores the header simply returns the whole resource with 200. How it works Download managers resume an interrupted transfer by requesting bytes=- ; video players request the range around the position the viewer seeks to; large files can be fetched in parallel chunks. A range the server cannot satisfy — beyond the end of the resource, or malformed — gets 416 Range Not Satisfiable. The misconception That a 200 to a range request is an error. It is a valid answer meaning the server does not do ranges; a client has to handle both and must not append a full body to a partial download it believes is being resumed. Try it here GET /storage/v1/objects/{key} accepts Range: bytes=start-end, answering 206 with the slice, 416 for a range past the end or a malformed one, and 200 with the whole object when no Range is sent. Related - HTTP 206 Partial Content - HTTP 416 Range Not Satisfiable Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/multipart-form-data TITLE: What is multipart/form-data? — Fun API Playground ================================================================ multipart/form-data multipart/form-data is the media type browsers use when a form includes a file input, and the conventional way to upload files to an API. The body is divided into parts, each with its own headers — a name, optionally a filename and a Content-Type — so text fields and binary files travel together in one request. How it works The Content-Type header declares a boundary string, and the body is the parts separated by that boundary. Clients should let their HTTP library build the body and set the header, boundary included; servers check each part's declared type and size, answering 415 for a file type they do not accept and 413 for one that is too large. The misconception That setting Content-Type: multipart/form-data by hand is helpful. Without the boundary parameter the server cannot split the body, and the upload fails in a confusing way. With fetch and FormData, the right move is to not set the header at all. Try it here POST /movies/v1/movies/{id}/poster simulates a multipart poster upload, answering 415 for an unsupported image type and 413 for an oversized one — the two checks every upload endpoint needs. Related - HTTP 415 Unsupported Media Type - HTTP 413 Content Too Large Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/media-type TITLE: Media type and Content-Type, explained — Fun API Playground ================================================================ Media type (Content-Type) A media type (formerly MIME type) names a data format: application/json, text/csv, image/png, multipart/form-data. Content-Type states the media type of the body actually being sent; Accept states which media types the sender is willing to receive. Parameters refine it, as in text/csv; charset=utf-8. How it works Servers use the request's Content-Type to choose a parser and answer 415 Unsupported Media Type when they have none for it. Clients use the response's Content-Type to decide how to read the body. Structured suffixes such as application/problem+json signal "this is JSON with a known structure". The misconception That the body speaks for itself. A JSON body sent as text/plain — a common default in some HTTP clients — will be refused or misread by a strict server, and a JSON response labelled text/html can be interpreted as a web page by a browser, which is a security problem as well as a bug. Try it here The Movies poster upload answers 415 for a type it does not accept, and GET /protocol/v1/export/documents returns JSON, CSV or XML depending on Accept, answering 406 for anything else. Related - Content negotiation - HTTP 415 Unsupported Media Type Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/server-sent-events TITLE: What are Server-Sent Events? — Fun API Playground ================================================================ Server-Sent Events (SSE) Server-Sent Events let a server push updates to a client without the client polling. The client makes one GET with Accept: text/event-stream; the server keeps the response open and writes events as they happen, each as a few lines of text with optional id and event fields. Browsers expose it through the EventSource API. How it works Each event is data: lines followed by a blank line. If the connection drops, EventSource reconnects automatically and sends the id of the last event it saw in a Last-Event-ID header, so the server can resume from there without gaps. Servers send periodic comment lines as heartbeats to keep proxies from closing idle connections. The misconception That WebSockets are always the better choice. SSE is plain HTTP — it passes through proxies and load balancers that block WebSocket upgrades, needs no special server, and reconnects with resume built in. For server-to-client updates such as notifications, progress and feeds, it is usually the simpler tool. Try it here GET /streams/v1/events answers as JSON or, with Accept: text/event-stream, as an event stream; send Last-Event-ID to resume after a given event, and POST /streams/v1/events to publish one. Related - Event Streams API docs - What a webhook is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/json-patch TITLE: What is JSON Patch? — Fun API Playground ================================================================ JSON Patch JSON Patch is a JSON array of operations — add, remove, replace, move, copy and test — each naming a location in the target document with a JSON Pointer such as /tags/0. Sent as the body of a PATCH request with Content-Type application/json-patch+json, it tells the server exactly what to change rather than sending a new copy of the whole resource. How it works Operations apply in order, and the patch is meant to be atomic: if any operation fails, none of them should take effect. The test operation is a built-in precondition — "only apply this patch if /status is still draft" — which makes JSON Patch a lightweight form of optimistic concurrency at the field level. The misconception That a partial JSON object sent with PATCH is JSON Patch. That is JSON Merge Patch (RFC 7396), a different format where null means "delete this field" and arrays can only be replaced whole. Servers usually accept one or the other, and the Content-Type is how they tell them apart. Try it here PATCH /protocol/v1/documents/{id} takes an RFC 6902 array: add, replace, remove and test on /title, /body and /tags — a failing test answers 409, and a body that is not an array answers 400. Related - PUT vs PATCH - HTTP 409 Conflict Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/soft-delete TITLE: What is a soft delete, and why does it return 410? — Fun API ================================================================ Soft delete A soft delete flags a record — deleted_at, status: deleted — instead of removing the row. The data stays for auditing, undo and referential integrity, while the API treats it as gone. That lets the API answer 410 Gone for a deleted resource, which is more informative than 404 Not Found: it says the identifier was valid and the thing is deliberately no longer available. How it works Every read has to exclude flagged rows, including list endpoints, search and counts. A GET on a soft-deleted id returns 410, a second DELETE returns 410 or 404 rather than 204, and a purge job eventually removes the data for good, often after a retention period that privacy law may dictate. The misconception That soft-deleted data is gone. It is still in the database, in backups and often in search indexes; for personal data, a soft delete alone does not satisfy an erasure request. And a list endpoint that forgets the filter resurrects deleted records for every client. Try it here DELETE /protocol/v1/documents/{id} as admin, then GET the same id: the answer is 410, not 404. The Shop API's expired coupons and the World Cup and FIBA cancelled tickets answer 410 the same way. Related - HTTP 410 Gone - HTTP 404 Not Found Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/batch-requests TITLE: Batch API requests and 207 Multi-Status — Fun API Playground ================================================================ Batch requests A batch endpoint accepts an array of items — records to create, ids to delete — in a single request, saving a round trip per item. Because some items can succeed while others fail, the response reports each one separately, and 207 Multi-Status is the status code for exactly that situation: "look inside, the outcomes differ". How it works The response body lists a status per item, usually in the same order as the request or keyed by an id the client supplied. Designs differ on atomicity: some batches are all-or-nothing and answer a single 4xx if any item is invalid; others commit what they can and report the rest. The API has to document which. The misconception That a 2xx on a batch means everything worked. 207 is in the success class, and a client that checks only response.ok will report success while half its records were rejected. Batch clients must iterate the per-item results. Try it here POST /friends/v1/characters/bulk validates each item separately and answers 207 when some fail, and POST /friends/v1/characters/bulk-delete reports partial success the same way; send one bad item among good ones to see it. Related - HTTP 207 Multi-Status - HTTP status codes Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/state-machine TITLE: What is a resource state machine in an API? — Fun API ================================================================ Resource state machine Many resources have a lifecycle: an order is placed, paid, shipped and delivered; a launch is scheduled, scrubbed or flown. Modelling it as a state machine means listing the states and the transitions allowed between them, and refusing everything else — you cannot ship an order that was never paid, or cancel one that was delivered. How it works Transitions are usually exposed as actions — POST /orders/7/cancel — or as an update to a status field that the server validates. An illegal transition answers 409 Conflict, because the request is well-formed but conflicts with the resource's current state. HATEOAS-style responses can include only the links for transitions that are currently legal. The misconception That status is just another field. A client that sets status freely through a generic PUT can skip states the business depends on — refunds without cancellations, deliveries without shipments. The transitions, not the field, are the contract. Try it here The Cargo Tracking API is a full state machine: POST /cargo/v1/shipments/{id}/advance moves a parcel one step and answers 409 at the end of the line, and three failed delivery attempts return it to sender. Related - HTTP 409 Conflict - What HATEOAS is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/fault-injection TITLE: What is fault injection? — Fun API Playground ================================================================ Fault injection Fault injection makes a dependency misbehave on purpose so the code that depends on it can be tested against the failures it will eventually meet: slow answers, intermittent 5xx errors, timeouts, malformed bodies. It is the controlled, repeatable end of the spectrum that runs up to chaos engineering in production. How it works Faults are injected at a boundary the code under test cannot see past — a mock server, a proxy, a service mesh rule, a feature flag in the dependency itself. The test then asserts on behaviour: that retries happen and stop, that a timeout fires, that a fallback is shown, that no half-written state is left behind. The misconception That random failures make a good test. A test that fails one run in four is a flaky test. Useful fault injection is deterministic — this request fails, that one is slow — or at least seeded, so a failure can be reproduced and a fix verified. Try it here The Fault Injection API is configured with PUT /faults/v1/config — latency, a status code, a failure rate, malformed JSON — and GET /faults/v1/target then misbehaves exactly as configured, inside your own sandbox. Related - Fault Injection API docs - Flaky tests Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/test-doubles TITLE: Mock vs stub vs fake: what is the difference? — Fun API ================================================================ Mocks, stubs and fakes A test double replaces a real dependency in a test. A stub returns canned answers and checks nothing. A mock is a stub that also records how it was called, so the test can assert the interaction happened — "charge was called once with 20". A fake is a working, simplified implementation, such as an in-memory database or an API that keeps state. How it works Stubs suit tests that only need the dependency to answer. Mocks suit tests where the call itself is the behaviour being verified. Fakes suit tests that exercise sequences — create, then read, then update — where canned answers would have to anticipate every step. In HTTP testing, all three are often loosely called "mock APIs". The misconception That more mocking means better isolation. Over-mocked tests assert on how code is written rather than what it does, and break on every refactor while missing real integration bugs. A fake that behaves like the real service often catches more with less setup. Try it here This playground is a fake in the strict sense: writes persist in your sandbox, so a POST is visible to a later GET, versions advance, and stock runs out — behaviour a stub cannot have. Related - What a mock API is - API sandbox Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/test-fixture TITLE: What is a test fixture? — Fun API Playground ================================================================ Test fixture A fixture is everything a test assumes before it begins: the records in the database, the files on disk, the responses a mock will give. Tests are only repeatable if their fixtures are — a test that passes against yesterday's leftover data and fails on a clean environment is testing the leftovers. How it works Fixtures are created in setup and removed or reset in teardown, or each test runs against a fresh copy. They can be hand-written for the edge cases that matter, generated in bulk for volume and variety, or captured from a real system and scrubbed. Seeded generation gives both variety and repeatability. The misconception That production data makes the best fixture. Copied data brings personal information into test environments, changes under you, and rarely contains the edge cases you need. Generated data with a fixed seed is safer and can be made to contain exactly the awkward cases. Try it here POST /data/v1/generate returns deterministic fixture rows from a schema, and every sandbox here can be reset with POST /api/_reset so each test run starts from the same seed data; the sibling site fundata.dev generates larger fixtures as files. Related - Fun Data Bridge API docs - QA test data (fundata.dev) Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/api-sandbox TITLE: What is an API sandbox? — Fun API Playground ================================================================ API sandbox A sandbox is an environment that behaves like the real API but is cut off from real consequences: payments are not charged, emails are not sent, shipments do not move. Payment providers, banks and shipping companies offer sandboxes so integrations can be built and tested without risk. How it works Sandboxes usually have their own base URL or credentials, seed data and test values that trigger specific outcomes — a card number that is always declined, an amount that always times out. Data in one developer's sandbox is isolated from another's, and can be reset to a known state. The misconception That passing in the sandbox means passing in production. Sandboxes simplify: they skip fraud checks, approve instantly, run with generous rate limits and old API versions. Treat them as a place to exercise behaviour, and keep a small set of production smoke tests for the differences. Try it here Every request here is isolated by an X-Sandbox-ID header, so your writes are invisible to other people's tests; reset yours from any docs page or with POST /api/_reset. Related - How caller data is isolated - Mocks, stubs and fakes Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/curl TITLE: What is cURL? — Fun API Playground ================================================================ cURL curl sends a request from the terminal and prints the response: method with -X, headers with -H, a body with -d, and -i to show the response headers. Because a curl command spells out every part of a request, it has become the standard way to share one — in documentation, bug reports and the "Copy as cURL" option of every browser's developer tools. How it works -d implies POST and a form content type unless you set -H "Content-Type: application/json". -L follows redirects, -v shows the whole exchange including TLS, and --fail makes curl exit non-zero on a 4xx or 5xx so it can gate a script. Single quotes around the body keep the shell from interpreting it. The misconception That curl and a browser send the same request. A browser adds cookies, an Origin, CORS preflights and its own User-Agent; curl sends only what you write. A call that works in curl and fails in the browser is very often a CORS or cookie problem, not an API bug. Try it here Every endpoint's Try it out panel generates the curl command for the request you configured, and the curl converter in the tools section turns any curl command into code in nine languages. Related - curl to code converter - What CORS is Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/correlation-id TITLE: What is a request ID or correlation ID? — Fun API Playground ================================================================ Request ID (correlation ID) A request ID is generated at the edge — by the load balancer, the gateway or the first service — and returned in a response header such as X-Request-Id. Every log line written while handling that request carries it, and when the request fans out to other services the ID travels with it, so the whole path can be reassembled later. How it works Clients should log the ID with any error they report, and include it in bug reports; support can then find the exact server-side logs in seconds. Distributed tracing standards such as W3C Trace Context (the traceparent header) formalise the same idea, adding parent and child spans for timing. The misconception That a timestamp and an endpoint are enough to find a request in the logs. On a busy system there are thousands of identical calls per second. Without the ID, "it failed around 10:42" is a search, not a lookup. Try it here The live backend sets an X-Request-Id header on every response and includes the same requestId in JSON bodies — including in its 500 errors, where it is the only detail it exposes. Related - HTTP 500 Internal Server Error - HTTP headers Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/flaky-tests TITLE: What is a flaky test? — Fun API Playground ================================================================ Flaky tests A flaky test gives different results for the same code. Common causes in API testing are timing — asserting before an asynchronous job finishes — shared state between tests, data left over from earlier runs, real network calls, unseeded random data, and dependence on the current date or time zone. How it works Flakiness is diagnosed by rerunning the same commit until the failure reproduces and comparing what differed. It is fixed by removing the source of variation: wait for a condition instead of a fixed time, give each test its own data, seed generators, freeze clocks, and replace live dependencies with a fake or a sandbox you control. The misconception That an automatic retry fixes a flaky test. Retries hide the symptom and keep the cause; they also hide real intermittent bugs in the product — a race condition looks exactly like a flaky test. Quarantine and fix, rather than retry