# Fun API Playground — full text
# Every indexable page on https://funapi.dev/ as plain text, generated at
# build time from the same content the site renders. See /llms.txt for the
# short version. 119 pages.

================================================================
URL: https://funapi.dev/
TITLE: 39 Mock REST APIs for QA Testing — Fun API Playground
================================================================

39 playful mock REST APIs. Every status code you'll ever need to test.

Real, working mock REST endpoints with Swagger-style docs — CRUD, Bearer tokens, pagination, filtering, GraphQL, webhooks, and errors on demand. Always free, no signup. Pick an API and hit Try it out.

Getting started guide

Fandom & Pop Culture
- Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints)
- Movies API — QA-themed cinema. Sort, filter, rate. (9 endpoints)
- Harry Potter API — Houses, students & spells from a magic school. (10 endpoints)
- Star Wars API — Characters, planets & starships from a galaxy far away. (11 endpoints)
- Sherlock Holmes API — Cases, suspects & clues from Baker Street. (10 endpoints)
- Pokémon API — Creatures, trainers & simulated battles. (10 endpoints)
- Middle-earth API — Fellowship, quests & artifacts from a fantasy realm. (9 endpoints)
- The Office API — Employees, pranks & quotes from a paper company. (8 endpoints)
- Marvel API — Avengers, villains & mission assignments. (10 endpoints)
- Game of Thrones API — Houses, nobles & dragons of Westeros. (12 endpoints)
- Rick and Morty API — Characters, locations & episodes across the multiverse. (9 endpoints)
- Starfleet API — Ships, warp limits & exponentially multiplying tribbles. (10 endpoints)
- GTA API — Characters, vehicles, weapons, missions, heists, a wanted system & radio stations across Los Santos, Vice City and Liberty City. (17 endpoints)
- Dragon Ball API — Fighters, transformations, power levels & tournaments. (6 endpoints)
- Voxel Worlds API — Block worlds, players, inventories & coordinates. (6 endpoints)
- Anime Tournament API — Original fighters, power levels & tournament brackets. (5 endpoints)
- Retro Quest API — Pixel heroes, quests, loot & save-game conflicts. (5 endpoints)

Everyday Life
- Pizza Orders API — Place & track orders. Includes a guaranteed 500. (9 endpoints)
- Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints)
- Football API — Teams, squads, standings & simulated matches. (7 endpoints)
- Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints)
- Airline API — Flights, seat conflicts & overbooking drama. (9 endpoints)
- Shop API — Carts, stock drama & expired coupons. (9 endpoints)
- Cargo Tracking API — Shipment state machines. Writes need an X-API-Key. (9 endpoints)
- World Cup 2026 API — Teams, groups, venues, match simulation, tickets & bracket predictions across the 2026 host cities. (17 endpoints)
- FIBA World Cup API — Teams, Doha arenas, quarter-by-quarter game simulation, box scores, coach challenges, cursor-paged play-by-play & ticketing. (22 endpoints)
- Formula 1 API — Drivers, constructors, races, telemetry & pit stops. (7 endpoints)

Original Worlds
- Superhero API — Heroes, powers & nemeses. Great for nested resources. (6 endpoints)
- Dino Park API — Dinosaurs, enclosures & the occasional breach. (9 endpoints)
- Space Agency API — Launches, scrubs & probes with real signal lag. (9 endpoints)

Testing Scenarios
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. (6 endpoints)
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints)
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints)
- Object Storage API — Objects, checksums, ranges & resumable uploads. (4 endpoints)
- Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. (6 endpoints)
- Event Streams API — SSE events, replay cursors, heartbeats & ordering. (3 endpoints)
- Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (4 endpoints)
- Search & Facets API — Full-text queries, facets, highlights & cursor pagination. (2 endpoints)
- Fun Data Bridge API — Seeded fixtures from schemas, inspired by fundata.dev. (4 endpoints)

FAQ

Do I need to sign up?No. The web playground runs entirely in your browser with zero backend, and the live API accepts the documented tokens without registration.
Which Bearer token should I use?qa-admin-token for full access, qa-viewer-token for read + write with 403 on DELETE. Anything else returns 401.
How do I reset sandbox data?Click ↺ Reset sandbox data on any docs page, reload the page, or call window.__funApiReset() in the browser console. Against the live backend, requests are isolated by X-Sandbox-ID.
Can I export the API spec?Yes — every docs page has download buttons for an OpenAPI 3.1 spec and a Postman collection, and the whole catalog is served as one OpenAPI 3.1 document at /openapi.json.

================================================================
URL: https://funapi.dev/guide
TITLE: Getting Started Guide — Fun API Playground
================================================================

Getting started

Everything here is a simulated sandbox — no real server, no signup, nothing to break. Five minutes and you are testing.

Step 1: Pick an API and open its docs
From the homepage, click any API card. You land on a Swagger-style page listing every endpoint, grouped by tag. Green is GET, blue is POST, orange is PUT, red is DELETE.
The catalog is grouped four ways — fandoms, everyday business domains, original worlds and pure testing scenarios — because the domain is the part you should not have to think about. If you already know how a pizza order or a flight booking behaves, the only new thing on the page is the HTTP.
Step 2: Send your first request
Expand an endpoint, click Try it out, fill the parameters, choose Browser sandbox, then click Run request. You get a real status code, a JSON body, response headers and a ready-to-copy curl command. A good first one:
GET /friends/v1/quotes/random
Browser sandbox runs the whole API engine locally — no network, no rate limits, nothing to wait for. Switch the environment picker to Live API when you want the same endpoint over the real network, served by a Cloud Function against Firestore.
Step 3: Authorize for protected endpoints
Endpoints marked with a lock need a Bearer token. Click Authorize at the top of any docs page and use one of these:
- qa-admin-token: full access — everything works
- qa-viewer-token: read + write, but DELETE returns 403
- anything else: always 401 Unauthorized

One exception: the Cargo API's write endpoints use API-key auth instead — send the header X-API-Key: cargo-key-123. It is there precisely because not every API you will ever test uses Bearer.
For a real token lifecycle rather than a static string, POST /auth/v1/login issues a genuine signed JWT, and the OAuth 2.0 endpoints run the authorization-code, client-credentials and refresh-token flows end to end.
Step 4: Practice negative testing
Every error code is one request away:
- 400: send page=abc, an invalid JSON body, or a rating of 11
- 401 / 403: wrong token / viewer token on a DELETE
- 404: ask for id 999, or a page past the last one
- 418: GET /coffee/v1/teapot — it is, in fact, a teapot
- 402: GET /bank/v1/premium/statements — the paywall says hi
- 500: GET /pizza/v1/oven/status — always fails, by design
- 503 / 504: GET /protocol/v1/maintenance and /gateway-timeout — outages on demand
- 413 / 415: POST /movies/v1/movies/{id}/poster — oversized or wrong-type file upload

The point of provoking these deliberately is that each one should make your client do something different. A 429 means wait and retry; a 403 means never retry; a 503 means retry the whole request later; a 400 means fix the request first. A client that treats all four as "the call failed" is a client that will retry its way into an outage.
Step 5: Take it into your own tools
Each docs page has a download button for an OpenAPI 3.1 spec and a Postman collection — import either into Postman, Insomnia, Bruno or Swagger Editor and build your test collections there. Every executed request also shows its equivalent in nine languages: curl, fetch, axios, Python, HTTPie, Playwright, RestAssured, C# and k6.
There is a merged spec covering all the APIs at once, next to the per-API downloads, if you want one file to point a contract tester at.
Step 6: Test concurrency and idempotency
PUT and DELETE on characters, heroes and movies accept an optional If-Match header — send a stale ETag to get 412 Precondition Failed, which is what stops two clients silently overwriting each other. POST endpoints accept an Idempotency-Key header — repeat the same key and you get the original response back instead of a duplicate.
Both are worth rehearsing because both fail quietly in production: an ignored ETag loses an edit nobody notices for a week, and a missing idempotency key turns one network retry into two charges.
Step 7: Automate it
Turn on Deterministic mode in Test settings for repeatable random values — quotes, scores, latency — which is what makes an assertion safe to run in CI. Call window.__funApiReset() from your test runner to reset data without touching the UI.
Feed the OpenAPI spec into a contract tester such as Dredd or Schemathesis to check real responses against the spec, and try GET /pizza/v1/oven/preheat — it always takes about three seconds, which is exactly what you need to prove your client's timeout works.
Against the live API, every caller is isolated by an X-Sandbox-ID header, so a suite that creates and deletes records cannot collide with anybody else running the same suite.

Good to know

POST, PUT and DELETE really change the sandbox data — create a character, then GET it back. Reloading the page or clicking Reset sandbox data restores the original seed.

Where to go next

Jump straight into an API: Friends API · Pokémon API · Star Wars API · Bank API · Auth Playground API · Webhooks API

Go deeper on one technique: Pagination testing · Rate limit testing · Idempotency key testing · ETag and If-Match testing · Webhook signature testing · OAuth and JWT testing · Negative testing · Async job testing

Or look up a status code: all 28 of them

Browse all 39 APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/challenges
TITLE: 23 API Testing Exercises — Fun API Playground
================================================================

23 API testing exercises you can actually finish

Reading about a 409 is not the same as provoking one. These are 23 things to make the APIs
do, in 7 groups, from a first 200 to verifying an HMAC signature on a webhook delivery.
Each step ticks itself off the moment a request you run produces the response it asks for — in the browser
sandbox or against the live API, either counts — because the runner records every endpoint and status it
sees. Nothing is submitted anywhere and there is no account: progress is stored on your own device.

