Superhero API — free mock REST API for testing

Original heroes and villains with powers, teams and nemeses. Practice nested resources (/heroes/{id}/nemesis), filtering and role-based auth.

The Superhero API is the smallest resource tree in the catalog and the clearest one for practising nested routes: heroes own powers, and powers are addressed underneath their hero rather than in a flat collection. If you are writing a client that has to build URLs from parent ids, or tests that must clean up children before parents, this is the shape to rehearse on.

Base URL: https://funapi.dev/api/superheroes/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/superheroes/v1/heroes — List heroes (paginated, filterable). No token, no signup:

curl -i https://funapi.dev/api/superheroes/v1/heroes

answers 200 OK with:

{
  "page": 1,
  "pageSize": 4,
  "total": 8,
  "totalPages": 2,
  "data": [
    {
      "id": 1,
      "name": "Captain Volt",
      "alias": "Deniz Aksoy",
      "power": "electricity",
      "team": "Alpha Squad",
      "nemesisId": 5,
      "_v": 1
    },
    {
      "id": 2,
      "name": "Night Owl",
      "alias": "Sam Reyes",
      "power": "night vision",
      "team": "Alpha Squad",
      "nemesisId": 6,
      "_v": 1
    },
    {
      "id": 3,
      "name": "Aqua Comet",
      "alias": "Mira Chen",
      "power": "hydrokinesis",
      "team": "Freelance",
      "nemesisId": null,
      "_v": 1
    },
    {
      "id": 4,
      "name": "Turbo Tortoise",
      "alias": "unknown",
      "power": "super speed (eventually)",
      "team": "Freelance",
      "nemesisId": 7,
      "_v": 1
    }
  ]
}

Open and run this endpoint

What you can practise here

• Fetch a hero, then its powers sub-collection, and check what happens when the parent id is valid but the child id is not.
• Delete a hero that still has powers attached and see how the API handles the orphaned children.
• Use If-Match with a stale ETag on an update and confirm the 412 before your real client meets one.
• Call a write endpoint with qa-viewer-token to see the 403 that separates read-only from admin credentials.

heroes

capes, powers and their sworn enemies

• GET /superheroes/v1/heroes — List heroes (paginated, filterable) · Responds with 200 400 404 Link to this endpoint
• GET /superheroes/v1/heroes/{id} — Get one hero · Responds with 200 404 Link to this endpoint
• GET /superheroes/v1/heroes/{id}/nemesis — Get a hero's nemesis (nested resource) · Responds with 200 404 Link to this endpoint
• POST /superheroes/v1/heroes — Register a new hero (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
• DELETE /superheroes/v1/heroes/{id} — Retire a hero (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint
• POST /superheroes/v1/heroes/versus — Simulate a fight between two heroes (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint

Related APIs

• Dino Park API — Dinosaurs, enclosures & the occasional breach.
• Space Agency API — Launches, scrubs & probes with real signal lag.

All 39 mock REST APIs

Use this response elsewhere

• JSON to TypeScript on fundata.dev — an interface for this response
• JSON to Zod on fundata.dev — a runtime validator for it
• mock API data on fundata.dev — thousands of records of the same shape for your own fixtures

Last updated 15 October 2026