and forget. Try it here POST /protocol/v1/jobs returns 202 and the job progresses on each poll of GET /protocol/v1/jobs/{id} — a good place to practise waiting for a condition instead of sleeping. Reset the sandbox between runs to keep state from leaking. Related - Testing async jobs and 202 Accepted - Test fixture Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/api-gateway TITLE: What is an API gateway? — Fun API Playground ================================================================ API gateway An API gateway is a reverse proxy specialised for APIs. Clients call the gateway; it decides which backend service handles the request and applies the cross-cutting rules every service would otherwise implement for itself — authentication, quotas, request size limits, CORS, request IDs, caching and metrics. How it works Routes map paths and methods to upstream services. Policies run before and after the upstream call: verify the token, check the rate limit, forward, then add headers and log. Because the gateway sits in the path, many errors a client sees — 401, 413, 429, 502, 504 — come from the gateway rather than from the service the client meant to call. The misconception That a 502 or 504 is the application's fault, or that it is not. Both are produced by the gateway about its upstream: 502 means the service answered with something invalid or dropped the connection, 504 that it did not answer in time. The gateway's logs and the request ID are where to start. Try it here GET /protocol/v1/gateway-timeout behaves like a gateway in front of a slow upstream, answering 504 after about three seconds; GET /faults/v1/status/502 returns the bad-gateway case on demand. Related - HTTP 502 Bad Gateway - HTTP 504 Gateway Timeout Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/boundary-value-analysis TITLE: What is boundary value analysis in API testing? — Fun API ================================================================ Boundary value analysis Boundary value analysis is a test design technique: for any input with limits — a rating from 0 to 10, a page size up to 100, a name up to 50 characters — test the values exactly at each limit and just either side of it. Bugs cluster at boundaries because that is where comparisons are written, and < versus <= is easy to get wrong. How it works For a range of 0 to 10 inclusive, the interesting inputs are −1, 0, 1, 9, 10 and 11: the two limits, their inside neighbours and their outside neighbours. The outside values should be rejected — usually with 400 or 422 — and the inside ones accepted. The same applies to lengths, dates, counts and sizes. The misconception That testing a typical value plus one invalid value covers the rule. A test with 5 and 999 passes against code that accepts 10.5, rejects 10 or allows 11. Only the values at the edge distinguish a correct boundary from a nearly correct one. Try it here PUT /movies/v1/movies/{id}/rating accepts 0 to 10 inclusive — try −1, 0, 10 and 11 — and the Starfleet API rejects a warp factor above 9.9 on PUT /starfleet/v1/ships/{id}/warp. Related - Negative testing: every error code on demand - HTTP 422 Unprocessable Content Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/glossary/smoke-testing TITLE: What is a smoke test? — Fun API Playground ================================================================ Smoke testing A smoke test answers one question quickly: is this build or deployment fundamentally working? For an API that usually means the service starts, health checks pass, authentication works, and a handful of critical endpoints answer with the right status and shape. If smoke fails, there is no point running the full suite. How it works Smoke tests run right after a deploy — often against production itself — and before longer suites in CI. They touch every major dependency once (database, cache, auth provider, payment sandbox) with read-only or self-cleaning calls, and they are kept short enough that nobody is tempted to skip them. The misconception That a smoke test is a small regression suite. Its job is breadth, not depth: one call through each critical path beats twenty variations of one endpoint. A smoke suite that grows to forty minutes has stopped being a smoke suite. Try it here A good first smoke check here: GET /pizza/v1/menu, POST /auth/v1/login, and GET /auth/v1/me with the token it returns — three calls touching public reads, authentication and authorization. Related - API testing challenges - Getting started guide Other terms - Mock API — A stand-in for a real API that returns realistic responses without the real system behind it. - REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods. - ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes. - HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next. - Bearer token — A credential where possession alone grants access — whoever holds it can use it. - JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup. All glossary terms · Testing techniques · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary TITLE: API Test Sözlüğü — Fun API Playground ================================================================ API test sözlüğü Bu API’lerin çalıştırdığı kavramlar: her biri bir paragrafta tanımlanıyor, sonra çağırabileceğiniz bir uç noktayla gösteriliyor. Her madde, o kavram hakkında insanların gerçekte tuttuğu yanlış inanışı da söylüyor — çünkü tanımı okumakla doğru anlamak arasında duran şey genellikle odur. - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. - Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı. - HMAC imzası — Bir yükün, paylaşılan gizli anahtarı bilen birinden geldiğini ve değiştirilmediğini kanıtlayan anahtarlı özet. - İçerik uzlaşımı — İstemci ile sunucunun yanıtın biçiminde, ayrı adresler üzerinden değil başlıklarla anlaşması. - Güvenli ve idempotent metotlar — Bir istemcinin neyi yeniden deneyebileceğini belirleyen, birbirinden bağımsız iki HTTP metodu özelliği. - CORS — Bir kaynaktaki JavaScript’in başka bir kaynaktan gelen yanıtı okuyup okuyamayacağına karar veren tarayıcı kuralı. - API uç noktası (endpoint) — Bir URL ile bir HTTP metodunun birleşimi — bir istemcinin çağırabileceği en küçük API birimi. - HTTP durum kodları — Her HTTP yanıtının başındaki, gövdeden önce ne olduğunu söyleyen üç haneli sayı. - PUT ile PATCH farkı — PUT kaynağı gönderdiğiniz temsille değiştirir; PATCH ise ona bir değişiklik kümesi uygular. - Sorgu parametreleri — URL’deki ? işaretinden sonra gelen, bir uç noktanın döndürdüğünü filtrelemek, sıralamak ya da sayfalamak için kullanılan anahtar=değer çiftleri. - Yol parametreleri — Bir URL yolunun, /orders/42’deki 42 gibi, belirli bir kaynağı tanımlayan değişken parçası. - HTTP başlıkları — Her istek ve yanıtla birlikte, gövdeden ayrı olarak gönderilen ad–değer üst verisi. - OpenAPI — Bir HTTP API’sinin yollarını, parametrelerini, gövdelerini ve yanıtlarını JSON ya da YAML olarak anlatan, makinenin okuyabildiği tarif. - Postman koleksiyonu — Başlıkları, gövdeleri, değişkenleri ve testleriyle birlikte, Postman’in JSON biçiminde kaydedilmiş ve paylaşılabilir API istekleri grubu. - GraphQL — İstemcinin tam olarak istediği alanları adlandırdığı, genellikle tek bir uç nokta üzerinden çalışan bir API sorgu dili. - OAuth 2.0 — Bir uygulamanın kullanıcının şifresiyle uğraşmak yerine sınırlı bir erişim token’ı almasını sağlayan standart çerçeve. - Client credentials grant — Bir servisin başka bir servisi çağırdığı OAuth akışı: istemci kendi kimliğini ve gizli anahtarını bir erişim token’ı ile takas eder. - PKCE — Proof Key for Code Exchange — çalınan bir OAuth yetkilendirme kodunun başkası tarafından kullanılmasını engelleyen tek seferlik bir gizli değer. - Refresh token — Kullanıcıdan yeniden giriş istemeden yeni, kısa ömürlü erişim token’ları almak için kullanılan uzun ömürlü kimlik bilgisi. - OpenID Connect — OAuth 2.0’ın üzerine eklenen ve istemciye kullanıcının kim olduğunu imzalı bir ID token ile söyleyen kimlik katmanı. - API anahtarı — Çağıran uygulamayı tanımlayan ve her istekle gönderilen sabit, gizli bir dize. - Basic kimlik doğrulama — Her istekle kullanıcı adı ve şifreyi, Base64 ile kodlanmış olarak Authorization başlığında göndermek. - Kimlik doğrulama ile yetkilendirme — Kimlik doğrulama kim olduğunuzu kanıtlar; yetkilendirme ne yapmanıza izin verildiğine karar verir. - OAuth kapsamları (scopes) — Bir erişim token’ına iliştirilen ve neye kullanılabileceğini sınırlayan adlandırılmış izinler. - JWKS — JSON Web Key Set — bir yayımlayıcının, imzaladığı token’ları herkesin doğrulayabilmesi için yayımladığı açık anahtarlar. - Retry-After — İstemciye yeniden denemeden önce ne kadar beklemesi gerektiğini saniye ya da tarih olarak söyleyen yanıt başlığı. - Üstel geri çekilme (exponential backoff) — Her beklemenin bir öncekinden uzun olduğu ve istemcilerin aynı anda yeniden denememesi için rastgelelik eklenen bir yeniden deneme stratejisi. - İstek zaman aşımı — Bir istemcinin isteği bırakmadan önce yanıt için bekleyeceği en uzun süre. - Sözleşme testi (contract testing) — Bir API ile tüketicilerinin, birlikte çalıştırılmadan, istek ve yanıtların biçiminde anlaştığını test etmek. - JSON Schema — Geçerli bir JSON belgesinin nasıl göründüğünü anlatan, böylece belgelerin otomatik doğrulanabildiği bir JSON sözlüğü. - API sürümleme — Geriye uyumsuz değişiklikler mevcut istemcileri bozmasın diye bir API’nin birden fazla sürümünü yan yana çalıştırmak. - Deprecation ve Sunset başlıkları — İstemciyi bir uç noktanın kaldırılmak üzere olduğu ve ne zaman çalışmayı bırakacağı konusunda uyaran yanıt başlıkları. - Cache-Control — Tarayıcılara, CDN’lere ve proxy’lere bir yanıtın saklanıp saklanamayacağını, kim tarafından ve ne kadar süreyle saklanabileceğini söyleyen başlık. - Aralık istekleri (range requests) — Bir kaynağın yalnızca bir parçasını — bir bayt aralığını — istemek; böylece indirmeler kaldığı yerden devam edebilir ve medya ileri sarılabilir. - multipart/form-data — Dosyaları form alanlarıyla birlikte tek bir istekte yüklemek için kullanılan istek gövdesi biçimi. - Medya türü (Content-Type) — Bir gövdenin hangi biçimde olduğunu söyleyen ve Content-Type içinde taşınan etiket — application/json gibi. - Server-Sent Events (SSE) — Açık kalan sıradan bir HTTP yanıtı üzerinden sunucudan istemciye tek yönlü olay akışı. - JSON Patch — Bir JSON belgesindeki değişiklikleri bir işlem listesi olarak anlatan standart biçim (RFC 6902). - Yumuşak silme (soft delete) — Bir kaydı silmek yerine silinmiş olarak işaretlemek; böylece API onun hiç var olmadığını değil, artık olmadığını söyleyebilir. - Toplu (batch) istekler — Birden çok işlem taşıyan ve her işlem için ayrı bir sonuçla yanıtlanan tek bir istek. - Kaynak durum makinesi — Tanımlı durumlar — oluşturuldu, kargolandı, teslim edildi — arasında ilerleyen ve yalnızca bazı geçişlere izin verilen bir kaynak. - Hata enjeksiyonu (fault injection) — Bir sistemin nasıl başa çıktığını test etmek için bilerek hatalar — hata kodları, gecikme, bozuk yanıtlar — sokmak. - Mock, stub ve fake — Gerçek bir bağımlılığın yerine geçen üç tür test dublörü; ne yaptıkları ve neyi kontrol ettikleri bakımından farklıdırlar. - Test fikstürü (fixture) — Bir testin başladığı, her çalıştırmada aynı şekilde kurulan bilinen veri ve durum. - API sandbox — Çağrıların gerçek dünyada etkisi olmadığı ve verinin sıfırlanabildiği, bir API’nin yalıtılmış kopyası. - cURL — HTTP istekleri yapmak için kullanılan komut satırı aracı; bir API çağrısını birebir paylaşmanın ortak dili. - İstek kimliği (correlation ID) — Bir isteğe ve onun loglarına iliştirilen benzersiz kimlik; tek bir çağrının dokunduğu her servis boyunca izlenebilmesini sağlar. - Titrek testler (flaky tests) — Test ettiği kodda hiçbir değişiklik olmadan bazen geçen, bazen başarısız olan test. - API ağ geçidi (API gateway) — Bir ya da daha çok servisin önünde duran ve yönlendirme, kimlik doğrulama, hız sınırlama ve loglamayı üstlenen tek giriş noktası. - Sınır değer analizi — Test girdilerini, izin verilenin kenarlarında ve hemen çevresinde seçmek — bir eksik/bir fazla hataların yaşadığı yer. - Smoke test — Daha kapsamlı her şeyden önce çalıştırılan ve en önemli yolların hiç çalışıp çalışmadığını kontrol eden küçük, hızlı kontroller kümesi. Read this page in English Test teknikleri · Her HTTP durum kodu · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/mock-api TITLE: Mock API nedir? — Fun API Playground ================================================================ Mock API Bir mock API, isteklere gerçek bir servisin döneceği gibi cevap verir — aynı adresler, aynı durum kodları, aynı yanıt biçimleri — ama gerçek servisin bağlı olduğu hiçbir şeye ihtiyaç duymadan. Var olma sebebi, gerçek servis hazır değilken bir istemcinin yazılabilmesi, gösterilebilmesi ya da test edilebilmesi; ya da gerçeğini çağırmanın yavaş, pahalı, kotalı veya geri alınamaz olması. Nasıl çalışır Mock’lar kabaca üç biçimde gelir. Statik mock her seferinde aynı hazır yanıtı döner. Yapılandırılabilir mock, her uç nokta için ne döneceğini sizin bildirmenize izin verir. Simüle edilmiş mock — bu oyun alanının olduğu tür — gerçekten durum tutar: POST ettiğiniz şeyi sonraki GET bulur, DELETE onu siler, stok seviyesi, koltuk doluluğu ve sürüm çakışması gibi kısıtlar anlatılmaz, uygulanır. Yaygın yanılgı Yaygın varsayım, mock’un hata yönetimini sınayamayacağıdır, çünkü mock her zaman başarılı olur. Bu, mock’lamanın değil çoğu mock’un özelliğidir. Oysa asıl değerli olan hata yollarıdır — 409, 412, 429, 503 — çünkü bunları gerçek bir serviste kasten üretmek en zor olanıdır. Sadece 200 dönen bir API, tam da bu yüzden zayıf bir alıştırma hedefidir. Burada deneyin Buradaki her API iki şekilde çalışır: hiç ağ kullanmadan tamamen tarayıcınızın içinde, ya da HTTPS üzerinden canlı bir arka uca karşı. Tarayıcıdaki motor aynı koddur, dolayısıyla yanıtlar birebir örtüşür. İlgili - Negatif test: istediğiniz an her hata kodu - Bu oyun alanı gerçekte nasıl sunuluyor Diğer terimler - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. - Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/rest-api TITLE: REST API nedir? — Fun API Playground ================================================================ REST API REST bir mimari üsluptur, bir şartname değil. Pratikte bir API’yi RESTful yapan şunlardır: sistemdeki şeylerin birer adresi vardır, HTTP metodu onlara ne yapılmasını istediğinizi söyler, durum kodu ne olduğunu söyler, ve sunucu istekler arasında istemciye özel oturum tutmaz. Sunucunun bir isteği karşılamak için ihtiyaç duyduğu her şey o istekle birlikte gelir. Nasıl çalışır Bir koleksiyon bir yolda durur — /characters — ve içindeki tekil öğe /characters/1 adresinde. GET okur, POST yaratır, PUT değiştirir, PATCH kısmen günceller, DELETE siler. Filtreleme, sıralama ve sayfalama sorgu dizesinde taşınır. Temsil biçimi URL’ye gömülmez, Accept ve Content-Type ile anlaşılır. Asıl sonuç durum kodudur: yalnızca gövdeyi okuyan bir istemci cevabın yarısını atıyor demektir. Yaygın yanılgı REST’in “HTTP üzerinden JSON” demek olduğu sanılır. Değildir — REST JSON hakkında hiçbir şey söylemez, ve JSON dönen pek çok HTTP API’si hiç de RESTful değildir (gövdesinde eylem adı taşıyan tek bir /api uç noktası, REST kılığına girmiş RPC’dir). Ayırt edici özellik, kaynakların adreslenebilir olması ve fiili metodun taşımasıdır. Burada deneyin Katalogda 39 REST API ve aralarında 338 uç nokta var. Temelleri çalışmak için herhangi biri yeterli; Protocol Lab ise özellikle çoğu mock API’nin atladığı HTTP ayrıntıları üzerine kurulu olanı. İlgili - Başlangıç rehberi - Güvenli ve idempotent metotlar Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. - Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/etag TITLE: ETag nedir? — Fun API Playground ================================================================ ETag ETag, sunucunun yanıta iliştirdiği ve o kaynağın tam olarak o sürümünü tanımlayan bir dizedir. Opaktır: bir özet, bir sürüm numarası ya da bir zaman damgası olabilir, ve istemci onu asla yorumlamaya çalışmamalı — yalnızca geri göndermelidir. Nasıl çalışır Okumada istemci ETag’i If-None-Match ile geri yollar; hâlâ eşleşiyorsa sunucu gövdesiz bir 304 Not Modified döner ve istemci kendi kopyasını kullanır. Yazmada aynı değeri If-Match ile yollar; artık eşleşmiyorsa sunucu 412 Precondition Failed döner ve yazma reddedilir. Aynı değer, iki başlık, bambaşka iki iş — biri bant genişliği kazandırır, diğeri kaybolan güncellemeyi önler. Yaygın yanılgı ETag uyuşmazlığının bir arıza olduğu sanılır. 412 tam tersine mekanizmanın çalıştığı andır: siz okuduktan sonra bir başkası kaynağı değiştirmiştir ve sizin yazmanız onun değişikliğini sessizce ezecekti. Doğru tepki yeniden okuyup uzlaştırmak ve yeni ETag ile tekrar denemektir — eskisiyle tekrar denemek sonsuza kadar aynı 412’yi üretir. Burada deneyin Football ve FIBA puan durumu uç noktaları koşullu okumalara 304 ile cevap verir. Karakter, kahraman ve film yazmaları If-Match kabul eder ve sürüm eskimişse gerçek bir 412 üretir. İlgili - ETag ve If-Match ile iyimser eşzamanlılık testi - HTTP 412 Precondition Failed - HTTP 304 Not Modified Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. - Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/hateoas TITLE: HATEOAS nedir? — Fun API Playground ================================================================ HATEOAS HATEOAS, bir istemcinin ne yapabileceğini dokümantasyona bakıp URL gömerek değil, aldığı yanıtlardan keşfetmesi gerektiğini söyleyen kısıttır. Her temsil bağlantılar taşır ve istemciyi bir durumdan diğerine götüren o bağlantılardır. Nasıl çalışır Yanıt, mevcut geçişleri ve adreslerini adlandıran bir bağlantı yapısı içerir — genellikle `_links`: self, next, cancel, approve. İstemci yapmak istediği şeyin adını taşıyan bağlantıyı izler. Hangi bağlantıların bulunacağı mevcut duruma bağlı olduğundan, kargoya verilmiş bir sipariş cancel bağlantısını hiç taşımaz ve istemcinin iptalin ne zaman mümkün olduğuna dair kendi kuralına ihtiyacı kalmaz. Yaygın yanılgı HATEOAS’ın akademik olduğu ve kimsenin uygulamadığı sanılır. Kısmi HATEOAS her yerdedir: sayfalanmış bir yanıttaki `next` adresi tam olarak bu fikirdir, ve sayfa sayacını artırmak yerine o bağlantıyı izleyen istemci şimdiden kazanmaktadır — sunucu cursor sayfalamaya geçtiğinde çalışmayı sürdürür. Burada deneyin Protocol Lab’in doküman uç noktaları her öğeye `_links` ekler. Bank işlem listesi ise istemcinin kurgulaması değil izlemesi beklenen bir cursor kullanır. İlgili - Gerçek bir API’ye karşı sayfalama testi - REST API nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. - Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/bearer-token TITLE: Bearer token nedir? — Fun API Playground ================================================================ Bearer token Bearer token, Authorization başlığında `Authorization: Bearer ` biçiminde gönderilir ve isteği sadece sunulmuş olmakla yetkilendirir. İstek üzerinde bir imza yoktur, gönderenin token’ın verildiği taraf olduğuna dair bir kanıt yoktur: token’ın kendisi kimlik bilgisinin tamamıdır — “bearer”, yani “hamiline”, tam olarak bu demektir. Nasıl çalışır Sunucu token’ı doğrular — ya kayıtlarında arayarak ya da JWT gibi kendi içinde taşıyorsa imzasını sınayarak — ve çağıranın kimliğini ve yetkilerini oradan çıkarır. Eksik ya da geçersiz token 401’dir. Geçerli ama bu işlemi yapmaya yetkisi olmayan bir token 403’tür; aradaki fark önemlidir, çünkü ikisinden yalnızca biri yeni bir token alarak çözülür. Yaygın yanılgı Süresi dolduğu için bearer token’ı URL’ye koymanın güvenli olduğu sanılır. URL’ye giren her şey sunucu günlüklerine, tarayıcı geçmişine, referrer başlıklarına ve analitiğe girer. Bearer token’ın yeri, TLS üzerinde bir başlıktır: kısa ömürlü ve bir yenileme mekanizmasına bağlı. Burada deneyin Kilit işaretli her uç nokta `qa-admin-token` ya da `qa-viewer-token` kabul eder. 401/403 ayrımını görmenin en temiz yolu viewer token’ı bir DELETE üzerinde denemektir: token geçerlidir, cevap yine de hayırdır. İlgili - OAuth 2.0, JWT ve token süresi testi - HTTP 401 Unauthorized - HTTP 403 Forbidden Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. - Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/jwt