New to the site? Start with the getting started guide, or look up
any status code as you go.

First contact (easy)
Send a request, read a status line, and find your way around an endpoint panel.
- Get a random Friends quote — a plain 200 with no parameters to fill in. Open the endpoint · Passes on 200 OK
- Fetch a single character by id. Open the endpoint · Passes on 200 OK
- Ask for a character that does not exist (try id 999) and get a 404 back. Open the endpoint · Passes on 404 Not Found

Errors on demand (easy)
The four error codes every test suite should have a case for, each one request away.
- Brew coffee in a teapot and collect your 418. Open the endpoint · Passes on 418 I'm a Teapot
- Trip the coffee shop rush-hour rate limit — four requests inside ten seconds gets you a 429. Open the endpoint · Passes on 429 Too Many Requests
- Check the pizza oven, which fails by design, for a 500. Open the endpoint · Passes on 500 Internal Server Error
- Walk into the bank paywall and get a 402. Open the endpoint · Passes on 402 Payment Required

Auth and roles (medium)
Prove that the same request behaves differently for three different callers.
- Call a protected endpoint with no token, or a junk one, and get a 401. Open the endpoint · Passes on 401 Unauthorized
- Authorize with qa-admin-token and create a character — a 201 with a Location header. Open the endpoint · Passes on 201 Created
- Switch to qa-viewer-token and try a DELETE. Authenticated, but not allowed: 403. Open the endpoint · Passes on 403 Forbidden
- Log in for a real signed JWT (admin / admin123) instead of a demo token. Open the endpoint · Passes on 200 OK

Concurrency and caching (medium)
The headers that stop two clients from overwriting each other — and stop you re-sending a payment.
- Send an If-None-Match with a current ETag to a standings endpoint and get a 304. Open the endpoint · Passes on 304 Not Modified
- Send a stale If-Match on a PUT and get a 412 instead of a silent overwrite. Open the endpoint · Passes on 412 Precondition Failed
- Create a conflict a retry cannot fix — book a taken seat, or check out an empty cart: 409. Open the endpoint · Passes on 409 Conflict

Protocol lab (hard)
Asynchronous work, redirects, content negotiation and the two outage codes.
- Start a background job and get a 202 with somewhere to poll. Open the endpoint · Passes on 202 Accepted
- Follow a permanent redirect and read the Location header off a 301. Open the endpoint · Passes on 301 Moved Permanently
- Ask for a representation the server cannot produce and get a 406. Open the endpoint · Passes on 406 Not Acceptable
- Hit a maintenance window (503, with Retry-After) or a gateway timeout (504). Open the endpoint · Passes on 503 Service Unavailable, 504 Gateway Timeout

Uploads and partial success (hard)
The two failure modes of file upload, and the status code for “some of it worked”.
- Upload a poster the server considers too large: 413. Open the endpoint · Passes on 413 Content Too Large
- Upload the wrong content type to the same endpoint: 415. Open the endpoint · Passes on 415 Unsupported Media Type
- Bulk-create characters where only some of them are valid and read the 207 body. Open the endpoint · Passes on 207 Multi-Status

Webhooks end to end (hard)
Subscribe, trigger, and verify the signature that proves the delivery was not forged.
- Create a webhook subscription and keep its secret. Open the endpoint · Passes on 201 Created
- Trigger an event and watch a delivery attempt come back. Open the endpoint · Passes on 201 Created, 200 OK

Testing techniques explained · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/about
TITLE: About & how it works — Fun API Playground
================================================================

About Fun API Playground

Fun API Playground is a sandbox for practising REST API testing. It exists because the realistic parts of API work — the 429 you have to back off from, the 412 that means someone else wrote first, the POST that timed out and may or may not have gone through — are exactly the parts you cannot rehearse against a real production API without consequences.

Who it is for
QA engineers writing their first API test suite, developers learning what the headers in an HTTP exchange are actually for, students who need an endpoint that answers immediately, and anyone building a client who wants to see it meet a failure before a customer does.
No account, no API key, no quota to apply for. The documented Bearer tokens are printed on every docs page because they are demo credentials, not secrets.
How it actually works
There are two of everything. The web playground runs the entire API engine inside your browser, with no backend involved at all — that is why "Try it out" answers instantly and keeps working offline. The same catalog is also served over the real network by a single Express application on Firebase Cloud Functions, backed by Firestore, for when you need a genuine HTTP round trip from curl, Postman or CI.
Both are generated from one catalog definition, so the docs, the OpenAPI 3.1 spec, the Postman collection and the live endpoints cannot describe different APIs.
What is real and what is pretend
The data is invented. The characters, orders, flights and transfers are fiction, and no endpoint here is a proxy for a real service.
The HTTP behaviour is not invented. Rate limits are counted in a shared store over a live window. Webhook deliveries are signed with a real HMAC you can verify. Tokens are genuinely signed and genuinely expire. Optimistic concurrency compares real version tokens, and writes run inside real transactions. That distinction is the entire point: practising against a mock that only pretends to fail teaches you nothing about the client you are writing.
Your data
Requests are isolated per caller by a sandbox id, so anything you create, edit or delete is yours and resets on demand. There is nothing to sign up with, so there is no account to leak.
Analytics load only after an explicit opt-in — decline and no third-party tag is ever fetched.

Related playgrounds

- Fun UI Playground — the same idea for UI test automation.

- Fun Data Playground — synthetic test data generation.

All 39 mock REST APIs · Getting started guide · Testing techniques

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status
TITLE: Every HTTP Status Code, Live — Fun API Playground
================================================================

Every HTTP status code, returned on demand

This playground answers with 28 different HTTP status codes — not as documentation, but as live endpoints you can call right now. Each page explains what the code means, why you would provoke it deliberately, and which endpoints produce it.

Success
- 200 OK — The request succeeded and the response carries the representation you asked for. For a GET this is the body; for a PUT or POST it is the result of the operation.
- 201 Created — A new resource exists as a result of this request. A well-behaved API also sends a Location header pointing at it, and usually the created representation as the body.
- 202 Accepted — The request was accepted but has not been carried out yet. The work happens asynchronously, and the response tells you where to look for the result.
- 204 No Content — The request succeeded and there is deliberately no body. Most commonly the answer to a successful DELETE.
- 206 Partial Content — The response carries only the byte range you asked for with a Range header, described by Content-Range. This is how resumable downloads and media seeking work.
- 207 Multi-Status — One response carrying several independent outcomes, for a request that operated on more than one resource. Each element has its own status.

Redirection
- 301 Moved Permanently — The resource has a new URL, given in the Location header, and clients should use it from now on.
- 302 Found — The resource is temporarily at a different URL. Unlike a 301, the original URL stays authoritative and should still be used for future requests.
- 304 Not Modified — The answer to a conditional GET whose If-None-Match matched the current ETag: your cached copy is still valid, so no body is sent.

Client error
- 400 Bad Request — The server could not understand the request — malformed JSON, a missing required field, or a parameter of the wrong type.
- 401 Unauthorized — Authentication is missing or invalid. Despite the name, this is about identity, not permission — the server does not know who you are.
- 402 Payment Required — Reserved in the original spec and now used in practice for quota, billing and insufficient-funds conditions.
- 403 Forbidden — The server knows who you are and is refusing anyway. Authentication succeeded; authorization did not.
- 404 Not Found — There is no resource at this URL. The server will not say whether there ever was one.
- 405 Method Not Allowed — The URL exists but not with this method. The response must include an Allow header listing what is permitted.
- 406 Not Acceptable — The server cannot produce a representation matching your Accept header.
- 409 Conflict — The request is valid but clashes with the current state — a duplicate, a seat already taken, a state transition that is not allowed from here.
- 410 Gone — The resource existed and has been permanently removed. Unlike a 404, the server is stating that it will not come back.
- 412 Precondition Failed — A condition in the request headers was not met — almost always an If-Match ETag that no longer reflects the current state of the resource.
- 413 Content Too Large — The request body exceeds what the server will accept. Still widely known by its old reason phrase, Payload Too Large.
- 415 Unsupported Media Type — The body is in a format the endpoint does not accept — usually a Content-Type mismatch.
- 416 Range Not Satisfiable — The Range header asks for bytes that do not exist — typically an offset past the end of the resource.
- 418 I'm a Teapot — From the 1998 April Fools' hypertext coffee-pot spec. It is a real, registered code, and a teapot cannot brew coffee.
- 422 Unprocessable Content — The syntax is fine and the server understood the request, but the content is semantically wrong — a valid date in the past where a future one is required, a transfer that would overdraw an account.
- 429 Too Many Requests — You are being rate limited. The response should carry Retry-After, and usually X-RateLimit-Limit, -Remaining and -Reset.

Server error
- 500 Internal Server Error — The server failed and cannot say anything more useful. Nothing about the request needs to be wrong.
- 503 Service Unavailable — The server is temporarily unable to handle the request — overloaded, or down for maintenance. Often accompanied by Retry-After.
- 504 Gateway Timeout — An upstream server did not respond in time. The failure is in the chain behind the endpoint, not at the endpoint itself.

Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing
TITLE: API Testing Techniques, Hands-On — Fun API Playground
================================================================

API testing techniques you can practise right now

Each technique below is backed by endpoints that really behave that way — real rate limits, real token expiry, real HMAC signatures, real conflicts — so you can rehearse the failure before production supplies it.

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Every HTTP status code · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/friends
TITLE: Friends API — Mock REST API, 14 endpoints | Fun API
================================================================

Friends API — free mock REST API for testing

Characters, episodes and quotes from the sitcom universe. Practice CRUD, Bearer auth, pagination, filtering and every error code — no setup needed.

The Friends API models a sitcom archive: six main characters with jobs and catchphrases, ten episodes, and a quote collection. It is the catalog's introduction to API versioning — the v1 character list is deliberately marked deprecated and answers with Deprecation, Sunset and Link headers pointing at v2, so you can practise the one migration path most public APIs eventually force on their consumers.

Base URL: https://funapi.dev/api/friends/v1 · 14 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/friends/v1/episodes — List episodes, filter by season. No token, no signup:

curl -i https://funapi.dev/api/friends/v1/episodes

answers 200 OK with:

{
"total": 10,
"data": [
{
"id": 1,
"title": "The One Where Monica Gets a Roommate",
"season": 1,
"episode": 1,
"rating": 8.3
},
{
"id": 2,
"title": "The One with the Prom Video",
"season": 2,
"episode": 14,
"rating": 9.4
},
{
"id": 3,
"title": "The One Where No One's Ready",
"season": 3,
"episode": 2,
"rating": 8.9
},
{
"id": 4,
"title": "The One with the Embryos",
"season": 4,
"episode": 12,
"rating": 9.5
},
{
"id": 5,
"title": "The One with All the Thanksgivings",
"season": 5,
"episode": 8,
"rating": 9.1
},
{
"id": 6,
"title": "The One with Ross's Sandwich",
"season": 5,
"episode": 9,
"rating": 9
},
{
"id": 7,
"title": "The One Where Everybody Finds Out",
"season": 5,
"episode": 14,
"rating": 9.7
},
{
"id": 8,
"title": "The One with the Cop",
"season": 5,
"episode": 16,

(truncated — the full response comes back when you run it)

Open and run this endpoint

What you can practise here
- Read the Deprecation and Sunset headers on GET /characters, then follow the Link header to the v2 successor.
- Send an unknown query parameter to the strict v1 list endpoint and watch it answer 400 rather than ignoring it.
- Create a character with an Idempotency-Key, replay the exact request, and confirm you get the original 201 body back instead of a duplicate.
- Ask for a page beyond the end of the collection and handle the 404 your pagination code probably assumes never happens.

characters
the six of them, and more
GET /friends/v1/characters — List all characters (paginated) — v1, deprecated · Responds with 200 400 404 Link to this endpoint
GET /friends/v1/characters/{id} — Get one character · Responds with 200 400 404 Link to this endpoint
POST /friends/v1/characters — Create a character (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
POST /friends/v1/characters/bulk — Batch-create characters (array body, per-item validation) (requires Bearer auth) · Responds with 201 207 400 401 Link to this endpoint
PUT /friends/v1/characters/{id} — Update a character (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
POST /friends/v1/characters/bulk-delete — Bulk-delete characters by id (partial success supported) (requires Bearer auth) · Responds with 200 207 400 401 403 Link to this endpoint
DELETE /friends/v1/characters/{id} — Delete a character (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint
GET /friends/v1/characters/{id}/quotes — Get a character's quotes (nested resource) · Responds with 200 404 Link to this endpoint
GET /friends/v2/characters — List characters — v2 (breaking change: job → occupation, re-wrapped) · Responds with 200 400 404 Link to this endpoint
GET /friends/version — Discover supported API versions · Responds with 200 Link to this endpoint
GET /friends/characters — Content-negotiated version via Accept header (406 if unsupported) · Responds with 200 406 Link to this endpoint

episodes
ten fan favorites
GET /friends/v1/episodes — List episodes, filter by season · Responds with 200 400 Link to this endpoint

quotes
could this API BE any more quotable?
GET /friends/v1/quotes/random — A random quote · Responds with 200 Link to this endpoint

graphql
one POST endpoint, query-shaped
POST /friends/v1/graphql — Run a query or mutation over character data · Responds with 200 400 Link to this endpoint

Related APIs
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.
- Sherlock Holmes API — Cases, suspects & clues from Baker Street.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/superhero
TITLE: Superhero API — Mock REST API, 6 endpoints | Fun API
================================================================

Superhero API — free mock REST API for testing

Original heroes and villains with powers, teams and nemeses. Practice nested resources (/heroes/{id}/nemesis), filtering and role-based auth.

The Superhero API is the smallest resource tree in the catalog and the clearest one for practising nested routes: heroes own powers, and powers are addressed underneath their hero rather than in a flat collection. If you are writing a client that has to build URLs from parent ids, or tests that must clean up children before parents, this is the shape to rehearse on.

Base URL: https://funapi.dev/api/superheroes/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/superheroes/v1/heroes — List heroes (paginated, filterable). No token, no signup:

curl -i https://funapi.dev/api/superheroes/v1/heroes

answers 200 OK with:

{
"page": 1,
"pageSize": 4,
"total": 8,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Captain Volt",
"alias": "Deniz Aksoy",
"power": "electricity",
"team": "Alpha Squad",
"nemesisId": 5,
"_v": 1
},
{
"id": 2,
"name": "Night Owl",
"alias": "Sam Reyes",
"power": "night vision",
"team": "Alpha Squad",
"nemesisId": 6,
"_v": 1
},
{
"id": 3,
"name": "Aqua Comet",
"alias": "Mira Chen",
"power": "hydrokinesis",
"team": "Freelance",
"nemesisId": null,
"_v": 1
},
{
"id": 4,
"name": "Turbo Tortoise",
"alias": "unknown",
"power": "super speed (eventually)",
"team": "Freelance",
"nemesisId": 7,
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Fetch a hero, then its powers sub-collection, and check what happens when the parent id is valid but the child id is not.
- Delete a hero that still has powers attached and see how the API handles the orphaned children.
- Use If-Match with a stale ETag on an update and confirm the 412 before your real client meets one.
- Call a write endpoint with qa-viewer-token to see the 403 that separates read-only from admin credentials.

heroes
capes, powers and their sworn enemies
GET /superheroes/v1/heroes — List heroes (paginated, filterable) · Responds with 200 400 404 Link to this endpoint
GET /superheroes/v1/heroes/{id} — Get one hero · Responds with 200 404 Link to this endpoint
GET /superheroes/v1/heroes/{id}/nemesis — Get a hero's nemesis (nested resource) · Responds with 200 404 Link to this endpoint
POST /superheroes/v1/heroes — Register a new hero (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
DELETE /superheroes/v1/heroes/{id} — Retire a hero (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint
POST /superheroes/v1/heroes/versus — Simulate a fight between two heroes (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint

Related APIs
- Dino Park API — Dinosaurs, enclosures & the occasional breach.
- Space Agency API — Launches, scrubs & probes with real signal lag.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/pizza
TITLE: Pizza Orders API — Mock REST API, 9 endpoints | Fun API
================================================================

Pizza Orders API — free mock REST API for testing

A tiny pizzeria backend: menu, order placement with validation, an order-status flow — and /oven/status, which always returns 500 for negative testing.

The Pizza Orders API is a small order-lifecycle service: a menu, orders that move through states, and an oven endpoint that fails on purpose. It is the page to open when you need a guaranteed, repeatable 500 — most sandboxes make server errors impossible to reproduce, which is exactly why retry logic and error handling so often ship untested.

Base URL: https://funapi.dev/api/pizza/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/pizza/v1/menu — Get the menu. No token, no signup:

curl -i https://funapi.dev/api/pizza/v1/menu

answers 200 OK with:

{
"total": 6,
"data": [
{
"id": 1,
"name": "Margherita",
"price": 9.5,
"vegetarian": true
},
{
"id": 2,
"name": "Pepperoni",
"price": 11,
"vegetarian": false
},
{
"id": 3,
"name": "Quattro Formaggi",
"price": 12.5,
"vegetarian": true
},
{
"id": 4,
"name": "Veggie Garden",
"price": 10.5,
"vegetarian": true
},
{
"id": 5,
"name": "BBQ Chicken",
"price": 12,
"vegetarian": false
},
{
"id": 6,
"name": "Hawaiian",
"price": 11,
"vegetarian": false,
"controversial": true
}
]
}

Open and run this endpoint

What you can practise here
- Call the oven endpoint for a reliable 500 and verify your client retries, backs off, or surfaces the error rather than hanging.
- Send a PUT to an endpoint that only accepts POST and read the 405 together with its Allow header.
- Cancel an order twice and use the 409 to check that your code treats conflict as a state problem, not a transport failure.
- Hit the deliberately slow endpoint to confirm your HTTP client timeout is actually configured and actually fires.

menu
six pizzas, one controversial
DELETE /pizza/v1/menu — Delete the menu — always 405, the menu is read-only · Responds with 405 Link to this endpoint
GET /pizza/v1/menu — Get the menu · Responds with 200 400 Link to this endpoint

orders
received → baking → out-for-delivery → delivered
POST /pizza/v1/orders — Place an order (validated) · Responds with 201 400 Link to this endpoint
GET /pizza/v1/orders/{id} — Track an order · Responds with 200 404 Link to this endpoint
PUT /pizza/v1/orders/{id}/status — Update order status (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
PATCH /pizza/v1/orders/{id} — Partially update an order (address or size) · Responds with 200 400 404 Link to this endpoint
DELETE /pizza/v1/orders/{id} — Cancel an order (409 if already delivered) · Responds with 204 404 409 Link to this endpoint

oven
do not trust the oven
GET /pizza/v1/oven/status — Always returns 500 — for negative tests · Responds with 500 Link to this endpoint
GET /pizza/v1/oven/preheat — Preheat the oven — always takes ~3s · Responds with 200 Link to this endpoint

Related APIs
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.
- Airline API — Flights, seat conflicts & overbooking drama.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/coffee
TITLE: Coffee Shop API — Mock REST API, 6 endpoints | Fun API
================================================================

Coffee Shop API — free mock REST API for testing

A café counter API: browse drinks, place orders — and GET /teapot, which proudly returns HTTP 418 "I'm a teapot".

