The API client that feels like a Mac app.

Everything it does, as response headers.

Curlew has a long feature list. This seemed like the honest way to print it.

200 OKcurlew.app/features · 14 headers

Protocols

HTTP with every method, GraphQL with live schema introspection, WebSocket frames, and a Server-Sent Events viewer for streaming APIs.

Body

JSON with formatting and validation, URL-encoded and multipart forms with file attachments, plain text, XML.

Authorization

OAuth 2.0 (Authorization Code with PKCE, Client Credentials, background refresh), Bearer, Basic, API keys.

Client-Cert

Mutual TLS with PKCS#12 certificates bound to hostnames. Per-request TLS bypass for localhost and staging, with a visible warning.

Environment

{{baseUrl}} anywhere, with autocomplete. Request chaining lifts values out of one response into the next request.

Pre-Request

Sandboxed JavaScript before each send for signatures, HMAC-SHA256 hashes and computed headers.

Import-Export

OpenAPI 3.0, Postman 2.1 and HAR 1.2 in both directions. Markdown API docs. JSON to CSV or TSV.

Codegen

13 languages: Swift, Python, JavaScript, Node.js, Go, Rust, Java, C#, Kotlin, PHP, Ruby, cURL, HTTPie. Plus typed models from any JSON response in Swift, TypeScript, Python, Go and Rust.

Test

Collection Runner with assertions on status, JSON path, body text and latency. Markdown test reports.

Mock

A built-in mock server serves a whole collection on localhost, with wildcard routes and CORS.

Monitor

Menu bar monitors re-run a request on an interval and notify you when it fails.

Timing

DNS, TCP, TLS, time to first byte and download as a waterfall. Repeat a request 5–100× for min, median, p95 and max.

Inspect

JWT decoder with expiry countdown, cookie jar, searchable headers, HTML and image preview, hex dump, and a diff against the previous response.

Telemetry

none

Twenty variables that invent test data.

Drop one into a URL, header or body and it is generated fresh on every send. Click any card to roll it again.