TITLE: JWT nedir? — Fun API Playground ================================================================ JWT (JSON Web Token) JWT, noktayla ayrılmış üç base64url parçadır: imza algoritmasını bildiren bir başlık, iddiaların (claim) bulunduğu bir yük, ve ilk ikisinin üzerine atılmış bir imza. İmza yükün değiştirilmediğini kanıtladığı için sunucu, hiçbir oturum durumu saklamadan içindeki iddialara güvenebilir. Nasıl çalışır İstemci onu bearer token olarak yollar. Sunucu imzayı anahtarıyla doğrular, sonra iddiaları okur — özne için `sub`, sona erme için `exp`, düzenlenme zamanı için `iat`, artı düzenleyicinin eklemeyi seçtiği roller veya kapsamlar. Süre dolumunu sunucunun `exp` denetimi uygular; token’ın içinde onun gönderilmesini engelleyen hiçbir şey yoktur. Yaygın yanılgı JWT’nin şifreli olduğu sanılır. İmzalıdır, şifreli değil: token’ı eline geçiren herkes yükü çözüp içindeki her iddiayı okuyabilir. Gizli hiçbir şeyin JWT’de işi yoktur. İkinci yanılgı JWT’nin iptal edilebileceğidir — durumsuz bir token süresi dolana kadar geçerli kalır, kısa ömürler ve refresh token’lar tam da bu yüzden vardır. Burada deneyin `POST /auth/v1/login` ile admin/admin123 gerçekten imzalanmış bir JWT verir. Ortadaki parçayı çözüp kendi iddialarınızı okuyun; sonra süresinin dolmasını bekleyip 401’in gelişini izleyin. İlgili - OAuth 2.0, JWT ve token süresi testi - Bearer token nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/webhook TITLE: Webhook nedir? — Fun API Playground ================================================================ Webhook Webhook alışıldık yönü tersine çevirir. İstemci bir şeyin değişip değişmediğini tekrar tekrar sormak yerine kendine ait bir adres kaydeder, ve olay gerçekleştiğinde sunucu o adrese bir HTTP isteği yapar. İstemci, o istekler süresince, sunucu hâline gelir. Nasıl çalışır Sağlayıcıya bir adres verip genellikle paylaşılan bir gizli anahtar alarak abone olursunuz. Olay tetiklendiğinde sağlayıcı o adrese bir yük POST eder ve bunu imzalar — tipik olarak ham gövde üzerinden bir HMAC, bir başlıkta. Uç noktanız imzayı doğrular, hızlıca 2xx döner ve asıl işi sonrasında yapar. Sağlayıcılar 2xx olmayan yanıtları yeniden dener, dolayısıyla teslimatlar birden fazla kez gelebilir ve gelecektir. Yaygın yanılgı Webhook almanın olayın doğru olduğu anlamına geldiği sanılır. Doğrulanmayan bir webhook uç noktası, herkesin her şeyi POST edebileceği açık bir adrestir. İmza isteğe bağlı değildir, ve gelen tam baytlar üzerinden hesaplanmalıdır — JSON’u önce ayrıştırıp yeniden serileştirmek, doğru yazılmış bir uygulamanın doğrulamada başarısız olmasının en sık sebebidir. Burada deneyin Webhooks API’si abone olmanıza, bir teslimat tetiklemenize, `x-funapi-signature` başlığını okuyup doğrulamanıza — sonra yükü kurcalayıp doğrulamanın çöküşünü izlemenize izin verir. İlgili - Webhook ve HMAC imza doğrulama testi - HMAC imzası nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/hmac-signature TITLE: HMAC imzası nedir? — Fun API Playground ================================================================ HMAC imzası HMAC — hash-based message authentication code — gizli bir anahtarı bir mesajla birlikte bir özet fonksiyonundan geçirerek, yalnızca aynı anahtara ve aynı mesaja sahip olanın üretebileceği kısa bir değer verir. Açık anahtarlı kriptografiye gerek kalmadan hem özgünlüğü hem bütünlüğü aynı anda sağlar. Nasıl çalışır Gönderen HMAC(gizli, gövde) hesaplar ve sonucu bir başlığa koyar. Alıcı aynı hesabı aldığı gövde üzerinde yapar ve karşılaştırır. Gövde ya da anahtar farklıysa değerler tutmaz. Karşılaştırma sabit zamanlı olmalıdır: sıradan bir dize karşılaştırması ilk farklı baytta döner, ve bu zamanlama farkı yeterince denemeyle geçerli bir imzanın yeniden kurulmasına izin verecek kadar bilgi sızdırır. Yaygın yanılgı İmzanın tazeliği kanıtladığı sanılır. Kanıtlamaz — geçerli imzalı bir yük sonsuza kadar geçerli kalır, dolayısıyla birini yakalayan saldırgan onu tekrar oynatabilir. İmzalar bu yüzden normalde gövdeyle birlikte bir zaman damgası üzerinden hesaplanır ve alıcılar birkaç dakikadan eskisini reddeder. Burada deneyin Bir webhook teslimatı tetikleyin ve `x-funapi-signature` başlığını abonelikte size verilen gizli anahtara karşı doğrulayın. Yükün tek bir baytını değiştirin, doğrulama başarısız olur — bütün mesele bu. İlgili - Webhook ve HMAC imza doğrulama testi - Webhook nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/content-negotiation TITLE: İçerik uzlaşımı (content negotiation) nedir? — Fun API ================================================================ İçerik uzlaşımı İçerik uzlaşımı, tek bir adresin birden çok temsil sunabilmesinin yoludur. İstemci neyi kabul edebileceğini bildirir; sunucu üretebildikleri arasından seçer; yanıt hangisinin seçildiğini söyler. Kaynak her iki durumda da aynıdır — değişen yalnızca sunuluş biçimidir. Nasıl çalışır İstemci istediği ortam türlerini Accept ile, gerekirse q değerleriyle ağırlıklandırarak yollar. Sunucu gerçekte ne gönderdiğini Content-Type ile bildirir ve Vary: Accept göndermelidir, yoksa önbellek CSV isteyen bir istemciye JSON servis eder. İstemcinin kabul edeceği hiçbir şey üretilemiyorsa cevap 406 Not Acceptable’dır. Aynanın öbür yüzü — istemcinin sunucunun ayrıştıramayacağı bir türde gövde göndermesi — 415 Unsupported Media Type’tır. Yaygın yanılgı Accept başlığının tavsiye niteliğinde olduğu ve yok sayılabileceği sanılır. Pek çok API onu yok sayıp hep JSON döner; bu, bir istemcinin gerçekten başka bir şeye ihtiyacı olana kadar çalışır, sonra sessizce 200 ile JSON döner. Karşılanamayan bir Accept başlığının dürüst cevabı 406’dır. Burada deneyin Protocol Lab bunu gerçekten yapar: `GET /protocol/v1/export/documents` Accept başlığınıza göre JSON, CSV veya XML üretir, seçtiğini Content-Type ile bildirir, ve üretemediği bir şey istediğinizde sessizce geri düşmek yerine 406 döner. İlgili - HTTP 406 Not Acceptable - HTTP 415 Unsupported Media Type Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/safe-and-idempotent-methods TITLE: Güvenli ve idempotent HTTP metotları — Fun API Playground ================================================================ Güvenli ve idempotent metotlar Bir metot sunucu durumunu değiştirmiyorsa güvenlidir: GET, HEAD, OPTIONS. Aynı isteği çok kez yapmak bir kez yapmakla aynı etkiyi bırakıyorsa idempotenttir: GET, HEAD, OPTIONS, PUT ve DELETE. Her güvenli metot idempotenttir; tersi doğru değildir, çünkü DELETE durumu değiştirdiği hâlde idempotenttir. Nasıl çalışır Otomatik yeniden denemeyi mümkün kılan tam olarak bu özelliklerdir. Bir vekil sunucu, bir tarayıcı ya da bir HTTP kütüphanesi, zaman aşımından sonra idempotent bir isteği size sormadan tekrarlayabilir, çünkü tekrarlamak durumu kötüleştiremez. POST ve PATCH ne güvenli ne idempotenttir; hiçbir katman onları sizin yerinize tekrarlamaz — ve Idempotency-Key başlığı, bir POST’a doğuştan sahip olmadığı özelliği vermek için vardır. Yaygın yanılgı İdempotentin “aynı yanıtı döner” demek olduğu sanılır. Sunucu üzerindeki aynı *etki* demektir. Aynı kaynağın ikinci DELETE’i, birincisi 204 ve ikincisi 404 dönse bile idempotenttir: son durum — o şeyin artık olmaması — aynıdır. Burada deneyin `GET /starfleet/v1/tribbles` bilinçli bir anti-örnektir: her okumada sayıyı ikiye katlayan bir GET. “Güvenli” olmanın neyi koruduğunu buradaki en net gösteren şey odur. İlgili - Idempotency key ve güvenli yeniden deneme testi - REST API nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/cors TITLE: CORS nedir? — Fun API Playground ================================================================ CORS Cross-Origin Resource Sharing bir tarayıcı güvenlik mekanizmasıdır. Öntanımlı olarak bir sayfa başka bir kaynağa istek gönderebilir ama yanıtı okuyamaz. CORS, hedef sunucunun bu belirli kaynağın sonucu görmesine izin verdiğini tarayıcıya bildirdiği yanıt başlıkları kümesidir. Nasıl çalışır Basit isteklerde tarayıcı isteği gönderir, sonra Access-Control-Allow-Origin eşleşmiyorsa yanıtı sayfadan saklar. Bunun dışındaki her şeyde — özel bir başlık, JSON içerik türü, GET/POST/HEAD dışında bir metot — tarayıcı önce bir OPTIONS ön uçuşu gönderir ve ancak cevap kullanacağı metoda ve başlıklara izin veriyorsa devam eder. Kimlik bilgisi taşıyan istekler hem Access-Control-Allow-Credentials hem de joker değil belirli bir kaynak ister. Yaygın yanılgı CORS hatasının isteğin başarısız olduğu anlamına geldiği sanılır. Genellikle başarılı olmuştur — sunucu isteği almış, işlemiş ve cevap vermiştir — tarayıcı yalnızca yanıtı kodunuza vermeyi reddetmiştir. Bir POST’ta “CORS hatası”, kayıt yaratıldı ama onayını göremiyorsunuz demek olabilir. CORS bir sunucu tarafı koruması da değildir: tarayıcı olmayan hiçbir şey onu dikkate almaz. Burada deneyin Herhangi bir isteği kendi sayfanızdan Live API kipinde çalıştırıp ön uçuşu izleyin. Eksik bir OPTIONS işleyicisi konsola CORS hatası, ağ sekmesine düpedüz 405 olarak düşer. İlgili - HTTP 405 Method Not Allowed - Canlı API nasıl sunuluyor Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/api-endpoint TITLE: API uç noktası (endpoint) nedir? — Fun API Playground ================================================================ API uç noktası (endpoint) Uç nokta, sunucunun yanıt verdiği HTTP metodu ve URL yolu ikilisidir: GET /orders ile POST /orders aynı kaynak üzerindeki iki ayrı uç noktadır. Dokümantasyon, erişim kuralları, hız sınırları ve testler genellikle uç nokta bazında düzenlenir; bir API’nin büyüklüğü de çoğunlukla bu birimle sayılır. Nasıl çalışır Yol kaynağı adlandırır, yol parametreleri tek bir örneği seçer (/orders/{id}), sorgu dizesi sonucu daraltır ya da biçimlendirir, metot ise onunla ne yapılacağını söyler. Sunucu her isteği o metot ve yol kalıbı için kayıtlı işleyiciye yönlendirir; yolu eşleşip metodu eşleşmeyen bir istek 404 ile değil 405 ile yanıtlanır. Yaygın yanılgı Uç noktanın bir URL olduğu sanılır. Aynı URL farklı bir metotla, farklı kuralları olan farklı bir uç noktadır: GET /orders/7 herkese açıkken DELETE /orders/7 yönetici token’ı isteyebilir. Tek bir metodu test edip diğerlerinin de aynı davrandığını varsaymak, yetkilendirme açıklarının incelemeden sağ çıkmasının yoludur. Burada deneyin Her dokümantasyon sayfası uç noktalarını metot, yol ve dönebilecekleri durum kodlarıyla listeler; Pizza API’sindeki DELETE /menu, GET için var olan ama her DELETE isteğine 405 dönen bir yoldur. İlgili - REST API nedir - HTTP 405 Method Not Allowed Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/http-status-codes TITLE: HTTP durum kodları nedir? — Fun API Playground ================================================================ HTTP durum kodları Durum kodu, sunucunun bir isteğin sonucunu özetlemesidir ve bir programın gövdeyi okumadan buna göre davranabileceği biçimdedir. İlk hane sınıfı belirtir: 2xx başarılı, 3xx başka yere bak, 4xx istek hatalı, 5xx sunucu başarısız oldu. Kalan haneler o sınıf içindeki anlamı daraltır. Nasıl çalışır İstemciler önce sınıfa, sonra tam koda göre dallanır: 2xx işlenir, 3xx takip edilir, 4xx isteği oluşturan tarafa bildirilir, 5xx ise istek idempotent ise yeniden denenebilir. Belirli kodlar da belirli talimatlar taşır — 401 kimliğini doğrula, 429 yavaşla, 412 yazmadan önce yeniden oku demektir. Yaygın yanılgı Asıl cevabın gövde, kodun ise süs olduğu sanılır. Önbellekler, proxy’ler, yeniden deneme mantığı, izleme araçları ve tarayıcılar gövdeyi okumadan durum satırına göre hareket eder; {"error": …} ile 200 dönen bir API bunların hiçbirine görünmez, hata oranı da öyle. Burada deneyin Durum kodu dizini, bu oyun alanının döndüğü her kod için bir sayfaya ve o kodu üreten uç noktalara bağlanır. GET /faults/v1/status/{code} ise 200 ile 599 arasındaki herhangi bir kodu istek üzerine döndürür. İlgili - Tüm HTTP durum kodları, canlı örnekleriyle - Negatif test: istediğiniz an her hata kodu Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/put-vs-patch TITLE: PUT ile PATCH arasındaki fark nedir? — Fun API Playground ================================================================ PUT ile PATCH farkı İki metot da var olan bir kaynağı değiştirir; fark gövdenin ne anlama geldiğindedir. PUT gövdesi yeni durumun tamamıdır: boş bıraktığınız alanlar ilke olarak silinir ya da sıfırlanır. PATCH gövdesi ise değişikliklerin bir tarifidir ve biçimini sunucu belgeler — kısmi bir nesne ya da JSON Patch’teki gibi bir işlem listesi. Nasıl çalışır PUT tanımı gereği idempotenttir: aynı tam temsili iki kez göndermek aynı sonucu bırakır. PATCH’in böyle olması garanti değildir, çünkü “bu listeye ekle” ya da “bir artır” gibi bir işlemi iki kez uygulamak bir kez uygulamaktan farklı sonuç verir. Bu yüzden özellikle PATCH istekleri If-Match’ten fayda görür: yeniden gönderilen bir yama iki kez uygulanmak yerine reddedilebilir. Yaygın yanılgı PATCH’in yalnızca “değiştirmediğiniz alanlar olmadan PUT” olduğu sanılır. Pek çok API bunu böyle uygular ama metot bunu söylemez — birleştirme tarzı bir PATCH ile bir JSON Patch belgesi ikisi de PATCH’tir ve anlamları çok farklıdır. Pratikte birçok “PUT” uç noktası da değiştirmek yerine birleştirir; eksik bir alanla sizinkinin ne yaptığını test edin. Burada deneyin Pizza API’si PATCH /pizza/v1/orders/{id} ile kısmi güncelleme alır, Protocol Lab ise PATCH /protocol/v1/documents/{id} ile RFC 6902 JSON Patch kabul eder; karakter PUT uç noktaları tam değiştirme yapar ve If-Match kontrol eder. İlgili - JSON Patch nedir - Güvenli ve idempotent metotlar nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/query-parameters TITLE: Sorgu parametreleri (query parameters) nedir? — Fun API ================================================================ Sorgu parametreleri Sorgu parametreleri URL’nin soru işaretinden sonraki kısmıdır: ?status=open&sort=-created&limit=20. Farklı bir kaynağı tanımlamazlar; yolun adlandırdığı kaynağa yapılan isteği değiştirirler. Bu yüzden filtreleme, sıralama, sayfalama, arama terimleri ve çıktı seçenekleri için alışılmış yer burasıdır. Nasıl çalışır Çiftler & ile ayrılır ve her değer yüzde kodlamasıyla yazılır; boşluk %20, bir değerin içindeki & ise %26 olur. Tekrarlanan anahtarlar (?tag=a&tag=b) geçerlidir ama standart bir anlamı yoktur — çatılar ilkini, sonuncusunu ya da hepsini tutar. URL’nin parçası oldukları için loglara, tarayıcı geçmişine ve önbelleklere girerler. Yaygın yanılgı Bilinmeyen sorgu parametrelerinin zararsız olduğu sanılır. Pek çok API yanlış yazılmış bir filtreyi (?stauts=open) sessizce yok sayar ve her şeyi döndürür; bu başarı gibi görünür ama istemcide bir hatadır. Katı bir API bunun yerine 400 döner; test, sizinkinin hangisi olduğunu kontrol etmeli. Burada deneyin Search & Facets API’si GET /search/v1/items üzerinde bilinmeyen sorgu parametrelerini reddeder; Friends v1 karakter listesi de öyle. Movies API’si GET /movies/v1/movies üzerinde filtreleme, sıralama ve sayfalamayı birleştirir. İlgili - Gerçek bir API’ye karşı sayfalama testi - HTTP 400 Bad Request Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/path-parameters TITLE: Yol parametresi (path parameter) nedir? — Fun API Playground ================================================================ Yol parametreleri Yol parametresi, bir uç noktanın yol şablonundaki (/orders/{id}) yer tutucudur ve istemci onu tek bir örneği adreslemek için doldurur. Sorgu parametresinden farkı, kaynağın kimliğinin parçası olmasıdır: /orders/42 ile /orders/43 farklı kaynaklardır, /orders?status=open ise tek bir kaynağın bir görünümüdür. Nasıl çalışır Sunucu yolu şablonlarıyla eşleştirir, parçayı çıkarır ve doğrular: sayı beklenen yerde sayı olmayan bir kimlik 400, biçimi doğru olup arkasında bir şey olmayan bir kimlik ise 404 olmalıdır. Değerler yüzde kodlamasıyla yazılmalıdır; aksi halde değerin içindeki bir eğik çizgi yolu bölüp başka bir rotaya götürür. Yaygın yanılgı 404’ün her zaman URL’deki bir yazım hatası olduğu sanılır. Bir yol parametresi için daha çok kaynağın silindiği, hiç var olmadığı ya da var olduğu ama çağıranın bunu bilmemesi gerektiği anlamına gelir — bazı API’ler bir kimliğin gerçek olduğunu doğrulamamak için bilerek 403 yerine 404 döner. Burada deneyin Her API kimlikleri yolda alır. Voxel Worlds API’si GET /voxel/v1/worlds/{id}/blocks/{x}/{y}/{z} üzerinde aynı anda üç tane alır; World Cup API’si ise GET /worldcup/v1/groups/{letter}/standings üzerinde sayı yerine harf kullanır. İlgili - HTTP 404 Not Found - Sorgu parametreleri nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/http-headers TITLE: HTTP başlıkları (headers) nedir? — Fun API Playground ================================================================ HTTP başlıkları Başlıklar bir mesajın içeriği dışındaki her şeyi taşır: kimin çağırdığını (Authorization), gövdenin biçimini (Content-Type), istemcinin hangi biçimi geri istediğini (Accept), ne kadar önbelleğe alınabileceğini (Cache-Control), hangi sürüm olduğunu (ETag) ve ne zaman yeniden denenmesi gerektiğini (Retry-After). Adlar büyük-küçük harf duyarsızdır, değerler metindir. Nasıl çalışır Bir istek ya da yanıt; bir başlangıç satırı, ardından her satırda bir başlık, sonra boş bir satır ve en sonda gövdeden oluşur. Aradaki sistemler gövdeye dokunmadan başlık okur ve ekler — proxy Via, yük dengeleyici X-Forwarded-For, CDN kendi önbellek durumunu ekler. API özelliği gibi görünen pek çok davranış aslında bir başlık geleneğidir. Yaygın yanılgı Gövde üzerinde doğrulama yapmanın yeterli olduğu sanılır. En sonuçlu hataların bazıları yalnızca başlıklarda yaşar: 201’den sonra eksik bir Location, kişiye özel bir yanıtın CDN’de önbelleğe alınmasına izin veren bir Cache-Control, JSON gövdeli bir yanıtta text/html Content-Type. Bunlar gövde üzerindeki her doğrulamadan geçer. Burada deneyin Dokümantasyon panelindeki her yanıt başlıklarını gövdenin yanında gösterir ve doğrulama dili onları headers. ile okur — GET /football/v1/standings üzerinde headers.etag exists deneyin. İlgili - İçerik uzlaşımı nedir - ETag nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/openapi TITLE: OpenAPI nedir? — Fun API Playground ================================================================ OpenAPI OpenAPI Spesifikasyonu, bir HTTP API’sini yalnızca insanların değil araçların da okuyabileceği biçimde tarif etmek için standart bir formattır. Tek bir belge her yolu ve metodu, her birinin aldığı parametreleri, JSON Schema olarak istek ve yanıt gövdelerini, durum kodlarını ve kimlik doğrulama şemalarını listeler. Swagger ilk adıydı; güncel ana sürüm OpenAPI 3.1’dir. Nasıl çalışır Tek bir belgeden araçlar etkileşimli referans dokümantasyonu, birçok dilde istemci SDK’ları, sunucu iskeletleri, mock sunucular ve sözleşme testleri üretir. Aynı dosya CI’da çalışan API’ye karşı kontrol edilebilir; böylece tarif ile uygulama, bir build kırılmadan birbirinden kopamaz. Yaygın yanılgı Bir OpenAPI dosyasının API’nin anlatıldığı gibi davrandığını kanıtladığı sanılır. O bir test değil bir iddiadır: bir işleyicinin spesifikasyonun hiç bahsetmediği bir alanı ya da listelemediği bir durumu döndürmesini hiçbir şey engellemez. Değeri gerçek yanıtlara karşı kontrol edilmesinden gelir; sözleşme testi tam olarak bunu yapar. Burada deneyin Buradaki her API kendi OpenAPI 3.1 belgesini /docs/{api-id}/openapi.json adresinde yayımlar; /openapi.json ise tüm kataloğu kapsar. İkisi de dokümantasyon sayfalarının çizdiği tanımlardan üretilir. İlgili - Sözleşme testi (contract testing) nedir - JSON Schema nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/postman-collection TITLE: Postman koleksiyonu nedir? — Fun API Playground ================================================================ Postman koleksiyonu Koleksiyon, Postman’in işi düzenlediği birimdir: her biri kendi metodu, URL’si, başlıkları, gövdesi ve isteğe bağlı betikleriyle istekler içeren bir klasör ağacı ve bunların ortak kullandığı değişkenler. Dışa aktarıldığında başka bir kişinin, bir CI işinin ya da Newman’ın (Postman’in komut satırı çalıştırıcısı) açıp çalıştırabileceği bir JSON dosyasıdır. Nasıl çalışır İstekler {{baseUrl}} ve {{token}} gibi değişkenlere başvurur; bunlar bir ortamdan (environment) gelir, böylece aynı koleksiyon yerelde, test ortamında ve canlıda çalışır. Bir isteğe bağlı test betikleri yanıtı doğrular ve bir sonraki istek için değişken ayarlayabilir — girişten bir token yakalayıp sonraki her çağrıda kullanmak gibi. Yaygın yanılgı Koleksiyonun dokümantasyon olduğu sanılır. Koleksiyon API’nin neyi kabul ettiğini değil, birinin bir zamanlar ne gönderdiğini kaydeder; aylarca eskimiş olup, başarısız olacak isteği kimse eklemediği için yeşil çalışmaya devam edebilir. API’nin OpenAPI belgesinden üretmek onu dürüst tutar. Burada deneyin Her dokümantasyon sayfası o API için, OpenAPI belgesiyle aynı tanımlardan üretilmiş bir Postman koleksiyonu dışa aktarır. Buradaki çalışma alanı da aynı mantıkla işler: kaydedilen her istek için değişkenler, yakalamalar ve doğrulamalar. İlgili - OpenAPI nedir - Başlangıç rehberi Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/graphql TITLE: GraphQL nedir? — Fun API Playground ================================================================ GraphQL GraphQL çok sayıda kaynak URL’sini tek bir uç nokta ve tipli bir şemayla değiştirir. İstemci ihtiyaç duyduğu verinin şeklini anlatan bir sorgu gönderir — bu kullanıcı, son üç siparişi, her siparişin toplamı — ve tam olarak o şekli geri alır. Yazma işlemleri mutation olarak aynı yolla gönderilir. Nasıl çalışır Sunucu her sorguyu çalıştırmadan önce şemasına göre doğrular, sonra her alanı belki farklı veri kaynaklarından çözer. İstekler genellikle sorguyu JSON gövdede taşıyan POST’lardır. Hatalar, çözülebilen veriyle birlikte bir errors dizisinde bildirilir ve HTTP isteğinin tamamı için durum genellikle 200’dür. Yaygın yanılgı GraphQL’in HTTP durum kodlarının yerini aldığı sanılır. Kısmen başarısız bir sorgu da 200 döndüğü için yalnızca duruma bakan bir istemci alan düzeyindeki hataları tamamen kaçırır; errors dizisi her yanıtta incelenmelidir. Aynı esneklik tek bir sorgunun çok pahalı olabileceği anlamına da gelir; bu yüzden canlı sunucular derinliği ve karmaşıklığı sınırlar. Burada deneyin POST https://funapi.dev/graphql, Friends karakterleri üzerinde sorgu ve mutation çalıştırır; aynı adreste bir GraphiQL gezgini vardır. Friends API dokümantasyon sayfası da onu Try it out panelinde POST /graphql olarak çalıştırır. İlgili - REST API nedir - Friends API dokümantasyonu Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/oauth-2 TITLE: OAuth 2.0 nedir? — Fun API Playground ================================================================ OAuth 2.0 nedir? — Fun API Playground Bir uygulamanın kullanıcının şifresiyle uğraşmak yerine sınırlı bir erişim token’ı almasını sağlayan standart çerçeve. Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/client-credentials-grant TITLE: OAuth client credentials grant nedir? — Fun API Playground ================================================================ Client credentials grant Client credentials grant, içinde kullanıcı olmayan OAuth 2.0 akışıdır. Bir arka uç servisi yetkilendirme sunucusuna istemci kimliği ve gizli anahtarıyla kendisi olarak kimlik doğrular ve servisin kendi izinlerini temsil eden bir erişim token’ı alır. Makinelerin API’leri kendi adlarına çağırmasının standart yoludur. Nasıl çalışır İstemci token uç noktasına grant_type=client_credentials, kimlik bilgilerini ve isteğe bağlı olarak istediği kapsamları POST eder. Yanıt bir erişim token’ı ve expires_in ile ömrünü içerir. İstemci token’ı önbelleğe alır, süresi dolmadan kısa süre öncesine kadar Authorization: Bearer başlığında kullanır, sonra yenisini ister — bu akışta refresh token yoktur. Yaygın yanılgı Tarayıcıda ya da mobil uygulamada güvenli olduğu sanılır. Akış istemcinin gizli anahtarını saklamasına dayanır; kullanıcının cihazına gönderilen hiçbir şey bunu yapamaz. Genel (public) istemciler bunun yerine PKCE’li authorization code akışını kullanır. Burada deneyin POST /auth/v1/oauth/token isteği grantType client_credentials, clientId demo-client ve clientSecret demo-secret ile 15 saniye sonra süresi dolan bir token döner. Onu GET /auth/v1/oauth/protected-resource üzerinde kullanın; iki isteği zincirlemek için bir değişkenle yakalayın. İlgili - OAuth 2.0 nedir - Bearer token nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/pkce TITLE: PKCE nedir? — Fun API Playground ================================================================ PKCE PKCE (“piksi” diye okunur), tek sayfalık uygulamalar ve mobil uygulamalar gibi bir gizli anahtarı saklayamayan istemciler için OAuth authorization code akışına bir uzantıdır. Yetkilendirme kodunu onu isteyen istemciye bağlar; böylece kodu geri dönüş yolunda ele geçirmek onu bir token ile takas etmeye yetmez. Nasıl çalışır İstemci kullanıcıyı yönlendirmeden önce rastgele bir code_verifier üretir ve yetkilendirme isteğiyle yalnızca onun SHA-256 özetini, yani code_challenge değerini gönderir. Daha sonra kodu token ile takas ederken asıl doğrulayıcıyı gönderir. Sunucu onu özetler, kayıtlı challenge ile karşılaştırır ve yalnızca eşleşirse token verir. Yaygın yanılgı PKCE’nin yalnızca mobil uygulamalar için olduğu sanılır. Güncel OAuth güvenlik önerileri, gizli anahtarını saklayabilen sunucu taraflı istemciler de dahil authorization code akışını kullanan her istemci için onu tavsiye eder; çünkü yetkilendirme kodu enjeksiyonuna karşı da koruma sağlar. Burada deneyin Modern Identity API’si gerçek S256 PKCE uygular: codeChallenge ile POST /identity/v1/authorize, ardından codeVerifier ile POST /identity/v1/token — özeti challenge ile eşleşmeyen bir doğrulayıcı 400 invalid_grant ile reddedilir. İlgili - OAuth 2.0 nedir - Modern Identity API dokümantasyonu Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/refresh-token TITLE: Refresh token nedir? — Fun API Playground ================================================================ Refresh token Erişim token’ları bilerek kısa ömürlüdür; çalınan bir token yalnızca kısa bir süre işe yarar. Refresh token daha uzun yaşayan karşılığıdır: istemci onu saklar, kaynak sunucularına hiç göndermez ve yeni bir erişim token’ına ihtiyaç duyduğunda yalnızca yetkilendirme sunucusuna sunar. Nasıl çalışır Bir API erişim token’ının süresi dolduğu için 401 döndüğünde — ya da dolmadan hemen önce — istemci token uç noktasına grant_type=refresh_token POST eder ve yeni bir erişim token’ı alır; çoğu zaman eskisinin yerini alan yeni bir refresh token da gelir (rotasyon). Döndürülmüş bir refresh token’ın yeniden kullanılması çalınma işaretidir ve iyi tasarlanmış sunucular o zaman tüm zinciri iptal eder. Yaygın yanılgı Her 401’de yenilemenin doğru olduğu sanılır. İptal edilmiş ya da geçersiz bir token yüzünden gelen 401, yenilemeden sonra da başarısız olur; sınırsızca yenileyip yeniden deneyen bir istemci, oturum kapatmayı sonsuz bir döngüye çevirir. Bir kez yenileyin, bir kez yeniden deneyin, o da olmazsa kullanıcıyı girişe gönderin. Burada deneyin POST /auth/v1/oauth/token authorization code akışında bir refresh token verir ve yeni erişim token’ı almak için o refreshToken ile grantType refresh_token kabul eder. Buradaki erişim token’ları 15 saniyede dolar, yani yenileme yoluna çabuk ulaşılır. İlgili - OAuth 2.0, JWT ve token süresi testi - HTTP 401 Unauthorized Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/openid-connect TITLE: OpenID Connect nedir? — Fun API Playground ================================================================ OpenID Connect OpenID Connect (OIDC), OAuth 2.0’a kimlik doğrulama ekler. Yetkilendirme sunucusu erişim token’ının yanında bir ID token verir: talepleri (claims) kullanıcıyı tanımlayan — konu, yayımlayan, hedef kitle, veriliş ve bitiş zamanı — ve istemcinin sağlayıcının açık anahtarlarıyla doğrulayabildiği bir JWT. “Google ile giriş yap” ve kurumsal tek oturum açmanın (SSO) çoğu OIDC’dir. Nasıl çalışır İstemci bir sağlayıcının uç noktalarını ve yeteneklerini /.well-known/openid-configuration adresindeki keşif belgesinden öğrenir, authorization code akışında openid kapsamını ister, bir ID token alır ve imzasını sağlayıcının JWKS adresinde yayımladığı anahtarlarla doğrular. Ayrıca yayımlayanı, hedef kitleyi ve son kullanma zamanını da kontrol etmelidir. Yaygın yanılgı ID token’ı çözmenin onu doğrulamakla aynı şey olduğu sanılır. Herkes bir JWT’yi çözebilir; taleplerine güvenmek için imzayı doğru anahtarla kontrol etmek ve token’ın beklenen sağlayıcı tarafından, bu istemci için verildiğini ve süresinin dolmadığını doğrulamak gerekir. Burada deneyin Modern Identity API’si GET /identity/v1/.well-known/openid-configuration üzerinde bir keşif belgesi ve GET /identity/v1/jwks üzerinde bir anahtar kümesi sunar; araçlar bölümündeki JWT çözücü bir token’ın ne taşıdığını gösterir. İlgili - JWT nedir - JWT çözücü Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/api-key TITLE: API anahtarı (API key) nedir? — Fun API Playground ================================================================ API anahtarı API anahtarı, bir API’nin verebileceği en basit kimlik bilgisidir: bir hesaba ya da projeye bağlı, her istekle gönderilen uzun ve rastgele bir dize — genellikle X-API-Key gibi bir başlıkta, bazen sorgu dizesinde. Faturalama, kota ve erişim denetimi için kimin çağırdığını tanımlar; ama sunucu eklemedikçe kendine ait bir süre ya da kapsam taşımaz. Nasıl çalışır Sunucu her istekte anahtarı arar, bilinmeyenleri 401 ile reddeder ve o anahtarın kotasını ve izinlerini uygular. Anahtarlar genellikle bir panelden oluşturulur; eskisi iptal edilmeden önce yenisi verilerek döndürülebilir ve çoğu zaman belirli IP aralıklarına, yönlendiricilere ya da uç noktalara kısıtlanır. Yaygın yanılgı Sorgu dizesindeki bir anahtarın başlıktaki kadar güvenli olduğu sanılır. URL’ler sunucu loglarına, proxy loglarına ve tarayıcı geçmişine yazılır, Referer başlığıyla sızabilir; başlık da gizli değildir ama bu kadar çok yere düşmez. Burada deneyin Cargo Tracking API’si yazma işlemlerinde — POST /cargo/v1/shipments ve durum makinesi geçişleri — X-API-Key ister, okumaları ise açıktır; böylece aynı API iki tarafı da gösterir. İlgili - Bearer token nedir - Cargo Tracking API dokümantasyonu Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/basic-authentication TITLE: HTTP Basic kimlik doğrulama nedir? — Fun API Playground ================================================================ Basic kimlik doğrulama Basic kimlik doğrulama en eski HTTP kimlik doğrulama şemasıdır. İstemci kullanıcı adını ve şifreyi iki nokta üst üste ile birleştirir, sonucu Base64 ile kodlar ve Authorization: Basic ardından bu dizeyle gönderir. Sunucu onu çözer ve kimlik bilgilerini her istekte kontrol eder; ne token vardır ne oturum. Nasıl çalışır Kimlik bilgisi isteyen bir sunucu WWW-Authenticate: Basic başlığıyla 401 döner; tarayıcının kendi giriş penceresini göstermesini sağlayan budur. Kimlik bilgileri her istekte bulunduğu için şema yalnızca HTTPS üzerinde kabul edilebilir; yine de iç araçlarda, CI webhook’larında, paket kayıtlarında ve özel hesaplarla yapılan servisler arası çağrılarda yaygındır. Yaygın yanılgı Base64’ün şifreleme olduğu sanılır. Herkesin tek satırda geri çevirebileceği bir kodlamadır; düz HTTP üzerinde Basic kimlik doğrulama şifreyi açık metin olarak gönderir. Güvenliği tamamen TLS’den gelir. Burada deneyin Bu oyun alanı Basic yerine bearer token kullanır ve bu da farkı görmeyi kolaylaştırır: GET /auth/v1/me isteğini qa-admin-token ile karşılaştırın ve bir Basic başlığını tarayıcı konsolunuzda atob() ile kendiniz çözün. İlgili - Bearer token nedir - HTTP 401 Unauthorized Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/authentication-vs-authorization TITLE: Kimlik doğrulama ile yetkilendirme farkı — Fun API ================================================================ Kimlik doğrulama ile yetkilendirme Kimlik doğrulama (authn) çağıranın kimliğini belirler — bir şifre kontrolü, doğrulanmış bir token imzası, bir istemci sertifikası. Yetkilendirme (authz) bu kimliği alır ve bu kaynak üzerindeki bu işleme izin verilip verilmediğine karar verir. Korunan her istek, bu sırayla ikisinden de geçer. Nasıl çalışır HTTP her birine kendi hatasını verir: 401 Unauthorized kimlik doğrulamanın eksik ya da başarısız olduğu anlamına gelir, istemci kimlik bilgisi almalı ya da yenilemelidir; 403 Forbidden ise çağıranın bilindiği ve cevabın yine de hayır olduğu anlamına gelir, aynı kimlikle yeniden denemek anlamsızdır. Roller, kapsamlar ve kaynak sahipliği yetkilendirmenin girdileridir. Yaygın yanılgı 401 ile 403’ün birbirinin yerine kullanılabileceği sanılır. Adlar yanıltıcıdır — 401 aslında “kimliği doğrulanmamış” demektir — ama ayrım istemcinin davranışını belirler: 403 aldığında kullanıcıyı giriş sayfasına gönderen bir istemci, onu hiçbir işe yaramayacak bir giriş döngüsüne sokar. Burada deneyin Katalogdaki herhangi bir DELETE isteğinde qa-viewer-token kullanarak bilinen ama yetkisi yetmeyen bir çağırandan 403 alın, hiç token göndermeden de 401 alın — aynı uç nokta, iki farklı hata. İlgili - HTTP 401 Unauthorized - HTTP 403 Forbidden Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/oauth-scopes TITLE: OAuth kapsamları (scopes) nedir? — Fun API Playground ================================================================ OAuth kapsamları (scopes) Kapsam, bir erişim dilimini adlandıran bir dizedir — read, orders:write, openid. İstemci ihtiyaç duyduğu kapsamları ister, kullanıcı ya da politika bunların bir kısmını ya da tamamını verir ve verilen token bu kümeyi taşır. Kaynak sunucuları işlem yapmadan önce token’ın kapsamlarını kontrol eder; böylece okumak için üretilmiş bir token silmek için kullanılamaz. Nasıl çalışır Kapsamlar yetkilendirme ya da token isteğinin scope parametresinde boşlukla ayrılmış bir liste olarak gider ve token yanıtında — belki istenenden dar olarak — geri gelir. JWT bir erişim token’ı onları genellikle scope ya da scp talebinde taşır; opak bir token’ın kapsamları ise introspection ile öğrenilir. Yaygın yanılgı Token’ın istediğiniz kapsamlara sahip olduğu sanılır. Sunucu daha azını verebilir ve aksini varsayan bir istemci sonradan, nedenden çok uzak bir yerde hata verir. Token yanıtındaki scope alanını okuyun ve token’ın sahip olmadığı bir kapsamı gerektiren bir çağrıda ne olduğunu test edin. Burada deneyin POST /auth/v1/oauth/token yanıtı verilen kapsamı belirtir — client credentials için read, authorization code akışı için read write — ve POST /identity/v1/introspect bir Identity API token’ının kapsamını bildirir. İlgili - OAuth 2.0 nedir - HTTP 403 Forbidden Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/jwks TITLE: JWKS nedir? — Fun API Playground ================================================================ JWKS JWKS, her biri JWK biçiminde bir açık anahtar olan, bir tanımlayıcı (kid), anahtar türü, algoritma ve anahtar verisi taşıyan bir keys dizisi içeren JSON belgesidir. Kimlik sağlayıcıları onu bilinen bir adreste yayımlar; böylece token’larını alan her API, hiçbir gizli bilgi paylaşmadan imzaları doğrulayabilir. Nasıl çalışır İmzalı bir JWT, başlığındaki kid alanında hangi anahtarla imzalandığını söyler. Doğrulayıcı yayımlayıcının JWKS’ini (genellikle OpenID keşif belgesinden bulunur) çeker, o kid’e sahip anahtarı seçer ve imzayı kontrol eder. Anahtarlar, geçişten önce yenisi eskisinin yanında yayımlanarak döndürülür; bu yüzden doğrulayıcılar kümeyi önbelleğe almalı ama bilinmeyen bir kid gördüğünde yeniden çekmelidir. Yaygın yanılgı Anahtar kümesinin bir kez çekilip yapılandırmaya gömülebileceği sanılır. Sağlayıcılar anahtarları döndürür; anahtarı sabit kodlanmış bir doğrulayıcı, döndürme günü her geçerli token’ı reddetmeye başlar. Tersi hata — her istekte çekmek — kimlik sağlayıcısını her çağrının bir bağımlılığı haline getirir. Burada deneyin GET /identity/v1/jwks, Modern Identity API’sinin demo anahtar kümesini döndürür; GET /identity/v1/.well-known/openid-configuration adresindeki keşif belgesi de gerçek bir sağlayıcınınki gibi ona işaret eder. İlgili - JWT nedir - OpenID Connect nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/retry-after TITLE: Retry-After başlığı nedir? — Fun API Playground ================================================================ Retry-After Retry-After, sunucunun bir yeniden denemenin ne zaman başarılı olabileceğine dair açık talimatıdır. 429 Too Many Requests, 503 Service Unavailable ve bazı yönlendirmelerle gelir; ya bir saniye sayısı (Retry-After: 30) ya da bir HTTP tarihi taşır. Ona uymak, toparlanan bir istemci ile beklediği kesintiyi uzatan bir istemci arasındaki farktır. Nasıl çalışır İstemci değeri ayrıştırır — iki biçim de geçerlidir ve ikisi de görülür — ve yeniden denemeyi en erken o zamana planlar. Başlık yoksa kendi geri çekilme (backoff) politikasına döner. İyi istemciler beklemeye bir üst sınır da koyar; böylece yanlış yapılandırılmış bir sunucu onları bir gün boyunca bekletemez. Yaygın yanılgı Sabit bir saniyelik beklemeli bir yeniden deneme döngüsünün “429’u ele almak” olduğu sanılır. Bunu yapan her istemci, pencere açıldığı anda sunucuya topluca yeniden yüklenir. Retry-After varsa doğru sayıyı zaten söyler; yoksa rastgelelikli (jitter) geri çekilme kullanın. Burada deneyin GET /coffee/v1/rush-hour on saniyede üç isteğe izin verir ve dördüncüyü 429 ve Retry-After ile yanıtlar; GET /protocol/v1/maintenance ise her isteğe 503 ve Retry-After: 30 ile cevap verir. İlgili - Hız sınırlama ve Retry-After testi - HTTP 429 Too Many Requests Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/exponential-backoff TITLE: Exponential backoff (üstel geri çekilme) nedir? — Fun API ================================================================ Üstel geri çekilme (exponential backoff) Üstel geri çekilme, yeniden denemeleri her seferinde gecikmeyi ikiye katlayarak — 0,5 sn, 1 sn, 2 sn, 4 sn — bir üst sınıra kadar aralar ve zorlanan bir sunucuya toparlanma payı bırakır. Jitter her gecikmeyi rastgeleleştirir; çünkü o olmadan aynı anda başarısız olan her istemci aynı anda yeniden dener ve hataya yol açan sıçramayı yeniden oluşturur. Nasıl çalışır Tipik bir politika: sıfır ile taban × 2^deneme arasında rastgele bir süre bekle, bunu bir üst sınırla kes ve belirli sayıda denemeden ya da toplam süreden sonra vazgeç. Yalnızca yeniden denemesi güvenli olanı — idempotent metotları ya da bir idempotency anahtarıyla korunan yazmaları — ve yalnızca geçici olabilecek hataları yeniden dene: zaman aşımları, 429, 502, 503, 504. Yaygın yanılgı Daha çok yeniden denemenin daha çok güvenilirlik demek olduğu sanılır. Sınırsız yeniden denemeler bir kesintiyi büyütür: üç kez yeniden deneyen her katman altındaki katmanın yükünü katlar. Yeniden deneme bütçeleri, üst sınırlar ve devre kesiciler, yeniden denemenin kendisi de bir hata kaynağı olduğu için vardır. Burada deneyin Fault Injection API’sini PUT /faults/v1/config ile yapılandırın — örneğin failureRate 0.5 ve status 503 — sonra yeniden deneme politikanızın titrek bir bağımlılıkla nasıl başa çıktığını görmek için GET /faults/v1/target’ı tekrar tekrar çağırın. İlgili - Retry-After nedir - Hata enjeksiyonu (fault injection) nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/request-timeout TITLE: İstek zaman aşımı (request timeout) nedir? — Fun API ================================================================ İstek zaman aşımı Zaman aşımı istemcinin kendi son tarihidir. O olmadan, hiç cevap vermeyen bir sunucuya yapılan istek bir bağlantıyı, bir iş parçacığını ve kullanıcının sabrını sonsuza kadar tutabilir. Zaman aşımları genellikle parçalıdır: bağlanmak için ne kadar beklenecek, ilk bayt için ne kadar beklenecek ve tüm alışveriş ne kadar sürebilir. Nasıl çalışır Süre dolduğunda istemci isteği iptal eder ve bir hata bildirir — tarayıcıda AbortController ile, çoğu kütüphanede bir zaman aşımı istisnası olarak. Her durağın kendi zaman aşımı vardır: tarayıcı, CDN, yük dengeleyici, ağ geçidi ve uygulama. İçteki zaman aşımı dıştakinden uzunsa dış katman önce vazgeçer ve içerideki iş, kimse beklemezken sürer. Yaygın yanılgı Zaman aşımına uğrayan bir isteğin hiç gerçekleşmediği sanılır. Sunucu onu almış ve istemci dinlemeyi bıraktıktan sonra tamamlamış olabilir; zaman aşımına uğramış bir POST siparişi oluşturmuş olabilir. Zaman aşımını “sonucu bilinmiyor” olarak ele alın ve yazmaları bir idempotency anahtarıyla yeniden denemeye güvenli hale getirin. Burada deneyin GET /protocol/v1/gateway-timeout 504 dönmeden önce yaklaşık üç saniye