The Coffee Shop API is the catalog's rate-limiting playground and the home of HTTP 418. Its rush endpoint enforces a real quota: exceed it and you get a 429 with Retry-After and the usual X-RateLimit headers, refreshed on a live window. Client-side throttling and backoff are almost impossible to test against a well-behaved API, and this one misbehaves on request.

Base URL: https://funapi.dev/api/coffee/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/coffee/v1/drinks — List drinks, filter by type. No token, no signup:

curl -i https://funapi.dev/api/coffee/v1/drinks

answers 200 OK with:

{
"total": 8,
"data": [
{
"id": 1,
"name": "Espresso",
"type": "hot",
"price": 2.5
},
{
"id": 2,
"name": "Latte",
"type": "hot",
"price": 4
},
{
"id": 3,
"name": "Cappuccino",
"type": "hot",
"price": 3.8
},
{
"id": 4,
"name": "Flat White",
"type": "hot",
"price": 4.2
},
{
"id": 5,
"name": "Cold Brew",
"type": "cold",
"price": 4.5
},
{
"id": 6,
"name": "Iced Matcha Latte",
"type": "cold",
"price": 4.8
},
{
"id": 7,
"name": "Mocha",
"type": "hot",
"price": 4.4
},
{
"id": 8,
"name": "Turkish Coffee",
"type": "hot",
"price": 3
}
]
}

Open and run this endpoint

What you can practise here
- Fire requests at the rush endpoint until it answers 429, then respect Retry-After and watch the window reopen.
- Read X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset on a successful call and build your throttle from them.
- Ask the teapot endpoint to brew coffee and collect the 418 your status-code assertion table is missing.
- Order a drink that is out of stock and separate the 409 from the 400 in your error handling.

drinks
hot and cold
GET /coffee/v1/drinks — List drinks, filter by type · Responds with 200 400 Link to this endpoint
GET /coffee/v1/drinks/{id} — Get one drink · Responds with 200 404 Link to this endpoint

orders
name on the cup
POST /coffee/v1/orders — Order a drink · Responds with 201 400 Link to this endpoint
PUT /coffee/v1/orders/{id}/ready — Mark an order ready (409 if already ready) · Responds with 200 404 409 412 Link to this endpoint

rush
hammer it and watch the 429s
GET /coffee/v1/rush-hour — Rush hour special — max 3 requests per 10s · Responds with 200 429 Link to this endpoint

teapot
RFC 2324 compliance
GET /coffee/v1/teapot — Try to brew coffee in a teapot · Responds with 418 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.
- Airline API — Flights, seat conflicts & overbooking drama.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/football
TITLE: Football API — Mock REST API, 7 endpoints | Fun API
================================================================

Football API — free mock REST API for testing

A fictional league: teams with nested player squads, a standings table, and a match simulator with input validation.

The Football API keeps league tables, squads and simulated match results — data that changes only when a match is played, which makes it the right place to practise HTTP caching. Standings respond with an ETag, and a conditional GET carrying If-None-Match answers 304 with no body at all.

Base URL: https://funapi.dev/api/football/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/football/v1/teams — List teams (paginated). No token, no signup:

curl -i https://funapi.dev/api/football/v1/teams

answers 200 OK with:

{
"page": 1,
"pageSize": 4,
"total": 6,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Atlas FC",
"city": "Istanbul",
"founded": 1962,
"_v": 1
},
{
"id": 2,
"name": "River Wolves",
"city": "Porto Verde",
"founded": 1948,
"_v": 1
},
{
"id": 3,
"name": "Port Albion",
"city": "Southbay",
"founded": 1931,
"_v": 1
},
{
"id": 4,
"name": "Falcon United",
"city": "Ankara",
"founded": 1975,
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- GET the standings, keep the ETag, and repeat the request with If-None-Match for a 304 with an empty body.
- Simulate a match, then confirm the standings ETag changed and your cached copy is correctly invalidated.
- Delete a team without a token and with a viewer token, and compare the 401 against the 403.
- Register the same fixture twice and handle the 409 as a duplicate rather than a retryable failure.

teams
six fictional clubs
GET /football/v1/teams — List teams (paginated) · Responds with 200 400 404 Link to this endpoint
GET /football/v1/teams/{id} — Get one team · Responds with 200 404 Link to this endpoint
GET /football/v1/teams/{id}/players — Get a team's squad (nested) · Responds with 200 404 Link to this endpoint
GET /football/v1/teams/{id}/matches — Get a team's match history (nested resource) · Responds with 200 404 Link to this endpoint
DELETE /football/v1/teams/{id} — Remove a team (409 if it has played matches) (requires Bearer auth) · Responds with 204 401 403 404 409 412 Link to this endpoint

league
standings and matches
GET /football/v1/standings — League table — cacheable (ETag / If-None-Match / 304) · Responds with 200 304 Link to this endpoint
POST /football/v1/matches — Simulate a match (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.
- Airline API — Flights, seat conflicts & overbooking drama.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/movies
TITLE: Movies API — Mock REST API, 9 endpoints | Fun API Playground
================================================================

Movies API — free mock REST API for testing

A catalog of entirely fictional QA-themed films. Practice multi-parameter filtering, sorting, range validation on ratings, and role-based deletes.

The Movies API is a QA-themed catalog you can sort, filter and rate — and the only one with a file-upload endpoint that enforces limits. Posters have a maximum size and an allowed content type, so this is where 413 Payload Too Large and 415 Unsupported Media Type stop being theory.

Base URL: https://funapi.dev/api/movies/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/movies/v1/movies — List movies (filter, sort, paginate). No token, no signup:

curl -i https://funapi.dev/api/movies/v1/movies

answers 200 OK with:

{
"page": 1,
"pageSize": 5,
"total": 10,
"totalPages": 2,
"data": [
{
"id": 1,
"title": "Midnight Debugger",
"genre": "thriller",
"year": 2019,
"rating": 7.8,
"_v": 1
},
{
"id": 2,
"title": "The 404 Identity",
"genre": "thriller",
"year": 2021,
"rating": 8.1,
"_v": 1
},
{
"id": 3,
"title": "Gone in 60 Milliseconds",
"genre": "action",
"year": 2020,
"rating": 6.9,
"_v": 1
},
{
"id": 4,
"title": "The Curious Case of the Missing Semicolon",
"genre": "comedy",
"year": 2018,
"rating": 7.2,
"_v": 1
},
{
"id": 5,
"title": "Null Pointer in Manhattan",
"genre": "drama",
"year": 2022,
"rating": 7.5,
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Upload a poster over the size limit for a 413, then one with the wrong Content-Type for a 415.
- Combine sort and filter query parameters and check the ordering your client assumes is actually the one returned.
- Rate a film outside the valid range and read the validation error the API sends back.
- Update a movie with a stale ETag to trigger the 412 optimistic-concurrency path.

movies
now showing: Edge Case (2024)
GET /movies/v1/movies — List movies (filter, sort, paginate) · Responds with 200 400 404 Link to this endpoint
GET /movies/v1/movies/{id} — Get one movie · Responds with 200 404 Link to this endpoint
GET /movies/v1/search — Full-text search movie titles · Responds with 200 Link to this endpoint
GET /movies/v1/search/fuzzy — Typo-tolerant search (fuzzy match, "did you mean") · Responds with 200 400 Link to this endpoint
POST /movies/v1/movies — Add a movie (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /movies/v1/movies/{id}/rating — Rate a movie (0–10 inclusive) (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /movies/v1/movies/{id} — Remove a movie (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint
GET /movies/v1/movies/{id}/similar — Get movies with the same genre (recommendation) · Responds with 200 404 Link to this endpoint

uploads
simulated multipart file uploads
POST /movies/v1/movies/{id}/poster — Upload a movie poster (simulated multipart file upload) (requires Bearer auth) · Responds with 201 400 401 404 413 415 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.
- Sherlock Holmes API — Cases, suspects & clues from Baker Street.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/wizarding
TITLE: Harry Potter API — Mock REST API, 10 endpoints | Fun API
================================================================

Harry Potter API — free mock REST API for testing

Houses, students and spells from a fictional wizarding school. Practice CRUD, Bearer auth, nested filtering by house, pagination and optimistic concurrency.

The Harry Potter API models a magic school: four houses with point totals, students sorted into them, and a spell book. Points move between houses, which makes it a natural fit for practising the read-modify-write cycle — and for seeing what happens when two clients try it at the same time.

