Superhero API — free mock REST API for testing

Original heroes and villains with powers, teams and nemeses. Practice nested resources (/heroes/{id}/nemesis), filtering and role-based auth.

The Superhero API is the smallest resource tree in the catalog and the clearest one for practising nested routes: heroes own powers, and powers are addressed underneath their hero rather than in a flat collection. If you are writing a client that has to build URLs from parent ids, or tests that must clean up children before parents, this is the shape to rehearse on.

Base URL: https://funapi.dev/api/superheroes/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

What you can practise here

• Fetch a hero, then its powers sub-collection, and check what happens when the parent id is valid but the child id is not.
• Delete a hero that still has powers attached and see how the API handles the orphaned children.
• Use If-Match with a stale ETag on an update and confirm the 412 before your real client meets one.
• Call a write endpoint with qa-viewer-token to see the 403 that separates read-only from admin credentials.

heroes

capes, powers and their sworn enemies

• GET /superheroes/v1/heroes — List heroes (paginated, filterable)
• GET /superheroes/v1/heroes/{id} — Get one hero
• GET /superheroes/v1/heroes/{id}/nemesis — Get a hero's nemesis (nested resource)
• POST /superheroes/v1/heroes — Register a new hero (requires Bearer auth)
• DELETE /superheroes/v1/heroes/{id} — Retire a hero (requires Bearer auth)
• POST /superheroes/v1/heroes/versus — Simulate a fight between two heroes (requires Bearer auth)

Related APIs

• Dino Park API — Dinosaurs, enclosures & the occasional breach.
• Space Agency API — Launches, scrubs & probes with real signal lag.

All 39 mock REST APIs