bekler, GET /pizza/v1/oven/preheat ise başarılı olmadan önce yaklaşık üç saniye sürer — istemci zaman aşımını iki saniyeye ayarlayın ve ikisinin ne yaptığını karşılaştırın. İlgili - HTTP 504 Gateway Timeout - HTTP 408 Request Timeout Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/contract-testing TITLE: Sözleşme testi (contract testing) nedir? — Fun API ================================================================ Sözleşme testi (contract testing) Sözleşme, bir tüketicinin dayandığı etkileşimler kümesidir: şu istekler, şu biçimde yanıtlar ve şu durum kodlarıyla cevaplanır. Sözleşme testi her iki tarafı bu sözleşmeye karşı ayrı ayrı kontrol eder — tüketiciyi ondan üretilmiş bir mock’a karşı, sağlayıcıyı içinde kayıtlı isteklere karşı — böylece uyumsuzluklar uçtan uca bir ortamda değil, dağıtımdan önce bulunur. Nasıl çalışır Tüketici odaklı sözleşme testinde (en bilinen araç Pact’tir) her tüketicinin testleri bir sözleşme dosyası üretir; sağlayıcının build’i her sözleşmeyi gerçek servise karşı yeniden oynatır ve herhangi bir beklenti bozulursa başarısız olur. Şema tabanlı sözleşme testinde ise yanıtlar API’nin OpenAPI belgesine karşı doğrulanır. Yaygın yanılgı Sözleşme testlerinin davranışı kontrol ettiği sanılır. Biçimi ve protokolü kontrol ederler — bir alanın var olduğunu, bir türü olduğunu, bir durum koduyla geldiğini. O alandaki fiyatın doğru olup olmadığı fonksiyonel testin işidir. Fonksiyonel testleri sözleşme testleriyle değiştiren ekipler iyi biçimlenmiş yanlış cevaplar yayınlar. Burada deneyin Herhangi bir API’nin OpenAPI belgesini dokümantasyon sayfasından indirin ve Try it out ile aldığınız yanıtları ona karşı doğrulayın; doğrulama dili de bir sözleşmeyi body.data.0.id exists gibi madde madde sabitleyebilir. İlgili - OpenAPI nedir - JSON Schema nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/json-schema TITLE: JSON Schema nedir? — Fun API Playground ================================================================ JSON Schema JSON Schema, başka bir belgenin uyması gereken kuralları söyleyen bir JSON belgesidir: türü, hangi özelliklere sahip olduğu, hangilerinin zorunlu olduğu, değerlerinin hangi tür ve biçimleri aldığı, dizelerin ve dizilerin ne kadar uzun olabileceği. Her büyük dildeki doğrulayıcılar bir belgeyi şemaya göre kontrol eder ve her ihlali bildirir. Nasıl çalışır type, properties, required, items, enum, format ve pattern gibi anahtar kelimeler bir biçimi tarif etmek için birleşir; $ref tanımları yeniden kullanır. OpenAPI 3.1, istek ve yanıt gövdeleri için JSON Schema (draft 2020-12) kullanır; yani bir API tarifi aynı zamanda kendi trafiği için bir doğrulayıcılar kümesidir. Yaygın yanılgı additionalProperties’in varsayılanının false olduğu sanılır. Varsayılan olarak bir şema bahsetmediği özelliklere izin verir; yani beklenmedik alanlarla dolu bir yanıt yine de geçerli sayılır. Katı sözleşme kontrolleri additionalProperties: false demek zorundadır — ya da fazladan alanların yakalanmadığını kabul etmelidir. Burada deneyin Her API’nin OpenAPI belgesi gövdeleri için JSON Schema’lar içerir; Try it out ile aldığınız bir yanıtı kardeş sitenin JSON to JSON Schema üreticisine yapıştırarak doğrudan veriden çıkarılmış bir şema alın. İlgili - OpenAPI nedir - JSON’dan JSON Schema üreticisi (fundata.dev) Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/api-versioning TITLE: API sürümleme (versioning) nedir? — Fun API Playground ================================================================ API sürümleme Geriye uyumsuz bir değişiklik — yeniden adlandırılmış bir alan, kaldırılmış bir uç nokta, farklı bir hata biçimi — eski davranışa göre yazılmış her istemciyi bozar. Sürümleme, sağlayıcının yeni davranışı yeni bir sürüm olarak yayınlamasına ve eskisinin çalışmaya devam etmesine izin verir; istemcilere de geçiş için bir süre tanır. Nasıl çalışır Sürüm genellikle URL yolunda (/v1/, /v2/), bazen bir başlıkta ya da Accept medya türünde, ara sıra bir tarih olarak taşınır. Uyumlu değişiklikler — yeni isteğe bağlı alanlar, yeni uç noktalar — aynı sürüm içinde yayınlanır. Eski bir sürüm emekliye ayrılırken sağlayıcı bunu önceden duyurur, çoğu zaman yanıtlarına Deprecation ve Sunset başlıkları ekleyerek. Yaygın yanılgı Bir alan eklemenin her zaman güvenli olduğu sanılır. Bilinmeyen alanları yok sayan istemciler için güvenlidir; katı serileştiriciler ya da anlık görüntü (snapshot) testleri kullananları bozar. Neyin “uyumsuz” sayıldığı istemcilerin gerçekte ne yaptığına bağlıdır; bu yüzden sağlayıcılar uyumluluk kurallarını yayımlar. Burada deneyin Friends API’si iki sürümü birden çalıştırır: GET /friends/v1/characters kullanımdan kalkmış olarak işaretlidir, GET /friends/v2/characters ise job alanını occupation olarak yeniden adlandırır ve listeyi yeniden sarar; GET /friends/version desteklenenleri listeler. İlgili - Deprecation ve Sunset başlıkları nedir - Friends API dokümantasyonu Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/deprecation-and-sunset TITLE: Deprecation ve Sunset başlıkları nedir? — Fun API Playground ================================================================ Deprecation ve Sunset başlıkları Deprecation, istemciye az önce çağırdığı uç noktanın kullanımdan kaldırıldığını söyler — hâlâ çalışır ama artık kullanılmamalıdır. Sunset, sonrasında yanıt vermeyi bırakabileceği tarihi verir. Yenisine işaret eden bir Link başlığıyla birlikte, bir API’nin emekliliği trafiğin kendisi içinde, istemci kodunun fark edebileceği yerde duyurmasını sağlarlar. Nasıl çalışır İstemciler ve ağ geçitleri bu başlıklardan biri göründüğünde log yazabilir ya da uyarı verebilir; böylece bir ekip emekliye ayrılan bir uç noktaya bağımlı olduğunu hâlâ zaman varken öğrenir. Sunset bir HTTP tarihi taşır. rel="successor-version" ya da rel="deprecation" içeren bir Link başlığı yenisine ya da geçiş belgelerine işaret eder. Yaygın yanılgı Değişiklik günlüğündeki kullanımdan kaldırma duyurularının yeterli olduğu sanılır. Kimse çağırdığı her API’nin değişiklik günlüğünü okumaz; yanıtlardaki başlıklar gerçekten etkilenen koda ulaşır ve bu başlıkların yokluğunu doğrulayan bir test, ortaya çıktıkları gün başarısız olur. Burada deneyin GET /friends/v1/characters; Deprecation, Sunset ve v2 uç noktasına işaret eden bir Link başlığıyla yanıt verir. Bunları Expectations düzenleyicisinde headers.deprecation exists ile doğrulayın. İlgili - API sürümleme nedir - HTTP başlıkları nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/cache-control TITLE: Cache-Control başlığı nedir? — Fun API Playground ================================================================ Cache-Control Cache-Control önbellekleme talimatlarını virgülle ayrılmış yönergeler olarak taşır. max-age=60 yanıtın bir dakika taze olduğunu söyler; no-store saklanmasını tamamen yasaklar; private yalnızca kullanıcının kendi tarayıcısının onu tutmasına izin verir; public paylaşılan önbelleklere izin verir; no-cache saklamaya izin verir ama her yeniden kullanımdan önce doğrulama ister. Nasıl çalışır Bir önbellek taze bir yanıtı sunucuya gitmeden sunar. Bayatladığında koşullu bir istekle — saklanan ETag ile If-None-Match — yeniden doğrular ve hiçbir şey değişmediyse sunucu 304 Not Modified ile cevap verip gövdeden tasarruf ettirir. s-maxage, CDN’ler gibi paylaşılan önbellekler için ayrı bir ömür belirler. Yaygın yanılgı no-cache’in “önbelleğe alma” anlamına geldiği sanılır. “Önbellekteki bir kopyayı kullanmadan önce bana danış” demektir; saklamayı yasaklayan yönerge no-store’dur. İkisini karıştırmak ya kişisel verileri paylaşılan önbelleklere sızdırır ya da güvenli olan önbelleklemeyi çöpe atar. Burada deneyin GET /football/v1/standings ve GET /bank/v1/exchange-rates ikisi de bir ETag ile Cache-Control gönderir; isteği If-None-Match’i o ETag’e ayarlayarak tekrarlayın, cevap gövdesiz bir 304 olur. İlgili - ETag nedir - HTTP 304 Not Modified Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/range-requests TITLE: HTTP aralık isteği (range request) nedir? — Fun API ================================================================ Aralık istekleri (range requests) Bir aralık isteği GET’e bytes=0-1023 gibi bir Range başlığı ekler. Aralıkları destekleyen bir sunucu yalnızca o baytlarla ve bunların bütünün hangi parçası olduğunu söyleyen bir Content-Range başlığıyla 206 Partial Content döner. Sunucular desteklerini Accept-Ranges: bytes ile duyurur; başlığı yok sayan bir sunucu kaynağın tamamını 200 ile döndürür. Nasıl çalışır İndirme yöneticileri kesilen bir aktarımı bytes=- isteyerek sürdürür; video oynatıcılar izleyicinin atladığı konumun çevresindeki aralığı ister; büyük dosyalar paralel parçalar halinde çekilebilir. Sunucunun karşılayamadığı bir aralık — kaynağın sonunun ötesinde ya da hatalı biçimde — 416 Range Not Satisfiable alır. Yaygın yanılgı Bir aralık isteğine 200 dönmesinin hata olduğu sanılır. Sunucunun aralık desteklemediği anlamına gelen geçerli bir cevaptır; istemci ikisini de ele almalı ve sürdürdüğünü sandığı kısmi bir indirmenin sonuna tam bir gövde eklememelidir. Burada deneyin GET /storage/v1/objects/{key}, Range: bytes=başlangıç-bitiş kabul eder: dilimle 206, sonun ötesindeki ya da hatalı bir aralık için 416 ve Range gönderilmediğinde nesnenin tamamıyla 200 döner. İlgili - HTTP 206 Partial Content - HTTP 416 Range Not Satisfiable Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/multipart-form-data TITLE: multipart/form-data nedir? — Fun API Playground ================================================================ multipart/form-data multipart/form-data, bir form bir dosya girdisi içerdiğinde tarayıcıların kullandığı medya türüdür ve bir API’ye dosya yüklemenin alışılmış yoludur. Gövde, her biri kendi başlıklarına — bir ad, isteğe bağlı bir dosya adı ve bir Content-Type — sahip parçalara bölünür; böylece metin alanları ve ikili dosyalar tek bir istekte birlikte gider. Nasıl çalışır Content-Type başlığı bir sınır (boundary) dizesi bildirir ve gövde, bu sınırla ayrılmış parçalardan oluşur. İstemciler gövdeyi ve sınır dahil başlığı HTTP kütüphanelerinin oluşturmasına izin vermelidir; sunucular her parçanın bildirilen türünü ve boyutunu kontrol eder, kabul etmediği bir dosya türü için 415, fazla büyük biri için 413 döner. Yaygın yanılgı Content-Type: multipart/form-data başlığını elle ayarlamanın faydalı olduğu sanılır. Boundary parametresi olmadan sunucu gövdeyi bölemez ve yükleme kafa karıştırıcı bir şekilde başarısız olur. fetch ve FormData ile doğru hamle başlığı hiç ayarlamamaktır. Burada deneyin POST /movies/v1/movies/{id}/poster çok parçalı bir afiş yüklemesini simüle eder; desteklenmeyen bir görüntü türü için 415, fazla büyük biri için 413 döner — her yükleme uç noktasının ihtiyaç duyduğu iki kontrol. İlgili - HTTP 415 Unsupported Media Type - HTTP 413 Content Too Large Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/media-type TITLE: Medya türü nedir ve Content-Type ne işe yarar? — Fun API ================================================================ Medya türü (Content-Type) Bir medya türü (eski adıyla MIME türü) bir veri biçimini adlandırır: application/json, text/csv, image/png, multipart/form-data. Content-Type gerçekte gönderilen gövdenin medya türünü bildirir; Accept ise gönderenin hangi medya türlerini almaya istekli olduğunu. Parametreler onu daraltır: text/csv; charset=utf-8 gibi. Nasıl çalışır Sunucular isteğin Content-Type değerine göre bir ayrıştırıcı seçer ve ona uygun ayrıştırıcıları yoksa 415 Unsupported Media Type döner. İstemciler gövdeyi nasıl okuyacaklarına yanıtın Content-Type değerine göre karar verir. application/problem+json gibi yapılandırılmış sonekler “bu, bilinen bir yapıya sahip JSON’dur” demektir. Yaygın yanılgı Gövdenin kendini anlattığı sanılır. text/plain olarak gönderilen bir JSON gövde — bazı HTTP istemcilerinde yaygın bir varsayılan — katı bir sunucu tarafından reddedilir ya da yanlış okunur; text/html etiketli bir JSON yanıtı ise tarayıcı tarafından bir web sayfası olarak yorumlanabilir; bu bir hata olduğu kadar güvenlik sorunudur da. Burada deneyin Movies afiş yüklemesi kabul etmediği bir tür için 415 döner; GET /protocol/v1/export/documents ise Accept’e göre JSON, CSV ya da XML döndürür ve başka her şey için 406 verir. İlgili - İçerik uzlaşımı nedir - HTTP 415 Unsupported Media Type Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/server-sent-events TITLE: Server-Sent Events (SSE) nedir? — Fun API Playground ================================================================ Server-Sent Events (SSE) Server-Sent Events, istemci sorup durmadan sunucunun ona güncelleme göndermesini sağlar. İstemci Accept: text/event-stream ile tek bir GET yapar; sunucu yanıtı açık tutar ve olayları gerçekleştikçe, her biri isteğe bağlı id ve event alanları olan birkaç satırlık metin olarak yazar. Tarayıcılar bunu EventSource API’si ile sunar. Nasıl çalışır Her olay data: satırları ve ardından boş bir satırdır. Bağlantı koparsa EventSource otomatik olarak yeniden bağlanır ve gördüğü son olayın kimliğini Last-Event-ID başlığında gönderir; böylece sunucu boşluk bırakmadan oradan devam edebilir. Sunucular, proxy’lerin boşta kalan bağlantıları kapatmasını önlemek için düzenli yorum satırlarını kalp atışı olarak gönderir. Yaygın yanılgı WebSocket’lerin her zaman daha iyi seçim olduğu sanılır. SSE düz HTTP’dir — WebSocket yükseltmelerini engelleyen proxy ve yük dengeleyicilerden geçer, özel bir sunucu gerektirmez ve devam etme yeteneği yerleşik olarak yeniden bağlanır. Bildirimler, ilerleme ve akışlar gibi sunucudan istemciye güncellemeler için genellikle daha basit araçtır. Burada deneyin GET /streams/v1/events JSON olarak ya da Accept: text/event-stream ile bir olay akışı olarak yanıt verir; belirli bir olaydan sonra devam etmek için Last-Event-ID gönderin, bir olay yayınlamak için POST /streams/v1/events kullanın. İlgili - Event Streams API dokümantasyonu - Webhook nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/json-patch TITLE: JSON Patch nedir? — Fun API Playground ================================================================ JSON Patch JSON Patch, işlemlerden oluşan bir JSON dizisidir — add, remove, replace, move, copy ve test — ve her işlem hedef belgedeki bir konumu /tags/0 gibi bir JSON Pointer ile adlandırır. Content-Type application/json-patch+json ile bir PATCH isteğinin gövdesi olarak gönderildiğinde, sunucuya kaynağın tamamının yeni bir kopyasını göndermek yerine tam olarak neyi değiştireceğini söyler. Nasıl çalışır İşlemler sırayla uygulanır ve yamanın atomik olması beklenir: herhangi bir işlem başarısız olursa hiçbiri etkili olmamalıdır. test işlemi yerleşik bir ön koşuldur — “bu yamayı yalnızca /status hâlâ draft ise uygula” — ve JSON Patch’i alan düzeyinde hafif bir iyimser eşzamanlılık biçimi yapar. Yaygın yanılgı PATCH ile gönderilen kısmi bir JSON nesnesinin JSON Patch olduğu sanılır. O, null’ın “bu alanı sil” anlamına geldiği ve dizilerin yalnızca bütün olarak değiştirilebildiği farklı bir biçim olan JSON Merge Patch’tir (RFC 7396). Sunucular genellikle birini ya da ötekini kabul eder; aradaki farkı Content-Type söyler. Burada deneyin PATCH /protocol/v1/documents/{id} bir RFC 6902 dizisi alır: /title, /body ve /tags üzerinde add, replace, remove ve test — başarısız bir test 409, dizi olmayan bir gövde 400 döner. İlgili - PUT ile PATCH farkı nedir - HTTP 409 Conflict Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/soft-delete TITLE: Soft delete nedir, neden 410 döner? — Fun API Playground ================================================================ Yumuşak silme (soft delete) Yumuşak silme, satırı kaldırmak yerine kaydı işaretler — deleted_at, status: deleted. Veri denetim, geri alma ve bütünlük için kalır; API ise onu yok sayar. Bu, API’nin silinmiş bir kaynak için 404 Not Found yerine daha bilgilendirici olan 410 Gone dönmesini sağlar: tanımlayıcının geçerli olduğunu ve şeyin bilerek artık sunulmadığını söyler. Nasıl çalışır Her okuma işaretli satırları dışarıda bırakmalıdır; liste uç noktaları, arama ve sayımlar dahil. Yumuşak silinmiş bir kimliğe yapılan GET 410 döner, ikinci bir DELETE 204 yerine 410 ya da 404 döner; bir temizleme işi de veriyi sonunda — çoğu zaman gizlilik mevzuatının belirleyebileceği bir saklama süresinden sonra — kalıcı olarak siler. Yaygın yanılgı Yumuşak silinen verinin gittiği sanılır. Veritabanında, yedeklerde ve çoğu zaman arama dizinlerinde durmaya devam eder; kişisel veriler için yalnızca yumuşak silme bir silme talebini karşılamaz. Filtreyi unutan bir liste uç noktası da silinmiş kayıtları her istemci için diriltir. Burada deneyin Yönetici olarak DELETE /protocol/v1/documents/{id} yapın, sonra aynı kimliğe GET gönderin: cevap 404 değil 410’dur. Shop API’sinin süresi dolmuş kuponları ile World Cup ve FIBA’nın iptal edilmiş biletleri de aynı şekilde 410 döner. İlgili - HTTP 410 Gone - HTTP 404 Not Found Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/batch-requests TITLE: Toplu API isteği ve 207 Multi-Status — Fun API Playground ================================================================ Toplu (batch) istekler Toplu bir uç nokta, tek bir istekte bir öğe dizisi — oluşturulacak kayıtlar, silinecek kimlikler — kabul eder ve her öğe için bir gidiş-dönüşten tasarruf ettirir. Bazı öğeler başarılı olurken bazıları başarısız olabileceği için yanıt her birini ayrı bildirir; 207 Multi-Status tam olarak bu durumun durum kodudur: “içine bak, sonuçlar farklı”. Nasıl çalışır Yanıt gövdesi her öğe için bir durum listeler; genellikle istekteki sırayla ya da istemcinin verdiği bir kimlikle eşlenmiş olarak. Atomiklik konusunda tasarımlar farklıdır: bazı toplu işlemler ya hep ya hiçtir ve herhangi bir öğe geçersizse tek bir 4xx döner; bazıları yapabildiğini kaydeder ve geri kalanını bildirir. API hangisi olduğunu belgelemelidir. Yaygın yanılgı Toplu bir istekte 2xx’in her şeyin çalıştığı anlamına geldiği sanılır. 