Base URL: https://funapi.dev/api/wizarding/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/wizarding/v1/houses — List all houses. No token, no signup:

curl -i https://funapi.dev/api/wizarding/v1/houses

answers 200 OK with:

{
"total": 4,
"data": [
{
"id": 1,
"name": "Gryffindor",
"founder": "Godric Gryffindor",
"traits": [
"courage",
"bravery",
"daring"
],
"element": "fire",
"points": 472
},
{
"id": 2,
"name": "Slytherin",
"founder": "Salazar Slytherin",
"traits": [
"ambition",
"cunning",
"resourcefulness"
],
"element": "water",
"points": 452
},
{
"id": 3,
"name": "Hufflepuff",
"founder": "Helga Hufflepuff",
"traits": [
"patience",
"loyalty",
"fairness"
],
"element": "earth",
"points": 428
},
{
"id": 4,
"name": "Ravenclaw",
"founder": "Rowena Ravenclaw",
"traits": [
"wisdom",
"wit",
"creativity"
],
"element": "air",
"points": 461
}
]
}

Open and run this endpoint

What you can practise here
- Award house points from two concurrent requests and use If-Match to make one of them lose with a 412.
- Sort a student into a house that does not exist and read the 404 rather than a silent success.
- Page through the spell list and confirm your client handles the final, partially-full page correctly.
- Try a protected write with no Authorization header at all to see the bare 401.

houses
four houses, four elements
GET /wizarding/v1/houses — List all houses · Responds with 200 Link to this endpoint
GET /wizarding/v1/houses/{id} — Get one house · Responds with 200 404 Link to this endpoint
POST /wizarding/v1/sorting-hat — The Sorting Hat assigns you a house (stateless, random) · Responds with 200 Link to this endpoint

students
sorted, patronus and all
GET /wizarding/v1/students — List students (paginated, filter by house) · Responds with 200 400 404 Link to this endpoint
GET /wizarding/v1/students/{id} — Get one student · Responds with 200 404 Link to this endpoint
POST /wizarding/v1/students — Enroll a student (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /wizarding/v1/students/{id} — Update a student (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /wizarding/v1/students/{id} — Expel a student (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

spells
charms, jinxes, and one unforgivable
GET /wizarding/v1/spells — List spells, filter by type · Responds with 200 Link to this endpoint
GET /wizarding/v1/spells/random — A random spell · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Star Wars API — Characters, planets & starships from a galaxy far away.
- Sherlock Holmes API — Cases, suspects & clues from Baker Street.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/galaxy
TITLE: Star Wars API — Mock REST API, 11 endpoints | Fun API
================================================================

Star Wars API — free mock REST API for testing

Characters, homeworlds and starships from a fictional space opera. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency.

The Star Wars API covers characters, planets and starships — three related collections with enough cross-references to make filtering interesting. It is a good first stop for anyone building a client that has to resolve ids across resources and page through more records than fit in a single response.

Base URL: https://funapi.dev/api/galaxy/v1 · 11 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/galaxy/v1/planets — List all planets. No token, no signup:

curl -i https://funapi.dev/api/galaxy/v1/planets

answers 200 OK with:

{
"total": 5,
"data": [
{
"id": 1,
"name": "Tatooine",
"climate": "arid",
"population": 200000
},
{
"id": 2,
"name": "Hoth",
"climate": "frozen",
"population": 0
},
{
"id": 3,
"name": "Dagobah",
"climate": "murky",
"population": 0
},
{
"id": 4,
"name": "Coruscant",
"climate": "temperate",
"population": 1000000000
},
{
"id": 5,
"name": "Endor",
"climate": "temperate",
"population": 30000000
}
]
}

Open and run this endpoint

What you can practise here
- Filter characters by their home planet and check the empty-result case returns 200 with an empty list, not a 404.
- Walk every page of the starship collection and assert the total count matches what you actually collected.
- Create a starship, update it with the wrong ETag for a 412, then retry with the current one.
- Delete with a viewer token to see the 403 that read-only credentials produce.

planets
five worlds, one swamp
GET /galaxy/v1/planets — List all planets · Responds with 200 Link to this endpoint
GET /galaxy/v1/planets/{id} — Get one planet · Responds with 200 404 Link to this endpoint

characters
rebels, empire, and neutral parties
GET /galaxy/v1/characters — List characters (paginated, filter by affiliation) · Responds with 200 400 404 Link to this endpoint
GET /galaxy/v1/characters/{id} — Get one character · Responds with 200 404 Link to this endpoint
GET /galaxy/v1/characters/{id}/homeworld — Get a character's homeworld (nested resource) · Responds with 200 404 Link to this endpoint
POST /galaxy/v1/characters — Add a character (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /galaxy/v1/characters/{id} — Update a character (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /galaxy/v1/characters/{id} — Remove a character (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

starships
freighters to capital ships
GET /galaxy/v1/starships — List starships, filter by class · Responds with 200 Link to this endpoint
GET /galaxy/v1/starships/random — A random starship · Responds with 200 Link to this endpoint
GET /galaxy/v1/starships/{id} — Get one starship · Responds with 200 404 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Sherlock Holmes API — Cases, suspects & clues from Baker Street.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/holmes
TITLE: Sherlock Holmes API — Mock REST API, 10 endpoints | Fun API
================================================================

Sherlock Holmes API — free mock REST API for testing

Cases, suspects and clues from a fictional Victorian detective agency. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency.

The Sherlock Holmes API is a case file: investigations with suspects and clues, and cases that move from open to solved. It is the catalog's PATCH endpoint — partial updates rather than whole-object PUTs — which is where most clients quietly send the wrong thing and never find out.

Base URL: https://funapi.dev/api/holmes/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/holmes/v1/cases — List all cases. No token, no signup:

curl -i https://funapi.dev/api/holmes/v1/cases

answers 200 OK with:

{
"total": 5,
"data": [
{
"id": 1,
"title": "The Vanishing Violin",
"status": "solved",
"year": 1889
},
{
"id": 2,
"title": "The Crimson Cipher",
"status": "solved",
"year": 1891
},
{
"id": 3,
"title": "The Baker Street Burglary",
"status": "open",
"year": 1894
},
{
"id": 4,
"title": "The Midnight Telegram",
"status": "solved",
"year": 1896
},
{
"id": 5,
"title": "The Fogbound Heir",
"status": "open",
"year": 1899
}
]
}

Open and run this endpoint

What you can practise here
- PATCH a single field on a case and confirm the untouched fields survive, which a careless PUT would have wiped.
- Close a case that is already closed and read the 409 rather than assuming the operation is idempotent.
- Add a clue to a case that does not exist and check the 404 comes from the parent, not the child.
- Attach a suspect twice and see how the API reports the duplicate.

cases
five cases, two still open
GET /holmes/v1/cases — List all cases · Responds with 200 400 Link to this endpoint
GET /holmes/v1/cases/{id} — Get one case · Responds with 200 404 Link to this endpoint
GET /holmes/v1/cases/{id}/suspects — Get all suspects for a case (nested resource) · Responds with 200 404 Link to this endpoint
PATCH /holmes/v1/cases/{id} — Update a case status (409 if unchanged) (requires Bearer auth) · Responds with 200 400 401 404 409 Link to this endpoint

suspects
alibis included, guilt undisclosed
GET /holmes/v1/suspects/{id} — Get one suspect · Responds with 200 404 Link to this endpoint
POST /holmes/v1/suspects — Add a suspect to a case (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /holmes/v1/suspects/{id} — Update a suspect (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /holmes/v1/suspects/{id} — Clear a suspect (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

clues
physical, document, and testimony
GET /holmes/v1/clues — List clues, filter by case or type · Responds with 200 Link to this endpoint
GET /holmes/v1/clues/random — A random clue · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/pokemon
TITLE: Pokémon API — Mock REST API, 10 endpoints | Fun API
================================================================

Pokémon API — free mock REST API for testing

Creatures, trainers and a battle simulator. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency.

The Pokémon API holds creatures, trainers and a battle endpoint that resolves a fight from the two teams you send it. The battle result is computed, not stored, which makes it the catalog's clearest example of a POST that is neither a create nor idempotent — and a good target for contract tests over a non-trivial response shape.

Base URL: https://funapi.dev/api/pokemon/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/pokemon/v1/pokemon — List Pokémon (paginated, filter by type). No token, no signup:

curl -i https://funapi.dev/api/pokemon/v1/pokemon

answers 200 OK with:

{
"page": 1,
"pageSize": 4,
"total": 8,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Pikachu",
"type": "electric",
"level": 12,
"hp": 60,
"_v": 1
},
{
"id": 2,
"name": "Bulbasaur",
"type": "grass",
"level": 10,
"hp": 65,
"_v": 1
},
{
"id": 3,
"name": "Charmander",
"type": "fire",
"level": 11,
"hp": 58,
"_v": 1
},
{
"id": 4,
"name": "Squirtle",
"type": "water",
"level": 10,
"hp": 63,
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Run a battle twice with the same teams and decide whether your test asserts on the outcome or only on the response shape.
- Filter creatures by type and confirm your client handles a type with no members.
- Register a trainer, then create one with a name already taken, and read the conflict.
- Page through the creature list and check the pagination metadata against the number of records you received.

pokemon
eight starters and friends
GET /pokemon/v1/pokemon — List Pokémon (paginated, filter by type) · Responds with 200 400 404 Link to this endpoint
GET /pokemon/v1/pokemon/{id} — Get one Pokémon · Responds with 200 404 Link to this endpoint
GET /pokemon/v1/pokemon/random — A random Pokémon (wild encounter) · Responds with 200 Link to this endpoint
POST /pokemon/v1/pokemon — Catch a new Pokémon (create) (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /pokemon/v1/pokemon/{id} — Update a Pokémon (level up, heal, etc.) (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /pokemon/v1/pokemon/{id} — Release a Pokémon (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

trainers
three trainers, their rosters
GET /pokemon/v1/trainers — List all trainers · Responds with 200 Link to this endpoint
GET /pokemon/v1/trainers/{id}/pokemon — Get a trainer's roster (nested resource) · Responds with 200 404 Link to this endpoint

battles
simulate a fight, get a random winner
POST /pokemon/v1/battles — Simulate a battle between two Pokémon (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
GET /pokemon/v1/battles — List battle history (empty until you POST one) · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/middleearth
TITLE: Middle-earth API — Mock REST API, 9 endpoints | Fun API
================================================================

Middle-earth API — free mock REST API for testing

Fellowship members, quests and artifacts from a fictional fantasy epic. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency.