207 başarı sınıfındadır ve yalnızca response.ok’a bakan bir istemci, kayıtlarının yarısı reddedilmişken başarı bildirir. Toplu istemciler öğe başına sonuçları tek tek gezmelidir. Burada deneyin POST /friends/v1/characters/bulk her öğeyi ayrı doğrular ve bazıları başarısız olduğunda 207 döner; POST /friends/v1/characters/bulk-delete de kısmi başarıyı aynı şekilde bildirir. Görmek için iyi öğelerin arasına bir hatalı öğe koyun. İlgili - HTTP 207 Multi-Status - HTTP durum kodları nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/state-machine TITLE: Bir API’de kaynak durum makinesi nedir? — Fun API Playground ================================================================ Kaynak durum makinesi Pek çok kaynağın bir yaşam döngüsü vardır: bir sipariş verilir, ödenir, kargolanır ve teslim edilir; bir fırlatma planlanır, iptal edilir ya da gerçekleşir. Bunu bir durum makinesi olarak modellemek, durumları ve aralarında izin verilen geçişleri listelemek ve geri kalan her şeyi reddetmek demektir — hiç ödenmemiş bir siparişi kargolayamaz, teslim edilmiş birini iptal edemezsiniz. Nasıl çalışır Geçişler genellikle eylemler olarak — POST /orders/7/cancel — ya da sunucunun doğruladığı bir durum alanına yapılan güncelleme olarak sunulur. Geçersiz bir geçiş 409 Conflict döner; çünkü istek iyi biçimlidir ama kaynağın mevcut durumuyla çelişir. HATEOAS tarzı yanıtlar yalnızca o an geçerli geçişlerin bağlantılarını içerebilir. Yaygın yanılgı Durumun sıradan bir alan olduğu sanılır. Durumu genel bir PUT ile serbestçe ayarlayan bir istemci, işin dayandığı durumları atlayabilir — iptalsiz iadeler, kargosuz teslimatlar. Sözleşme alan değil, geçişlerdir. Burada deneyin Cargo Tracking API’si tam bir durum makinesidir: POST /cargo/v1/shipments/{id}/advance bir koliyi bir adım ilerletir ve hattın sonunda 409 döner; üç başarısız teslimat denemesi de koliyi göndericiye iade eder. İlgili - HTTP 409 Conflict - HATEOAS nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/fault-injection TITLE: Hata enjeksiyonu (fault injection) nedir? — Fun API ================================================================ Hata enjeksiyonu (fault injection) Hata enjeksiyonu bir bağımlılığı bilerek yanlış davrandırır; böylece ona bağlı kod er geç karşılaşacağı hatalara karşı test edilebilir: yavaş cevaplar, aralıklı 5xx hataları, zaman aşımları, bozuk gövdeler. Canlıda kaos mühendisliğine kadar uzanan yelpazenin kontrollü ve tekrarlanabilir ucudur. Nasıl çalışır Hatalar, test edilen kodun ötesini göremediği bir sınırda enjekte edilir — bir mock sunucu, bir proxy, bir service mesh kuralı, bağımlılığın kendisindeki bir özellik bayrağı. Test sonra davranışı doğrular: yeniden denemelerin olduğunu ve durduğunu, bir zaman aşımının tetiklendiğini, bir yedek gösterimin çıktığını, yarım yazılmış bir durum kalmadığını. Yaygın yanılgı Rastgele hataların iyi bir test oluşturduğu sanılır. Dört çalıştırmadan birinde başarısız olan bir test, titrek (flaky) bir testtir. Faydalı hata enjeksiyonu deterministiktir — bu istek başarısız olur, şu yavaştır — ya da en azından tohumludur; böylece bir hata yeniden üretilebilir ve bir düzeltme doğrulanabilir. Burada deneyin Fault Injection API’si PUT /faults/v1/config ile yapılandırılır — gecikme, bir durum kodu, bir hata oranı, bozuk JSON — ve GET /faults/v1/target ardından tam olarak yapılandırıldığı gibi, kendi sandbox’ınızın içinde yanlış davranır. İlgili - Fault Injection API dokümantasyonu - Titrek testler (flaky tests) nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/test-doubles TITLE: Mock, stub ve fake arasındaki fark nedir? — Fun API ================================================================ Mock, stub ve fake Bir test dublörü, testte gerçek bir bağımlılığın yerini alır. Stub hazır cevaplar döner ve hiçbir şeyi kontrol etmez. Mock, nasıl çağrıldığını da kaydeden bir stub’dur; böylece test etkileşimin gerçekleştiğini doğrulayabilir — “charge, 20 ile bir kez çağrıldı”. Fake ise bellek içi bir veritabanı ya da durum tutan bir API gibi çalışan, basitleştirilmiş bir uygulamadır. Nasıl çalışır Stub’lar yalnızca bağımlılığın cevap vermesine ihtiyaç duyan testlere uyar. Mock’lar, çağrının kendisinin doğrulanan davranış olduğu testlere uyar. Fake’ler ise sıralı adımları — oluştur, sonra oku, sonra güncelle — çalıştıran testlere uyar; orada hazır cevaplar her adımı önceden tahmin etmek zorunda kalırdı. HTTP testinde üçüne de gevşek bir şekilde “mock API” denir. Yaygın yanılgı Daha çok mock’lamanın daha iyi yalıtım demek olduğu sanılır. Aşırı mock’lanmış testler kodun ne yaptığını değil nasıl yazıldığını doğrular; her yeniden düzenlemede kırılır ve gerçek entegrasyon hatalarını kaçırır. Gerçek servis gibi davranan bir fake, daha az kurulumla çoğu zaman daha fazlasını yakalar. Burada deneyin Bu oyun alanı dar anlamıyla bir fake’tir: yazmalar sandbox’ınızda kalıcıdır; bir POST sonraki bir GET’e görünür, sürümler ilerler ve stok tükenir — bir stub’ın sahip olamayacağı davranışlar. İlgili - Mock API nedir - API sandbox nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/test-fixture TITLE: Test fikstürü (test fixture) nedir? — Fun API Playground ================================================================ Test fikstürü (fixture) Fikstür, bir testin başlamadan önce varsaydığı her şeydir: veritabanındaki kayıtlar, diskteki dosyalar, bir mock’un vereceği yanıtlar. Testler ancak fikstürleri tekrarlanabilirse tekrarlanabilirdir — dünden kalan verilere karşı geçen ve temiz bir ortamda başarısız olan bir test, o artıkları test ediyordur. Nasıl çalışır Fikstürler kurulumda (setup) oluşturulur ve temizlikte (teardown) kaldırılır ya da sıfırlanır; ya da her test taze bir kopyaya karşı çalışır. Önemli uç durumlar için elle yazılabilir, hacim ve çeşitlilik için toplu üretilebilir ya da gerçek bir sistemden alınıp temizlenebilir. Tohumlu üretim hem çeşitlilik hem tekrarlanabilirlik verir. Yaygın yanılgı En iyi fikstürün canlı veri olduğu sanılır. Kopyalanan veri kişisel bilgileri test ortamlarına taşır, altınızda değişir ve ihtiyacınız olan uç durumları nadiren içerir. Sabit bir tohumla üretilen veri daha güvenlidir ve tam olarak zorlu durumları içerecek şekilde hazırlanabilir. Burada deneyin POST /data/v1/generate bir şemadan deterministik fikstür satırları döndürür ve buradaki her sandbox POST /api/_reset ile sıfırlanabilir; böylece her test çalıştırması aynı tohum verisiyle başlar. Kardeş site fundata.dev daha büyük fikstürleri dosya olarak üretir. İlgili - Fun Data Bridge API dokümantasyonu - QA test verisi (fundata.dev) Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/api-sandbox TITLE: API sandbox nedir? — Fun API Playground ================================================================ API sandbox Sandbox, gerçek API gibi davranan ama gerçek sonuçlardan kopuk bir ortamdır: ödemeler tahsil edilmez, e-postalar gönderilmez, kargolar hareket etmez. Ödeme sağlayıcıları, bankalar ve kargo şirketleri, entegrasyonlar risksiz kurulup test edilebilsin diye sandbox sunar. Nasıl çalışır Sandbox’ların genellikle kendi temel URL’si ya da kimlik bilgileri, tohum verileri ve belirli sonuçları tetikleyen test değerleri vardır — her zaman reddedilen bir kart numarası, her zaman zaman aşımına uğrayan bir tutar. Bir geliştiricinin sandbox’ındaki veri diğerininkinden yalıtılmıştır ve bilinen bir duruma sıfırlanabilir. Yaygın yanılgı Sandbox’ta geçmenin canlıda geçmek demek olduğu sanılır. Sandbox’lar basitleştirir: dolandırıcılık kontrollerini atlar, anında onaylar, cömert hız sınırları ve eski API sürümleriyle çalışır. Onları davranışı çalıştırmak için bir yer olarak görün ve farklar için küçük bir canlı smoke test seti tutun. Burada deneyin Buradaki her istek bir X-Sandbox-ID başlığıyla yalıtılır; böylece yazmalarınız başkalarının testlerine görünmez. Kendi sandbox’ınızı herhangi bir dokümantasyon sayfasından ya da POST /api/_reset ile sıfırlayın. İlgili - Arayan verisinin nasıl yalıtıldığı - Mock, stub ve fake nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/curl TITLE: cURL nedir? — Fun API Playground ================================================================ cURL curl terminalden bir istek gönderir ve yanıtı yazdırır: metot -X ile, başlıklar -H ile, gövde -d ile, yanıt başlıklarını göstermek için -i. Bir curl komutu isteğin her parçasını açıkça yazdığı için bir isteği paylaşmanın standart yolu haline gelmiştir — dokümantasyonda, hata raporlarında ve her tarayıcının geliştirici araçlarındaki “Copy as cURL” seçeneğinde. Nasıl çalışır -H "Content-Type: application/json" ayarlamazsanız -d, POST ve bir form içerik türü anlamına gelir. -L yönlendirmeleri izler, -v TLS dahil tüm alışverişi gösterir, --fail ise curl’ün 4xx ya da 5xx’te sıfırdan farklı bir kodla çıkmasını sağlar; böylece bir betiği durdurabilir. Gövdeyi tek tırnakla sarmak kabuğun onu yorumlamasını engeller. Yaygın yanılgı curl ile tarayıcının aynı isteği gönderdiği sanılır. Tarayıcı çerezler, bir Origin, CORS ön istekleri ve kendi User-Agent’ını ekler; curl yalnızca sizin yazdığınızı gönderir. curl’de çalışıp tarayıcıda başarısız olan bir çağrı çoğu zaman bir API hatası değil, bir CORS ya da çerez sorunudur. Burada deneyin Her uç noktanın Try it out paneli, yapılandırdığınız isteğin curl komutunu üretir; araçlar bölümündeki curl dönüştürücü de herhangi bir curl komutunu dokuz dilde koda çevirir. İlgili - curl’den koda dönüştürücü - CORS nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/correlation-id TITLE: İstek kimliği (request ID / correlation ID) nedir? — Fun API ================================================================ İstek kimliği (correlation ID) İstek kimliği uçta — yük dengeleyici, ağ geçidi ya da ilk servis tarafından — üretilir ve X-Request-Id gibi bir yanıt başlığıyla döndürülür. O isteği işlerken yazılan her log satırı onu taşır; istek başka servislere dağıldığında kimlik de onunla gider, böylece tüm yol sonradan yeniden birleştirilebilir. Nasıl çalışır İstemciler bildirdikleri her hatayla birlikte kimliği loglamalı ve hata raporlarına eklemelidir; destek ekibi o zaman tam sunucu loglarını saniyeler içinde bulur. W3C Trace Context (traceparent başlığı) gibi dağıtık izleme standartları aynı fikri, zamanlama için üst ve alt span’ler ekleyerek resmileştirir. Yaygın yanılgı Bir zaman damgası ile bir uç noktanın loglarda bir isteği bulmaya yettiği sanılır. Yoğun bir sistemde saniyede binlerce aynı çağrı olur. Kimlik olmadan “10:42 civarında başarısız oldu” bir kayda bakmak değil, saatlerce arama yapmak demektir. Burada deneyin Canlı arka uç her yanıta bir X-Request-Id başlığı koyar ve aynı requestId’yi JSON gövdelere de ekler — açığa çıkardığı tek ayrıntının bu olduğu 500 hataları dahil. İlgili - HTTP 500 Internal Server Error - HTTP başlıkları nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/flaky-tests TITLE: Titrek (flaky) test nedir? — Fun API Playground ================================================================ Titrek testler (flaky tests) Titrek bir test aynı kod için farklı sonuçlar verir. API testindeki yaygın nedenler zamanlama — asenkron bir iş bitmeden doğrulama yapmak —, testler arasında paylaşılan durum, önceki çalıştırmalardan kalan veri, gerçek ağ çağrıları, tohumsuz rastgele veri ve o anki tarih ya da saat dilimine bağımlılıktır. Nasıl çalışır Titreklik, hata yeniden üretilene kadar aynı commit’i tekrar çalıştırıp neyin farklı olduğunu karşılaştırarak teşhis edilir. Varyasyon kaynağını kaldırarak düzeltilir: sabit bir süre yerine bir koşulu bekleyin, her teste kendi verisini verin, üreticileri tohumlayın, saatleri dondurun ve canlı bağımlılıkları kontrol ettiğiniz bir fake ya da sandbox ile değiştirin. Yaygın yanılgı Otomatik yeniden denemenin titrek bir testi düzelttiği sanılır. Yeniden denemeler belirtiyi saklar, nedeni bırakır; üründeki gerçek aralıklı hataları da saklar — bir yarış durumu (race condition) tam olarak titrek bir test gibi görünür. Yeniden deneyip unutmak yerine karantinaya alın ve düzeltin. Burada deneyin POST /protocol/v1/jobs 202 döner ve iş, GET /protocol/v1/jobs/{id} her yoklandığında ilerler — uyumak yerine bir koşulu beklemeyi çalışmak için iyi bir yer. Durumun sızmaması için çalıştırmalar arasında sandbox’ı sıfırlayın. İlgili - Asenkron işler ve 202 Accepted testi - Test fikstürü (fixture) nedir Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/api-gateway TITLE: API ağ geçidi (API gateway) nedir? — Fun API Playground ================================================================ API ağ geçidi (API gateway) API ağ geçidi, API’ler için özelleşmiş bir ters proxy’dir. İstemciler ağ geçidini çağırır; o, isteği hangi arka uç servisin işleyeceğine karar verir ve her servisin aksi halde kendisi uygulayacağı ortak kuralları uygular — kimlik doğrulama, kotalar, istek boyutu sınırları, CORS, istek kimlikleri, önbellekleme ve metrikler. Nasıl çalışır Rotalar yolları ve metotları yukarı akış servislerine eşler. Politikalar yukarı akış çağrısından önce ve sonra çalışır: token’ı doğrula, hız sınırını kontrol et, ilet, sonra başlık ekle ve logla. Ağ geçidi yolun üzerinde durduğu için istemcinin gördüğü pek çok hata — 401, 413, 429, 502, 504 — istemcinin çağırmak istediği servisten değil ağ geçidinden gelir. Yaygın yanılgı 502 ya da 504’ün uygulamanın suçu olduğu — ya da olmadığı — sanılır. İkisi de ağ geçidinin yukarı akışı hakkında ürettiği kodlardır: 502, servisin geçersiz bir şeyle cevap verdiği ya da bağlantıyı düşürdüğü; 504, zamanında cevap vermediği anlamına gelir. Başlanacak yer ağ geçidinin logları ve istek kimliğidir. Burada deneyin GET /protocol/v1/gateway-timeout yavaş bir yukarı akışın önündeki bir ağ geçidi gibi davranır ve yaklaşık üç saniye sonra 504 döner; GET /faults/v1/status/502 ise kötü ağ geçidi durumunu istek üzerine döndürür. İlgili - HTTP 502 Bad Gateway - HTTP 504 Gateway Timeout Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/boundary-value-analysis TITLE: API testinde sınır değer analizi nedir? — Fun API Playground ================================================================ Sınır değer analizi Sınır değer analizi bir test tasarım tekniğidir: sınırları olan her girdi için — 0’dan 10’a bir puan, en fazla 100 olan bir sayfa boyutu, en fazla 50 karakterlik bir ad — tam her sınırdaki değerleri ve hemen iki yanındakileri test edin. Hatalar sınırlarda toplanır; çünkü karşılaştırmalar orada yazılır ve < ile <= karıştırmak kolaydır. Nasıl çalışır 0’dan 10’a (dahil) bir aralık için ilginç girdiler −1, 0, 1, 9, 10 ve 11’dir: iki sınır, iç komşuları ve dış komşuları. Dıştaki değerler — genellikle 400 ya da 422 ile — reddedilmeli, içtekiler kabul edilmelidir. Aynısı uzunluklar, tarihler, sayılar ve boyutlar için de geçerlidir. Yaygın yanılgı Tipik bir değer artı bir geçersiz değeri test etmenin kuralı kapsadığı sanılır. 5 ve 999 ile yapılan bir test; 10,5’i kabul eden, 10’u reddeden ya da 11’e izin veren kodda da geçer. Doğru bir sınırı neredeyse doğru olandan yalnızca kenardaki değerler ayırır. Burada deneyin PUT /movies/v1/movies/{id}/rating 0 ile 10 (dahil) arasını kabul eder — −1, 0, 10 ve 11’i deneyin — Starfleet API’si de PUT /starfleet/v1/ships/{id}/warp üzerinde 9,9’un üzerindeki warp faktörünü reddeder. İlgili - Negatif test: istediğiniz an her hata kodu - HTTP 422 Unprocessable Content Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tr/glossary/smoke-testing TITLE: Smoke test nedir? — Fun API Playground ================================================================ Smoke test Smoke test tek bir soruyu hızlıca cevaplar: bu build ya da dağıtım temelde çalışıyor mu? Bir API için bu genellikle servisin ayağa kalktığı, sağlık kontrollerinin geçtiği, kimlik doğrulamanın çalıştığı ve bir avuç kritik uç noktanın doğru durum ve biçimle cevap verdiği anlamına gelir. Smoke başarısızsa tam takımı çalıştırmanın anlamı yoktur. Nasıl çalışır Smoke testler bir dağıtımın hemen ardından — çoğu zaman canlının kendisine karşı — ve CI’da daha uzun takımlardan önce çalışır. Her ana bağımlılığa (veritabanı, önbellek, kimlik sağlayıcı, ödeme sandbox’ı) salt okunur ya da kendini temizleyen çağrılarla bir kez dokunurlar ve kimse atlamak istemeyecek kadar kısa tutulurlar. Yaygın yanılgı Smoke testin küçük bir regresyon takımı olduğu sanılır. İşi derinlik değil genişliktir: her kritik yoldan bir çağrı, tek bir uç noktanın yirmi varyasyonundan iyidir. Kırk dakikaya çıkan bir smoke takımı artık smoke takımı değildir. Burada deneyin Burada iyi bir ilk smoke kontrolü: GET /pizza/v1/menu, POST /auth/v1/login ve döndürdüğü token ile GET /auth/v1/me — herkese açık okumaya, kimlik doğrulamaya ve yetkilendirmeye dokunan üç çağrı. İlgili - API test alıştırmaları - Başlangıç rehberi Diğer terimler - Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi. - REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API. - ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar. - HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır. - Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir. - JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token. Read this page in English Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/jsonplaceholder-alternative TITLE: JSONPlaceholder alternative — Fun API Playground ================================================================ A JSONPlaceholder alternative that keeps what you write JSONPlaceholder is the free fake REST API almost every tutorial reaches for, and deservedly: six resources, no signup, no configuration, and a URL short enough to type from memory. It is close to perfect for the thing it was built for — giving a front-end something to render while the real API does not exist yet. At a glance JSONPlaceholder compared with this playground, checked 2026-09. JSONPlaceholderFun API PlaygroundWrites persistNo — the response looks right, the data does not changeYes, for the life of your sandboxResources6 fixed collections39 APIs, 338 endpointsAuthNoneBearer roles, signed JWTs, full OAuth 2.0 flowsError codes on demand404 only, from unknown idsAny code from 200 to 599 on request, and 28 from endpoints whose behaviour causes themConcurrencyNot modelledETag / If-Match with a real 412Spec exportNoneOpenAPI 3.1 and Postman, per API and mergedWorks offlineNoYes — the engine runs in the browserRecognisabilityUniversal; in every tutorialNew, and has to be explained Where it stops It accepts POST, PUT, PATCH and DELETE and pretends to honour them. The response looks right, complete with a new id, and nothing has changed: fetch the resource afterwards and your write is not there. That is a deliberate design decision for a shared public service, and it is also the point at which it stops being useful for testing rather than prototyping — you cannot verify a create, you cannot test a conflict, and you cannot chain one request into the next. What is different here Here, writes persist. Create a character and it is in the collection; delete it and the next GET returns 404. Callers are isolated from one another — by an X-Sandbox-ID header against the live API, and by running the whole engine locally in the browser — which is what makes persistence safe on a public service. Beyond that the surface is much wider: 39 domains rather than 6 resources, real Bearer and JWT auth with a role that gets a 403, ETag and If-Match concurrency, Idempotency-Key replay, rate limits that really limit, webhooks with verifiable HMAC signatures, and every HTTP status code in the catalog reachable on demand. What JSONPlaceholder does better - Universally recognised — a JSONPlaceholder URL in a code sample needs no explanation, and it appears in tutorials, courses and StackOverflow answers everywhere. - A smaller surface to learn: six resources with obvious names, and nothing else to understand. - Its shape (posts, comments, users, todos) is the canonical example for front-end tutorials, and matches what most sample UIs expect. What this playground does better - Writes persist, so a create can be verified and requests can be chained. - 39 APIs and 338 endpoints across fandoms, business domains and pure protocol exercises. - Real auth: Bearer tokens with roles, signed JWTs, and complete OAuth 2.0 flows. - Error paths on demand — 409, 412, 413, 415, 422, 429, 503 — rather than only the happy one. - OpenAPI 3.1 and Postman exports per API, plus a merged spec for the whole catalog. - Runs entirely in the browser, so it works with no network and cannot be rate-limited by other people's traffic. Which to use Use JSONPlaceholder when you need a body to render and nothing else. Come here when the thing you are testing is the HTTP: the failures, the auth, the concurrency and the retries. Checked against JSONPlaceholder as of 2026-09. Other comparisons - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/httpbin-alternative TITLE: httpbin alternative — Fun API Playground ================================================================ An httpbin alternative with resources, not just reflections httpbin is a request-and-response inspector: send it something and it tells you exactly what arrived. Headers, IP, auth schemes, redirects, delays, compression, and a /status/:code endpoint that will return any status you name. It is the tool of choice for debugging what your client is actually sending, and it is also easy to self-host from its Docker image, which matters in a locked-down network. At a glance httpbin compared with this playground, checked 2026-09. httpbinFun API PlaygroundRequest inspectionIts whole purpose — headers, body, encoding, IPNot offered; use httpbin for thisSelf-hostingOne Docker commandNot packaged for self-hostingDomain resourcesNone by design39 APIs with persistent stateStatus codesAny code, on request, with nothing behind itAny code from 200 to 599 on request too, and 28 caused by real behaviour409 ConflictReturned because you askedReturned because the seat is takenAuthSchemes echoed back, no token lifecycleTokens that are issued, expire and refreshWebhooksNot offeredSubscribe, trigger, verify the HMAC signatureInteractive docsA single reference pageSwagger-style, with Try it out and nine languages Where it stops What it deliberately does not have is a domain. There are no resources to create, list, filter or conflict with, so there is nothing to test a client against — only the protocol layer, reflected back. Asking httpbin for a 409 gives you a 409 with no conflict behind it, which is fine for checking your error handler compiles and useless for checking that it does the right thing. What is different here This playground has the protocol layer too — the Protocol Lab covers redirects and redirect chains, 202 job polling, JSON Patch, content negotiation, ranges, conditional requests and on-demand 503s and 504s — but it hangs that layer off resources with real state. A 409 here is a seat that is genuinely taken; a 412 is a version that genuinely moved; a 429 is a limit you genuinely exceeded. The error is the consequence of something, which is what makes the handling of it testable. What httpbin does better - Self-hostable in one Docker command, which is often the deciding factor inside a corporate network. - Unbeatable for inspecting exactly what your client sent — headers, encoding, body, and the IP it arrived from. - Every status code, including ones no real API would produce, with no catalog to navigate. - Zero state means zero surprises: it behaves identically on the thousandth request. What this playground does better - Status codes arrive as the outcome of real behaviour — and, when you only need the code, GET /faults/v1/status/{code} returns any code from 200 to 599 on request, the way httpbin does. - Persistent resources, so a test can create, read, modify and conflict. - Interactive documentation with a Try it out panel and generated code in nine languages. - Auth flows with actual token lifecycles, not just a scheme that echoes back. - Webhook deliveries you can subscribe to, trigger and verify. Which to use They are complements more than competitors. Reach for httpbin to find out what your client is sending; reach for this to find out how it behaves when a real API answers badly. Checked against httpbin as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/reqres-alternative TITLE: reqres alternative — Fun API Playground ================================================================ A reqres alternative with more than users and a login reqres.in is a small hosted REST API — a paginated list of users, a couple of resource collections, register and login endpoints that hand back a token, and a delay parameter for testing spinners. Its virtue is how quickly it can be understood: the whole surface fits on one page, and the pagination is correct enough to build a real list view against. At a glance reqres.in compared with this playground, checked 2026-09. reqres.inFun API PlaygroundSurfaceOne page — users, a couple of collections, login39 APIs across four categoriesTokensA string handed back; nothing verifies itSigned JWTs with real claims and a real expiryOAuth 2.0Not offeredAuthorization code, client credentials, refreshRolesNoneViewer token reads, and gets a 403 on DELETEWrites persistNoYes, so requests can be chainedPaginationPage-number, correct enough to build againstPage-number and cursor, with the edge casesArtificial delayA ?delay parameterAsync 202 job polling insteadLearning curveMinutes — the whole API fits in your headA catalog to navigate Where it stops Its writes are not persisted, its tokens are not real credentials that anything verifies, and its error surface is a handful of cases rather than a system. For a UI demo that needs a plausible user list and a login screen, that is plenty. For testing what your client does when a token expires halfway through a suite, or when two writes collide, there is nothing there to test against. What is different here The auth here is the part that differs most. `POST /auth/v1/login` issues a genuinely signed JWT with real claims and a real expiry; the OAuth 2.0 endpoints run authorization-code, client-credentials and refresh-token flows properly, so a token can be obtained, used, expired and refreshed within one test run. Role separation is real too: the viewer token succeeds on reads and returns 403 on a DELETE, which is the case most auth tests never cover. What reqres.in does better - Very small and immediately comprehensible — you can hold the entire API in your head. - A built-in delay parameter that makes loading states easy to demonstrate. - A user-list shape that drops straight into most tutorial UIs. What this playground does better - JWTs that are actually signed and actually expire, and OAuth flows that actually complete. - Role-based access with a genuine 403, not just a 401 for a missing token. - Writes that persist for the duration of your sandbox, so requests can be chained. - Pagination in both page-number and cursor form, with the edge cases that break clients. - 39 domains instead of one, so the data is not the thing you are concentrating on. Which to use reqres is the better choice for a quick UI mock-up with a login screen. This is the better choice once the auth behaviour itself is what you are testing. Checked against reqres.in as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/json-server-alternative TITLE: json-server alternative — Fun API Playground ================================================================ A json-server alternative with behaviour, not just CRUD json-server is an npm package that turns a db.json file into a full REST API with one command: every top-level key becomes a collection with GET, POST, PUT, PATCH and DELETE, writes are saved back to the file, and filtering, sorting and pagination come from query parameters. For a front-end that needs a working backend on day one, very little is faster. At a glance json-server compared with this playground, checked 2026-09. json-serverFun API PlaygroundWhat it isAn npm package that serves a JSON file as RESTA hosted and in-browser simulated API catalogData modelYours, from db.json39 fixed domainsAuth and rolesNone built inBearer roles, signed JWTs, OAuth 2.0 flowsValidation errorsNone built in400 and 422 with field-level messagesConcurrencyNot modelledETag / If-Match with a real 412Rate limitingNoneReal 429 with Retry-AfterRuns in CI with no networkYesYes, through the browser engine; the HTTP API needs the networkSetupnpm install and a JSON fileNone Where it stops It is a CRUD mirror of your file. It has no authentication, no roles, no validation beyond what the file shape implies, no concurrency control, no rate limits and no business rules, so it answers almost everything with 200 or 201. That makes it a stand-in for a database, not for an API somebody else designed — your client never meets a 409, a 412, a 422 or a 429 unless you write middleware to produce one. What is different here Here the rules come built in and were written by somebody other than you: tickets sell out with a 409, stale versions are refused with 412, validation fails with 422, rate limits answer 429 with Retry-After, tokens expire. Nothing has to be installed or run, the same behaviour is available in the browser and over HTTPS, and each API ships an OpenAPI 3.1 document and a Postman collection. What json-server does better - Your own data model, defined in a file you control and can commit next to the front-end. - Runs locally, so it works in CI with no external dependency at all. - Writes go straight to db.json, so the state after a test run is easy to inspect. - Customisable with Express middleware when you need one specific behaviour. What this playground does better - Auth, roles, validation, concurrency and rate limits exist without writing middleware. - Failures happen for domain reasons, so a test exercises how the client copes rather than what you scripted. - Nothing to install or keep running, and the engine also runs offline in the browser. - Interactive docs, OpenAPI 3.1 and Postman exports for every API. Which to use Use json-server when you need your own data model behind a working REST API in minutes. Use this when the point is to see how a client copes with an API that has rules of its own. Checked against json-server as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/wiremock-alternative TITLE: WireMock alternative — Fun API Playground ================================================================ A WireMock alternative for practice, not for stubbing a contract WireMock is a mature HTTP mock server — a Java library, a standalone process and a Docker image — built for stubbing third-party APIs in automated tests. Stubs match requests on method, URL, headers and body, and return the responses you define; it can record real traffic and replay it, inject faults such as delays and dropped connections, and simulate stateful scenarios. At a glance WireMock compared with this playground, checked 2026-09. WireMockFun API PlaygroundWhat it isA configurable mock server and Java libraryA ready-made simulated API catalogWho defines responsesYou, with stubs and mappingsThe playgroundSetupLibrary, standalone JAR or Docker, plus stubsNoneReproduce a specific vendor APIYes — its main purposeNoStateful behaviourScenarios you scriptBuilt in: stock, versions, seats, tokensFault injectionDelays, resets, malformed bodiesFault Injection API plus status on demandRequest verificationYesNoBest forIsolating your code from a dependency in CILearning and rehearsing against an API you do not control Where it stops Every response it gives is one you wrote. That is its strength when you need to reproduce a specific contract inside CI, and the limit when the goal is to learn or rehearse: the API cannot surprise you, its rules are as complete as your stubs, and setting it up for anything beyond a handful of endpoints is real engineering work. What is different here This playground is the opposite trade. There is nothing to define, and the behaviour — conflicts, version checks, rate limits, async jobs, token expiry — follows rules you did not write, the way a real third-party API does. It is a place to practise and to learn what to stub, not a replacement for stubbing your own dependencies in CI. What WireMock does better - Reproduces one specific third-party contract exactly, including undocumented quirks you have observed. - Runs inside your test process or CI with no external dependency. - Record-and-playback captures a real API's responses as stubs. - Fine-grained fault injection: delays, malformed responses, connection resets. - Request verification: assert that your code called the dependency the way it should. What this playground does better - Zero setup — no stubs, JVM, container or configuration. - A wide, ready-made surface: 39 APIs with persistent state and real constraints. - Rules written by someone else, so tests discover client behaviour rather than confirm your stubs. - Interactive docs and generated code in nine languages for learning and demos. Which to use For stubbing a real dependency in your test suite, WireMock is the right tool and this is not. For learning API testing, building a practice suite or demonstrating client behaviour against realistic rules, this is ready with no setup. Checked against WireMock as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/mockoon-alternative TITLE: Mockoon alternative — Fun API Playground ================================================================ A Mockoon alternative with nothing to design Mockoon is an open-source desktop application, with a CLI and Docker image for running the same mocks headless, for creating mock APIs locally. You define routes, responses, headers and status codes in a GUI; rules pick a response based on the request, templating produces dynamic bodies, and it can import an OpenAPI document to start from. At a glance Mockoon compared with this playground, checked 2026-09. MockoonFun API PlaygroundWhat it isA desktop app and CLI for building mocksA ready-made simulated API catalogWho defines responsesYouThe playgroundCustom contractYesNoRealistic failures without setupNoYesRuns offlineYesYes, in the browserOpenAPIImport to create mocksExported for every APIBest forStanding in for an API you are building againstPractising against an API you do not control Where it stops Like every configurable mock, it does exactly what you designed. That is ideal for standing in for an API whose contract you know and for working offline, and it means the behaviour is never more realistic than the time you put into it. Persistent, constrained state — stock that runs out, versions that move, a seat someone else took — is possible to approximate and laborious to build. What is different here Here there is no design step. Thirty-nine APIs already exist with state that persists per caller and constraints that produce failures for a reason, so a test meets the kind of behaviour a real third-party API has. The trade-off is control: you cannot change the contract, only learn it. What Mockoon does better - Your own endpoints and responses, shaped to the contract you need. - A GUI that makes creating and editing mocks approachable. - Runs locally and offline, and headless in CI through the CLI or Docker. - Can start from an existing OpenAPI document. What this playground does better - Nothing to design, install or keep running. - Behaviour is realistic out of the box: conflicts, preconditions, rate limits, async jobs, token expiry. - Per-caller persistent state over a public HTTPS API as well as in the browser. - Practice material — guides, challenges and a glossary — built around the same APIs. Which to use Choose Mockoon to stand in for a specific API you know, locally and offline. Choose this to practise and learn against APIs whose rules you did not write. Checked against Mockoon as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/beeceptor-alternative TITLE: Beeceptor alternative — Fun API Playground ================================================================ A Beeceptor alternative with realistic behaviour built in Beeceptor is a hosted service that gives you your own endpoint on a subdomain in seconds. Requests sent to it are captured and shown so you can inspect what a client or a webhook sender actually sent, and you can add rules that return mocked responses — or proxy to a real backend — based on the request. At a glance Beeceptor compared with this playground, checked 2026-09. BeeceptorFun API PlaygroundWhat it isA hosted endpoint for inspecting and mocking requestsA ready-made simulated API catalogInspect arbitrary incoming requestsYes — its core featureOnly webhook deliveries the playground sendsWho defines responsesYou, with rulesThe playgroundDomain behaviourWhat you build from rulesBuilt in across 39 APIsAuth flowsNot modelledJWT, roles, OAuth 2.0, PKCESetupCreate an endpoint, add rulesNone Where it stops Its mocks, like any configurable mock, return what you set up, and its real strength is inspection: seeing a webhook payload or a client request arrive. It does not come with domain behaviour — there is no inventory to run out, no version to go stale, no token lifecycle — unless you build that out of rules. What is different here Here the behaviour is the product. Thirty-nine APIs keep state per caller and enforce rules that produce the full range of status codes for a reason, with interactive docs, assertions, collections and generated code around them. For capturing what a client sends, the webhook API here records deliveries you can inspect and replay, but a general-purpose request inspector is Beeceptor's job, not this one's. What Beeceptor does better - Your own hosted endpoint in seconds, with every incoming request captured for inspection. - Handy for receiving and inspecting webhooks from a real third-party service. - Rules and proxying let you mock some paths and pass the rest to a real backend. What this playground does better - Finished APIs with persistent state and real constraints, nothing to configure. - Auth flows, concurrency control, rate limits and async jobs that behave as specified. - Interactive docs, a test workspace with assertions, and OpenAPI and Postman exports. - Works offline in the browser as well as over HTTPS. Which to use Use Beeceptor to see exactly what is being sent to an endpoint, or to mock a few routes quickly. Use this when you need an API that already behaves like a real one to test a client against. Checked against Beeceptor as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/dummyjson-alternative TITLE: DummyJSON alternative — Fun API Playground ================================================================ A DummyJSON alternative where writes are real DummyJSON is a free hosted fake REST API with a broad set of realistic sample data — products, carts, users, posts, comments, recipes, todos and more — plus search, pagination, field selection and a login endpoint that returns a JWT. It is one of the richest free datasets for building a demo UI. At a glance DummyJSON compared with this playground, checked 2026-09. DummyJSONFun API PlaygroundWrites persistNo — simulated responsesYes, for your sandboxSample dataLarge and realistic, many resource types39 themed domains, smaller per domainAuthLogin returning a JWTJWT with roles, OAuth 2.0, PKCE, API keysError behaviourBasicStatus codes caused by domain rulesConcurrency controlNot modelledETag / If-Match with 412Best forData to render in a demo UITesting how a client handles an API's rules Where it stops Its add, update and delete endpoints simulate the result and do not store it, so a later GET does not see the change — the right decision for a shared public dataset, and the point where it stops being useful for testing workflows that span several requests. Error behaviour is limited to what the dataset needs. What is different here Here writes persist for the life of your sandbox, so a create can be verified, a conflict can happen and requests can be chained. Around that: role-based authorization with a real 403, ETag concurrency, idempotency keys, rate limits, webhooks, async jobs, and every status code in the catalog reachable from a documented endpoint. What DummyJSON does better - Large, realistic datasets — product catalogues with images, users with addresses — ideal for UI demos. - Search, pagination, sorting and field selection across many resources. - Familiar resource names that drop straight into tutorial apps. What this playground does better - Writes persist per caller, so multi-step workflows can be tested end to end. - Failure modes with causes: 409, 412, 422, 429, 402, 410. - Auth with roles and real 403s, plus OAuth 2.0 flows. - OpenAPI 3.1 and Postman exports for every API. Which to use DummyJSON is the better choice when you need plenty of realistic data to render. This is the better choice when you need a POST to stick and an API that says no for a reason. Checked against DummyJSON as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/postman-mock-server-alternative TITLE: Postman mock server alternative — Fun API Playground ================================================================ A Postman mock server alternative with state Postman mock servers serve responses from the examples saved in a Postman collection. Each request is matched to the most suitable saved example — by method, path, and optionally headers or body — and that example's status, headers and body are returned. They are hosted by Postman and are a quick way to give a front-end something to call while the real API is built. At a glance Postman mock servers compared with this playground, checked 2026-09. Postman mock serversFun API PlaygroundResponses come fromExamples saved in your collectionA simulated engine with rulesWrites persistNoYesYour own contractYesNoAccount neededA Postman accountNonePostman collectionIt is oneExported for every APIBest forContract-first front-end workPractising against stateful behaviour Where it stops A mock server returns saved examples; it does not keep state. A POST does not create anything a later GET can find, and a failure appears only if someone saved an example for it and the request matches that example. That suits contract-first development and demos, and leaves out the behaviour that only exists between requests. What is different here Here state is the point: creates are visible to later reads, versions advance, stock and seats run out, tokens expire. Every API also exports a Postman collection, so requests practised here move straight into Postman, and the in-site workspace offers the same collection, variable and assertion model. What Postman mock servers does better - Mocks your