The Middle-earth API tracks a fellowship, the quests it is assigned and the artifacts it carries. Members join and leave quests, so it is built around association endpoints — the join-table operations that are easy to write and easy to get wrong when the same member is added twice or removed from a quest they were never on.

Base URL: https://funapi.dev/api/middleearth/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/middleearth/v1/fellowship — List fellowship members (paginated, filter by race). No token, no signup:

curl -i https://funapi.dev/api/middleearth/v1/fellowship

answers 200 OK with:

{
"page": 1,
"pageSize": 3,
"total": 6,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Aldric Underhill",
"race": "hobbit",
"skill": "stealth",
"_v": 1
},
{
"id": 2,
"name": "Thoren Oakenshield II",
"race": "dwarf",
"skill": "axework",
"_v": 1
},
{
"id": 3,
"name": "Elarion Swiftarrow",
"race": "elf",
"skill": "archery",
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Assign the same member to a quest twice and check whether the second call is a conflict or a no-op.
- Remove a member from a quest they never joined and read the status the API chose.
- Update a quest with If-Match after someone else has changed it, for a 412.
- List artifacts filtered by bearer and handle the empty result as success.

fellowship
six companions, six races
GET /middleearth/v1/fellowship — List fellowship members (paginated, filter by race) · Responds with 200 400 404 Link to this endpoint
GET /middleearth/v1/fellowship/{id} — Get one fellowship member · Responds with 200 404 Link to this endpoint
GET /middleearth/v1/fellowship/{id}/artifact — Get the artifact carried by a member (nested resource) · Responds with 200 404 Link to this endpoint
POST /middleearth/v1/fellowship — Recruit a new member (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /middleearth/v1/fellowship/{id} — Update a fellowship member (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /middleearth/v1/fellowship/{id} — Remove a member from the fellowship (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

quests
one ring, several detours
GET /middleearth/v1/quests — List quests, filter by status · Responds with 200 400 Link to this endpoint
GET /middleearth/v1/quests/random — A random quest · Responds with 200 Link to this endpoint

artifacts
each bound to a bearer
GET /middleearth/v1/artifacts — List all artifacts · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/auth
TITLE: Auth Playground API — Mock REST API, 6 endpoints | Fun API
================================================================

Auth Playground API — free mock REST API for testing

A simulated OAuth 2.0 authorization server. Practice the client-credentials and authorization-code grants, token expiry, refresh tokens, and the standard invalid_client / invalid_grant error shapes — independent of the qa-admin-token / qa-viewer-token used elsewhere on this site. The "real tokens" tag issues a working token from /login (or /firebase-token) that unlocks every 🔒 endpoint across this playground.

The Auth Playground issues real, verifiable tokens over genuine OAuth 2.0 flows — client credentials and authorization code, plus refresh and deliberate expiry. Nothing here is a stub: the tokens are signed, they expire on schedule, and an expired one is rejected. It is the page for testing what your client does when a token dies mid-session, which is the failure most integrations never rehearse.

Base URL: https://funapi.dev/api/auth/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/auth/v1/oauth/protected-resource — A resource protected by a token from this flow (not the site-wide Authorize button). No token, no signup:

curl -i https://funapi.dev/api/auth/v1/oauth/protected-resource

answers 401 Unauthorized with:

{
"error": "invalid_token",
"message": "Missing or malformed Authorization header. Expected \"Bearer <access_token>\"."
}

Open and run this endpoint

What you can practise here
- Complete the client-credentials flow, then call a protected endpoint with the token you were issued.
- Wait for a short-lived token to expire and confirm your client refreshes instead of failing the user's request.
- Exchange a refresh token, then try to reuse the old one and read the rejection.
- Send a structurally valid but wrongly-signed token and check it is refused as firmly as a missing one.

oauth
client demo-client / secret demo-secret
POST /auth/v1/oauth/authorize — Step 1: request an authorization code · Responds with 200 400 Link to this endpoint
POST /auth/v1/oauth/token — Step 2: exchange for a token (client_credentials / authorization_code / refresh_token) · Responds with 200 400 Link to this endpoint
GET /auth/v1/oauth/protected-resource — A resource protected by a token from this flow (not the site-wide Authorize button) · Responds with 200 401 Link to this endpoint

real tokens
log in for a token that works on the 🔒 endpoints site-wide
POST /auth/v1/login — Log in as a demo user and get a working token (roles: admin / viewer) · Responds with 200 400 401 Link to this endpoint
POST /auth/v1/firebase-token — Mint a simulated Firebase-style token whose role claim grants admin or viewer · Responds with 200 400 Link to this endpoint
GET /auth/v1/me — Inspect the token you are sending (role, kind, subject) (requires Bearer auth) · Responds with 200 401 Link to this endpoint

Related APIs
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Object Storage API — Objects, checksums, ranges & resumable uploads.
- Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/webhooks
TITLE: Webhooks API — Mock REST API, 7 endpoints | Fun API
================================================================

Webhooks API — free mock REST API for testing

A simulated webhook dispatcher. Register a subscription, trigger an event, and inspect delivery attempts (~70% simulated success rate), retries, and payload-signature verification. Signatures here are a simplified simulated scheme for testing your verification logic — not real HMAC-SHA256.

The Webhooks API is the receiving end of the problem: register a callback URL, trigger an event, then inspect exactly what was delivered and replay it. Deliveries are signed with an HMAC, so you can practise verifying a signature — including the constant-time comparison and the replay window that separate a real verifier from a string equality check.

Base URL: https://funapi.dev/api/webhooks/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

What you can practise here
- Register a subscription, trigger an event, and verify the HMAC signature on the delivery against the shared secret.
- Replay a stored delivery and confirm your receiver is idempotent rather than double-processing it.
- Tamper with one byte of a delivery body and check that signature verification fails.
- Inspect the delivery log to see what your endpoint actually received, headers included.

subscriptions
who gets notified, and for what
POST /webhooks/v1/subscriptions — Register a webhook subscription (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
GET /webhooks/v1/subscriptions — List webhook subscriptions (secrets redacted) (requires Bearer auth) · Responds with 200 Link to this endpoint
DELETE /webhooks/v1/subscriptions/{id} — Unsubscribe (requires Bearer auth) · Responds with 204 401 403 404 Link to this endpoint

deliveries
attempts, replays, and signature checks
POST /webhooks/v1/trigger — Fire an event to all matching subscriptions (~70% simulated success) (requires Bearer auth) · Responds with 200 201 400 Link to this endpoint
GET /webhooks/v1/deliveries — List delivery attempts, filter by status or subscription (requires Bearer auth) · Responds with 200 400 Link to this endpoint
POST /webhooks/v1/deliveries/{id}/replay — Replay a delivery attempt (409 after 3 attempts) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint
POST /webhooks/v1/verify-signature — Verify a payload signature (simulated scheme, not real HMAC) · Responds with 200 400 Link to this endpoint

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Object Storage API — Objects, checksums, ranges & resumable uploads.
- Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/theoffice
TITLE: The Office API — Mock REST API, 8 endpoints | Fun API
================================================================

The Office API — free mock REST API for testing

Employees, office pranks and quotes from a fictional paper company mockumentary. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency.

The Office API covers a paper company: employees, the pranks played on them and a quote collection. It is one of the gentler CRUD surfaces in the catalog and a reasonable first target when you are teaching someone the request/response loop before introducing auth, concurrency or error injection.