own API from your own collection, so the responses match your contract. - Integrated with the rest of Postman — collections, environments, monitors and team workspaces. - Ideal for contract-first work, before the real backend exists. What this playground does better - State that persists between requests, so multi-step flows are testable. - Failures that happen because of the data, not because an example was saved. - Nothing to set up, and free of any account. - Postman collections exported for every API, so nothing practised here is stranded. Which to use Use a Postman mock server to stand in for your own API while it is being built. Use this to practise against an API with state and rules you did not write — and import its collections into Postman when you do. Checked against Postman mock servers as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/pokeapi-alternative TITLE: PokeAPI alternative — Fun API Playground ================================================================ A PokeAPI alternative for practising writes and errors PokeAPI is a free, open, community-maintained RESTful API with comprehensive Pokémon data — species, moves, abilities, types, items, evolution chains and much more — reached with GET requests. It is the reference choice for any app that needs accurate Pokémon information, and a popular first API for learning to fetch and render JSON. At a glance PokeAPI compared with this playground, checked 2026-09. PokeAPIFun API PlaygroundDataReal, comprehensive Pokémon dataSmall, invented, fan-made dataMethodsGET onlyGET, POST, PUT, DELETEAuthNoneBearer tokens with rolesConcurrencyNot applicableIf-Match with a real 412Fit for repeated test runsFair use; caching expectedYes — isolated sandbox or in-browser engineBest forBuilding an app with real Pokémon dataPractising API testing with a familiar theme Where it stops It is read-only by design: there is nothing to create, update or delete, and so no conflicts, validation failures or authentication to practise. It also asks for fair use and recommends caching, which means it is the wrong target for load tests or for hammering in a loop while learning. What is different here The Pokémon API here is unofficial, fan-made and much smaller, with invented data — and it accepts writes. You can catch (POST), level up (PUT with If-Match), release (DELETE with a viewer token that gets a 403) and simulate battles, against a sandbox that is yours alone, with a full set of failure codes and interactive docs around it. What PokeAPI does better - Accurate, comprehensive Pokémon data — the real thing, for real apps. - A large, well-known dataset with evolution chains, moves and sprites. - Widely used in tutorials and with community client libraries in many languages. What this playground does better - Create, update and delete endpoints, with state that persists in your sandbox. - Authentication and roles, optimistic concurrency and validation errors to test. - No shared fair-use concern: your sandbox is isolated, and the engine runs in your browser. - Sits in a catalog of 39 APIs with guides and challenges built on them. Which to use For anything that needs true Pokémon data, use PokeAPI. For practising writes, auth and error handling with the same theme, use this — it is unofficial and its data is invented on purpose. Checked against PokeAPI as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/swapi-alternative TITLE: SWAPI alternative — Fun API Playground ================================================================ A SWAPI alternative with writes, auth and errors SWAPI, the Star Wars API, is a long-standing free REST API with data about the films' people, planets, starships, vehicles, species and films, linked to one another by URL. It is a classic teaching API for fetching JSON and following links between resources, and several community mirrors keep it available. At a glance SWAPI compared with this playground, checked 2026-09. SWAPIFun API PlaygroundDataFilm data about people, planets, starships and moreSmall, invented, fan-made dataMethodsGET onlyGET, POST, PUT, DELETEAuthNoneBearer tokens with rolesFailure modesMostly 404400, 401, 403, 404, 412 and moreBest forLearning to read and follow an APILearning to test one Where it stops It is read-only, so there is nothing to create, edit or delete and no failure mode beyond a 404 for a missing id. That makes it good for learning to read an API and limited for learning to test one — auth, conflicts and validation never come up. What is different here The Star Wars API here is unofficial, fan-made and smaller, with invented data, and it supports the full set of operations: add and update characters (with If-Match), delete them as an admin, page and filter by affiliation, with a sandbox per caller so your changes are yours alone. What SWAPI does better - Canon data from the films, linked between resources. - A classic, widely documented teaching API with community mirrors and client libraries. - Linked resources by URL, good for learning hypermedia-style navigation. What this playground does better - Writes that persist in your sandbox: create, update and delete. - Auth with roles, optimistic concurrency and validation failures to test. - Interactive docs, generated code in nine languages and OpenAPI exports. - Part of a 39-API catalog with guides and challenges. Which to use Use SWAPI to learn to read an API with data from the films. Use this to practise testing one — it is unofficial, and its data is invented on purpose. Checked against SWAPI as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/compare/free-mock-api-tools TITLE: Free mock APIs compared — Fun API Playground ================================================================ Free mock APIs compared: which one for which job The free tools in this space fall into three groups, and most of the frustration people have with them comes from reaching into the wrong group. Knowing which is which takes about a minute and saves an afternoon. At a glance the free mock API landscape compared with this playground, checked 2026-09. Fixed datasetReflectorConfigurable mockThis playgroundJSONPlaceholder, reqreshttpbin, Postman EchoMockoon, WireMock, Beeceptorfunapi.devSetup requiredNoneNoneYou define every responseNoneWrites persistNoN/A — no resourcesIf you configure itYesWho wrote the rulesThe maintainersNobody — it reflectsYou didSomebody else, which is the pointStateful failuresNoNoOnly ones you scriptedYes — 409, 412, 429 with a causeRuns offlineNoIf self-hostedYesYes — the engine is in the browserSpec exportNoNoUsually spec-driven alreadyOpenAPI 3.1 and PostmanBest forA body to renderWhat did my client sendReproducing one exact contractRehearsing how an API misbehaves Where it stops The groups are: fixed public datasets you cannot change (JSONPlaceholder, reqres); protocol reflectors with no domain (httpbin, Postman Echo); and configure-your-own mock servers where you define the responses yourself (Mockoon, WireMock, Beeceptor, Prism, Mocky). Each is good at its own job and poor at the others, and none of the first two lets you provoke a stateful failure. What is different here This playground is a fourth thing: a simulated API with persistent per-caller state and behaviour that pushes back. You do not configure the responses — the point is that you did not write them, so you find out how your client copes with rules somebody else chose. That is closer to integrating with a real third-party API than any config file can be, and it is the gap the other three groups leave. What the free mock API landscape does better - A fixed public dataset is better when you want a body to render and nothing more. - A protocol reflector is better when the question is "what did my client actually send". - A configurable mock server is better when you must reproduce one specific third-party contract exactly, or run entirely offline inside CI with no external dependency at all. - A self-hosted option is better where the network will not allow outbound calls. What this playground does better - Nothing to configure, install or sign up for. - Stateful behaviour with real constraints, so failures happen for reasons. - Every HTTP status code in the catalog reachable from a documented endpoint. - The full engine runs in the browser, so it also works with no network at all. - OpenAPI 3.1 and Postman exports, so anything you practise here moves into your own tooling. Which to use Pick by the question you are asking. Rendering a list: a fixed dataset. Debugging your client: a reflector. Reproducing one exact contract: a configurable mock. Learning or rehearsing how an API behaves when things go wrong: this. Checked against the free mock API landscape as of 2026-09. Other comparisons - JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference. - httpbin — httpbin shows you the request. This shows you an API. They answer different questions. - reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path. - json-server — json-server turns a JSON file into a REST API in seconds. It does not push back — and that is the difference. - WireMock — WireMock reproduces the API you already know, exactly. This one gives you an API you do not control. - Mockoon — Mockoon is for designing your own mock API. This one is an API already designed, with rules you have to discover. - Beeceptor — Beeceptor gives you a hosted endpoint to inspect and mock. This gives you finished APIs that behave like real ones. - DummyJSON — DummyJSON has rich sample data and a JWT login. Its writes are simulated; here they persist. - Postman mock servers — A Postman mock server replays the examples saved in a collection. This one runs an API with state and rules. - PokeAPI — PokeAPI is the real Pokémon database, read-only. This Pokémon API is invented data you can write to and break. - SWAPI — SWAPI serves Star Wars data, read-only. This Star Wars API is invented practice data you can change. All 39 mock REST APIs · Getting started guide · About this playground Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tools/curl-converter TITLE: curl to code converter — Fun API Playground ================================================================ Convert a curl command to code Paste any curl command — including one copied straight out of your browser's network tab with "Copy as cURL" — and get the same request written out in nine languages. The command is parsed in the page: method, URL, headers and body are read out of it and then re-rendered, so what comes back is the request you pasted rather than a template with your URL dropped into it. Worked example This command: curl -X POST 'https://funapi.dev/api/friends/v1/characters' \ -H 'Authorization: Bearer qa-admin-token' \ -H 'Content-Type: application/json' \ -d '{"name":"Gunther","job":"Head barista"}' is parsed as POST https://funapi.dev/api/friends/v1/characters with 2 header(s) and a 39-byte body, and converts to: JavaScript (fetch) const res = await fetch("https://funapi.dev/api/friends/v1/characters", { method: "POST", headers: { "Authorization": "Bearer qa-admin-token", "Content-Type": "application/json" }, body: "{\"name\":\"Gunther\",\"job\":\"Head barista\"}" }); console.log(res.status, await res.json()); JavaScript (axios) import axios from 'axios'; const res = await axios({ method: "post", url: "https://funapi.dev/api/friends/v1/characters", headers: { "Authorization": "Bearer qa-admin-token", "Content-Type": "application/json" }, data: {"name":"Gunther","job":"Head barista"} }); console.log(res.status, res.data); Python (requests) import requests url = "https://funapi.dev/api/friends/v1/characters" headers = { "Authorization": "Bearer qa-admin-token", "Content-Type": "application/json" } payload = {"name":"Gunther","job":"Head barista"} res = requests.post(url, headers=headers, json=payload) print(res.status_code, res.json()) Go (net/http) package main import ( "fmt" "io" "net/http" "strings" ) func main() { req, _ := http.NewRequest("POST", "https://funapi.dev/api/friends/v1/characters", strings.NewReader("{\"name\":\"Gunther\",\"job\":\"Head barista\"}")) req.Header.Set("Authorization", "Bearer qa-admin-token") req.Header.Set("Content-Type", "application/json") res, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer res.Body.Close() out, _ := io.ReadAll(res.Body) fmt.Println(res.StatusCode, string(out)) } C# (HttpClient) using var client = new HttpClient(); var req = new HttpRequestMessage(HttpMethod.Post, "https://funapi.dev/api/friends/v1/characters"); req.Headers.TryAddWithoutValidation("Authorization", "Bearer qa-admin-token"); req.Content = new StringContent("{\"name\":\"Gunther\",\"job\":\"Head barista\"}", Encoding.UTF8, "application/json"); var res = await client.SendAsync(req); Console.WriteLine((int)res.StatusCode); Console.WriteLine(await res.Content.ReadAsStringAsync()); Java (RestAssured) given() .header("Authorization", "Bearer qa-admin-token") .header("Content-Type", "application/json") .body("{\"name\":\"Gunther\",\"job\":\"Head barista\"}") .when() .post("https://funapi.dev/api/friends/v1/characters") .then() .statusCode(200); Playwright import { test, expect } from '@playwright/test'; test('POST request', async ({ request }) => { const res = await request.post("https://funapi.dev/api/friends/v1/characters", { headers: { "Authorization": "Bearer qa-admin-token", "Content-Type": "application/json" }, data: {"name":"Gunther","job":"Head barista"} }); expect(res.status()).toBe(200); }); k6 import http from 'k6/http'; import { check } from 'k6'; export default function () { const res = http.request("POST", "https://funapi.dev/api/friends/v1/characters", "{\"name\":\"Gunther\",\"job\":\"Head barista\"}", { headers: { "Authorization": "Bearer qa-admin-token", "Content-Type": "application/json" } }); check(res, { 'status is 200': r => r.status === 200 }); } HTTPie echo "{\"name\":\"Gunther\",\"job\":\"Head barista\"}" | http POST "https://funapi.dev/api/friends/v1/characters" Authorization:"Bearer qa-admin-token" Content-Type:"application/json" What it handles Backslash line continuations and the caret form cmd.exe uses, single and double quoting with escapes, repeated -H headers, repeated -d bodies joined the way curl joins them, -u basic auth normalised into an Authorization header, and the pile of flags a devtools copy brings along (--compressed, -s, -L, --max-time and friends), which are recognised and dropped rather than mistaken for the URL. The two things it makes explicit curl defaults to POST when you give it a body and no method, and it sets a content type you never wrote. Every other client in the list does neither. Both are therefore made explicit in the output — an inferred POST and an inferred Content-Type — because the most common way a converted request stops working is that the implicit half of the curl command did not come with it. When it refuses An unknown flag that might take a value stops the conversion instead of being skipped, because skipping it would swallow the URL that followed it and produce a plausible, wrong result. An unbalanced quote does the same. A converter that fails loudly is worth more than one that guesses. Related - Getting started guide - The Friends API this example calls - What a bearer token is Other tools - JWT decoder — Paste a JSON Web Token to read its header and claims, and see whether it has expired. Nothing leaves the page. - HMAC signature verifier — Check a webhook signature against the payload and the shared secret, with HMAC-SHA256, SHA-1 or SHA-512. Nothing leaves the page. All tools · Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tools/jwt-decoder TITLE: JWT decoder — Fun API Playground ================================================================ Decode a JWT and read its claims A JWT is three base64url segments: a header naming the signing algorithm, a payload of claims, and a signature. The first two are not encrypted — anybody holding the token can read them — so decoding one needs no key and no server. This does it in the page, works out whether the token is still valid from its exp claim, and renders the timestamps as dates. Nothing is uploaded The decoding happens in your browser and the token never crosses the network. That matters more here than it sounds: a JWT is a live credential, and pasting a production token into a tool that posts it to a server is a credential disclosure. Load this page, disconnect, and it still works. What it cannot tell you It does not verify the signature, and no decoder that only has the token can. Verification needs the signing key, which is exactly the thing you are not going to paste into a web page. Read the output as "this is what the token claims", not as "this token is genuine" — anybody can craft a JWT that decodes cleanly and is signed with nothing. The claims worth reading exp is expiry and iat is issue time, both as seconds since the epoch rather than milliseconds, which is the off-by-1000 that breaks most first attempts. sub is the subject, aud the intended audience and iss the issuer; a token valid for a different audience is a real and easily-missed cause of a 401. Scopes and roles are conventions rather than standards, so they appear under whatever name the issuer chose. Related - What a JWT is - Testing OAuth 2.0, JWTs and token expiry - The Auth Playground that issues real signed JWTs - HTTP 401 Unauthorized Other tools - curl converter — Paste a curl command, get the same request in nine languages — fetch, axios, Python, Go, C#, RestAssured, Playwright, k6 and HTTPie. - HMAC signature verifier — Check a webhook signature against the payload and the shared secret, with HMAC-SHA256, SHA-1 or SHA-512. Nothing leaves the page. All tools · Getting started guide · All 39 mock REST APIs Last updated 2 October 2026 ================================================================ URL: https://funapi.dev/tools/hmac-verifier TITLE: HMAC signature verifier — Fun API Playground ================================================================ Verify an HMAC webhook signature Paste the raw request body, the shared secret and the signature you received, and this computes the HMAC and compares them. It is the check every webhook receiver has to do and the one that most often fails on the first attempt for a reason that has nothing to do with the cryptography. Why a correct implementation still fails Almost always because the payload changed before it was hashed. The signature covers the exact bytes that arrived, so a receiver that parses the JSON and re-serialises it before hashing is signing a different string — key order, whitespace and number formatting all shift. Capture the raw body first and hash that. The other frequent cause is a signature header that carries a prefix ("sha256=") or a different encoding, hex versus base64. Constant-time comparison In production, compare with a constant-time function — crypto.timingSafeEqual in Node, hmac.compare_digest in Python. A normal string comparison returns on the first differing byte, and the timing difference is enough to reconstruct a valid signature given enough attempts. This page compares in constant time too, though against a secret you pasted yourself it is a demonstration rather than a defence. A signature is not a freshness check A validly signed payload stays validly signed forever, so anyone who captures one can replay it. Real webhook providers sign a timestamp alongside the body and expect receivers to reject anything older than a few minutes. If the provider gives you a timestamp, it is part of the signed string, not a header to ignore. Related - What an HMAC signature is - Testing webhooks and HMAC signature verification - The Webhooks API that signs its deliveries Other tools - curl converter — Paste a curl command, get the same request in nine languages — fetch, axios, Python, Go, C#, RestAssured, Playwright, k6 and HTTPie. - JWT decoder — Paste a JSON Web Token to read its header and claims, and see whether it has expired. Nothing leaves the page. All tools · Getting started guide · All 39 mock REST APIs Last updated 2 October 2026