Base URL: https://funapi.dev/api/office/v1 · 8 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/office/v1/employees — List employees (paginated, filter by department). No token, no signup:

curl -i https://funapi.dev/api/office/v1/employees

answers 200 OK with:

{
"page": 1,
"pageSize": 4,
"total": 8,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Michael Scott",
"role": "Regional Manager",
"department": "Management",
"deskNumber": 1,
"_v": 1
},
{
"id": 2,
"name": "Dwight Schrute",
"role": "Assistant to the Regional Manager",
"department": "Sales",
"deskNumber": 2,
"_v": 1
},
{
"id": 3,
"name": "Jim Halpert",
"role": "Sales Representative",
"department": "Sales",
"deskNumber": 3,
"_v": 1
},
{
"id": 4,
"name": "Pam Beesly",
"role": "Receptionist",
"department": "Reception",
"deskNumber": 4,
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Create, read, update and delete an employee end to end, watching the status code change at each step.
- Repeat the delete and see the 404 that tells you the resource is already gone.
- Filter pranks by target and confirm an unmatched filter is an empty 200, not an error.
- Attempt a write without a token to meet the 401 before you meet it in production.

employees
eight desks, one regional manager
GET /office/v1/employees — List employees (paginated, filter by department) · Responds with 200 400 404 Link to this endpoint
GET /office/v1/employees/{id} — Get one employee · Responds with 200 404 Link to this endpoint
GET /office/v1/employees/{id}/pranks — Get pranks involving an employee (nested resource) · Responds with 200 404 Link to this endpoint
POST /office/v1/employees — Hire a new employee (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /office/v1/employees/{id} — Update an employee (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /office/v1/employees/{id} — Fire an employee (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

pranks
mostly aimed at one assistant (to the) regional manager
GET /office/v1/pranks — List pranks, filter by severity · Responds with 200 400 Link to this endpoint

quotes
that's what she said
GET /office/v1/quotes/random — A random quote · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/dinopark
TITLE: Dino Park API — Mock REST API, 9 endpoints | Fun API
================================================================

Dino Park API — free mock REST API for testing

A fictional dinosaur park: creatures, enclosure capacity, and a breach simulator. Practice CRUD, Bearer auth, nested resources, capacity conflicts (409), pagination and optimistic concurrency.

The Dino Park API runs a park: dinosaurs, the enclosures holding them, and an incident log for when those two facts stop agreeing. Enclosures have capacity and species compatibility rules, so writes are validated against the current state rather than accepted blindly — which makes it a good target for testing business-rule failures rather than schema failures.

Base URL: https://funapi.dev/api/dinopark/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/dinopark/v1/dinosaurs — List dinosaurs (paginated, filter by diet). No token, no signup:

curl -i https://funapi.dev/api/dinopark/v1/dinosaurs

answers 200 OK with:

{
"page": 1,
"pageSize": 4,
"total": 7,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Rexy",
"species": "Tyrannosaurus rex",
"diet": "carnivore",
"enclosureId": 1,
"dangerLevel": "extreme",
"_v": 1
},
{
"id": 2,
"name": "Blue",
"species": "Velociraptor",
"diet": "carnivore",
"enclosureId": 1,
"dangerLevel": "high",
"_v": 1
},
{
"id": 3,
"name": "Big Eatie",
"species": "Brachiosaurus",
"diet": "herbivore",
"enclosureId": 2,
"dangerLevel": "low",
"_v": 1
},
{
"id": 4,
"name": "Bumpy",
"species": "Ankylosaurus",
"diet": "herbivore",
"enclosureId": 2,
"dangerLevel": "low",
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Move a dinosaur into a full enclosure and read the conflict the capacity rule produces.
- Put incompatible species together and check the error explains which rule was broken.
- File an incident against an enclosure that does not exist and confirm the 404.
- Update an enclosure with a stale ETag for the 412 concurrency path.

dinosaurs
seven residents, one very hungry rex
GET /dinopark/v1/dinosaurs — List dinosaurs (paginated, filter by diet) · Responds with 200 400 404 Link to this endpoint
GET /dinopark/v1/dinosaurs/{id} — Get one dinosaur · Responds with 200 404 Link to this endpoint
GET /dinopark/v1/dinosaurs/{id}/enclosure — Get a dinosaur's enclosure (nested resource) · Responds with 200 404 Link to this endpoint
POST /dinopark/v1/dinosaurs — Add a dinosaur (409 if enclosure is at capacity) (requires Bearer auth) · Responds with 201 400 401 409 Link to this endpoint
PUT /dinopark/v1/dinosaurs/{id} — Update a dinosaur (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /dinopark/v1/dinosaurs/{id} — Relocate a dinosaur off-site (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

enclosures
capacity matters
GET /dinopark/v1/enclosures — List all enclosures with current occupancy · Responds with 200 Link to this endpoint

incidents
breach reports, growing list
POST /dinopark/v1/incidents/breach — Simulate a containment breach (random dinosaur & severity) (requires Bearer auth) · Responds with 201 401 Link to this endpoint
GET /dinopark/v1/incidents — List incident history (empty until you POST a breach) · Responds with 200 Link to this endpoint

Related APIs
- Superhero API — Heroes, powers & nemeses. Great for nested resources.
- Space Agency API — Launches, scrubs & probes with real signal lag.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/marvel
TITLE: Marvel API — Mock REST API, 10 endpoints | Fun API
================================================================

Marvel API — free mock REST API for testing

Marvel heroes, villains and mission assignments. Practice CRUD, Bearer auth, nested resources, pagination, and state-transition conflicts (409).

The Marvel API assigns heroes and villains to missions, which makes it a three-way relationship rather than a simple parent-child tree. Missions have states and rosters, so it is well suited to testing a client that has to keep several related collections consistent as it writes.

Base URL: https://funapi.dev/api/marvel/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/marvel/v1/heroes — List heroes (paginated, filter by team). No token, no signup:

curl -i https://funapi.dev/api/marvel/v1/heroes

answers 200 OK with:

{
"page": 1,
"pageSize": 4,
"total": 6,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Iron Man",
"codename": "Tony Stark",
"power": "powered armor",
"team": "Avengers",
"_v": 1
},
{
"id": 2,
"name": "Spider-Man",
"codename": "Peter Parker",
"power": "wall-crawling & webs",
"team": "Avengers",
"_v": 1
},
{
"id": 3,
"name": "Thor",
"codename": "Thor Odinson",
"power": "storm control",
"team": "Avengers",
"_v": 1
},
{
"id": 4,
"name": "Hulk",
"codename": "Bruce Banner",
"power": "rage-fueled strength",
"team": "Avengers",
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Assign a hero already committed to another mission and read the conflict.
- Advance a mission through its states and try an illegal transition.
- Filter by affiliation and confirm the empty case is handled as success.
- Delete a mission with a viewer token to see the 403.

heroes
six Avengers across two teams
GET /marvel/v1/heroes — List heroes (paginated, filter by team) · Responds with 200 400 404 Link to this endpoint
GET /marvel/v1/heroes/{id} — Get one hero · Responds with 200 404 Link to this endpoint
GET /marvel/v1/heroes/{id}/missions — Get a hero's assigned missions (nested resource) · Responds with 200 404 Link to this endpoint
POST /marvel/v1/heroes — Recruit a new hero (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /marvel/v1/heroes/{id} — Update a hero (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /marvel/v1/heroes/{id} — Retire a hero (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

villains
threat levels, some defeated
GET /marvel/v1/villains — List villains, filter by threat level · Responds with 200 400 Link to this endpoint

missions
assign heroes, then complete them
POST /marvel/v1/missions — Assign heroes to a new mission (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
GET /marvel/v1/missions/{id} — Get one mission · Responds with 200 404 Link to this endpoint
POST /marvel/v1/missions/{id}/complete — Mark a mission complete (409 if already complete) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/got
TITLE: Game of Thrones API — Mock REST API, 12 endpoints | Fun API
================================================================

Game of Thrones API — free mock REST API for testing

Great houses of Westeros, their nobles, and the dragons of House Targaryen. Practice CRUD, Bearer auth, nested resources, pagination, and a thematic 409 conflict.

The Game of Thrones API is one of the larger surfaces here: houses, nobles, dragons, battles and quotes, with allegiances tying them together. Battles change house standing, so reads taken before a write go stale — making it a practical place to test cache invalidation and optimistic concurrency on something bigger than a two-field record.

Base URL: https://funapi.dev/api/got/v1 · 12 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/got/v1/houses — List all houses. No token, no signup:

curl -i https://funapi.dev/api/got/v1/houses

answers 200 OK with:

{
"total": 4,
"data": [
{
"id": 1,
"name": "House Stark",
"seat": "Winterfell",
"words": "Winter Is Coming",
"sigil": "a grey direwolf on white"
},
{
"id": 2,
"name": "House Targaryen",
"seat": "Dragonstone",
"words": "Fire and Blood",
"sigil": "a red three-headed dragon on black"
},
{
"id": 3,
"name": "House Lannister",
"seat": "Casterly Rock",
"words": "Hear Me Roar",
"sigil": "a golden lion on crimson"
},
{
"id": 4,
"name": "House Greyjoy",
"seat": "Pyke",
"words": "We Do Not Sow",
"sigil": "a golden kraken on black"
}
]
}

Open and run this endpoint

What you can practise here
- Fight a battle, then confirm the affected houses' representations changed and your cached copies are invalid.
- Update a house with an If-Match header taken before the battle, for a 412.
- Swear a noble to a house that does not exist and read the 404.
- Page through nobles filtered by house and check the counts add up to the unfiltered total.

houses
four great houses
GET /got/v1/houses — List all houses · Responds with 200 Link to this endpoint
GET /got/v1/houses/{id} — Get one house · Responds with 200 404 Link to this endpoint
GET /got/v1/houses/{id}/nobles — Get all nobles of a house (nested resource) · Responds with 200 404 Link to this endpoint

nobles
not all of them survive
GET /got/v1/nobles/{id} — Get one noble · Responds with 200 404 Link to this endpoint
POST /got/v1/nobles — Add a noble to a house (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /got/v1/nobles/{id} — Update a noble (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
POST /got/v1/nobles/{id}/kill — Kill off a noble (409 if already dead) (requires Bearer auth) · Responds with 200 401 403 404 409 Link to this endpoint

dragons
two are still unclaimed
GET /got/v1/dragons — List dragons, filter by size · Responds with 200 400 Link to this endpoint
GET /got/v1/dragons/random — A random dragon · Responds with 200 Link to this endpoint

battles
Westeros conflict simulator
POST /got/v1/battles — Simulate a battle between two houses (requires Bearer auth) · Responds with 201 400 409 Link to this endpoint
GET /got/v1/battles/{id} — Get a battle result · Responds with 200 404 Link to this endpoint

quotes
memorable lines
GET /got/v1/quotes/random — Get a random Westeros quote · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/rickandmorty
TITLE: Rick and Morty API — Mock REST API, 9 endpoints | Fun API
================================================================

Rick and Morty API — free mock REST API for testing

Characters, locations and episodes from the animated sci-fi sitcom. Practice CRUD, Bearer auth, nested resources, pagination and optimistic concurrency.

The Rick and Morty API spans characters, locations and episodes across a multiverse, with characters appearing in many episodes. The many-to-many shape is the point: it is the catalog's best target for testing a client that has to de-duplicate records arriving from more than one relationship at once.

Base URL: https://funapi.dev/api/rickandmorty/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/rickandmorty/v1/characters — List characters (paginated, filter by status). No token, no signup:

curl -i https://funapi.dev/api/rickandmorty/v1/characters

answers 200 OK with:

{
"page": 1,
"pageSize": 4,
"total": 8,
"totalPages": 2,
"data": [
{
"id": 1,
"name": "Rick Sanchez",
"species": "Human",
"status": "Alive",
"locationId": 1,
"_v": 1
},
{
"id": 2,
"name": "Morty Smith",
"species": "Human",
"status": "Alive",
"locationId": 1,
"_v": 1
},
{
"id": 3,
"name": "Summer Smith",
"species": "Human",
"status": "Alive",
"locationId": 1,
"_v": 1
},
{
"id": 4,
"name": "Beth Smith",
"species": "Human",
"status": "Alive",
"locationId": 1,
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- List a character's episodes and an episode's characters, and confirm both sides agree.
- Page through characters filtered by location and de-duplicate across pages.
- Create a character in a location that does not exist and read the validation failure.
- Update with a stale ETag to see the 412.

characters
eight characters, one dead
GET /rickandmorty/v1/characters — List characters (paginated, filter by status) · Responds with 200 400 404 Link to this endpoint
GET /rickandmorty/v1/characters/{id} — Get one character · Responds with 200 404 Link to this endpoint
GET /rickandmorty/v1/characters/{id}/location — Get a character's current location (nested resource) · Responds with 200 404 Link to this endpoint
POST /rickandmorty/v1/characters — Add a character (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
PUT /rickandmorty/v1/characters/{id} — Update a character (requires Bearer auth) · Responds with 200 400 401 404 412 Link to this endpoint
DELETE /rickandmorty/v1/characters/{id} — Remove a character (portal them out of existence) (requires Bearer auth) · Responds with 204 401 403 404 412 Link to this endpoint

locations
planets, stations, and a dimension
GET /rickandmorty/v1/locations — List locations, filter by dimension · Responds with 200 Link to this endpoint

episodes
five picks across seven seasons
GET /rickandmorty/v1/episodes — List episodes, filter by episode code · Responds with 200 Link to this endpoint
GET /rickandmorty/v1/episodes/random — A random episode · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/bank
TITLE: Bank API — Mock REST API, 9 endpoints | Fun API Playground
================================================================

Bank API — free mock REST API for testing

A tiny FinTech sandbox: list accounts, page through transactions with an opaque cursor, and move money with idempotent transfers. Insufficient funds return HTTP 402 Payment Required, frozen accounts 409, and bad amounts 422.

The Bank API is the strictest surface in the catalog and the one closest to a real payments integration: accounts, balances and transfers, with cursor-based pagination instead of page numbers. It is the home of 402 Payment Required and of 422 for a transfer that is well-formed but not permissible — the distinction between "I cannot parse this" and "I understood you and the answer is no".

Base URL: https://funapi.dev/api/bank/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/bank/v1/exchange-rates — Exchange rates (cacheable, ETag + If-None-Match → 304). No token, no signup:

curl -i https://funapi.dev/api/bank/v1/exchange-rates

answers 200 OK with:

{
"base": "USD",
"rates": {
"EUR": 0.91,
"GBP": 0.78,
"TRY": 41.2,
"JPY": 148.5,
"GALLEON": 0.02,
"CREDITS": 3800
},
"note": "Rates are frozen in time, like everything else in this sandbox."
}

Open and run this endpoint

What you can practise here
- Transfer more than an account holds and read the 402 rather than a generic 400.
- Send a syntactically valid transfer that breaks a business rule and compare the 422 with the 400.
- Walk the transaction history by cursor and confirm no record is skipped or repeated between pages.
- Replay a transfer with the same Idempotency-Key and check the money moves exactly once.

accounts
who owns the money
GET /bank/v1/accounts — List accounts (requires Bearer auth) · Responds with 200 401 Link to this endpoint
GET /bank/v1/accounts/{id} — Get one account (requires Bearer auth) · Responds with 200 401 404 Link to this endpoint
POST /bank/v1/accounts — Open a new account (requires Bearer auth) · Responds with 201 400 401 422 Link to this endpoint
POST /bank/v1/accounts/{id}/freeze — Freeze an account (admin only) (requires Bearer auth) · Responds with 200 401 403 404 409 Link to this endpoint
GET /bank/v1/exchange-rates — Exchange rates (cacheable, ETag + If-None-Match → 304) · Responds with 200 304 Link to this endpoint

transactions
cursor-based pagination
GET /bank/v1/accounts/{id}/transactions — List transactions (cursor pagination) (requires Bearer auth) · Responds with 200 400 401 404 Link to this endpoint

transfers
idempotent money movement
POST /bank/v1/transfers — Transfer money between accounts (requires Bearer auth) · Responds with 201 400 401 402 404 409 422 Link to this endpoint
GET /bank/v1/transfers/{id} — Look up a transfer (requires Bearer auth) · Responds with 200 401 404 Link to this endpoint

premium
pay up — 402 on demand
GET /bank/v1/premium/statements — Premium statements — always 402 · Responds with 402 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Airline API — Flights, seat conflicts & overbooking drama.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/airline
TITLE: Airline API — Mock REST API, 9 endpoints | Fun API
================================================================

Airline API — free mock REST API for testing

Book seats on four questionable flights. Practice 409 seat conflicts and overbooking, a booking state machine (confirmed → checked-in → cancelled), 410 Gone for cancelled bookings, If-Match concurrency and idempotent booking.

The Airline API sells seats, which means it is built to be contended: two bookings for the same seat conflict, and flights that have departed are gone rather than merely missing. It is the catalog's only source of 410 Gone, the status most clients treat as a 404 and should not.

Base URL: https://funapi.dev/api/airline/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/airline/v1/flights — List flights, filter by route. No token, no signup:

curl -i https://funapi.dev/api/airline/v1/flights

answers 200 OK with:

{
"total": 4,
"data": [
{
"id": "FN101",
"from": "NYC",
"to": "LON",
"departs": "08:30",
"gate": "A4",
"status": "scheduled",
"seatsTotal": 6,
"seatsFree": 5
},
{
"id": "FN202",
"from": "IST",
"to": "TYO",
"departs": "13:45",
"gate": "B2",
"status": "scheduled",
"seatsTotal": 4,
"seatsFree": 4
},
{
"id": "FN303",
"from": "SFO",
"to": "SYD",
"departs": "21:05",
"gate": "C1",
"status": "cancelled",
"seatsTotal": 4,
"seatsFree": 4
},
{
"id": "FN404",
"from": "AMS",
"to": "REK",
"departs": "06:15",
"gate": "D7",
"status": "boarding",
"seatsTotal": 2,
"seatsFree": 1
}
]
}

Open and run this endpoint

What you can practise here
- Book the same seat twice and use the 409 to drive your retry-with-a-different-seat path.
- Request a departed flight and handle the 410 differently from a 404 — one is permanent.
- Cancel a booking, then cancel it again, and check the second response.
- Change a booking with a stale ETag for the 412.

flights
where the planes pretend to go
GET /airline/v1/flights — List flights, filter by route · Responds with 200 Link to this endpoint
GET /airline/v1/flights/{id} — Get one flight · Responds with 200 404 Link to this endpoint
GET /airline/v1/flights/{id}/seats — Seat map with availability · Responds with 200 404 Link to this endpoint
GET /airline/v1/flights/{id}/status — Live-ish flight status (random delays) · Responds with 200 404 Link to this endpoint

bookings
a state machine with conflicts
POST /airline/v1/bookings — Book a seat (409 on conflicts & overbooking) (requires Bearer auth) · Responds with 201 400 401 404 409 Link to this endpoint
GET /airline/v1/bookings/{id} — Get a booking (410 if cancelled) (requires Bearer auth) · Responds with 200 401 404 410 Link to this endpoint
PUT /airline/v1/bookings/{id}/seat — Change seat (If-Match concurrency) (requires Bearer auth) · Responds with 200 400 401 404 409 412 Link to this endpoint
POST /airline/v1/bookings/{id}/checkin — Check in (state machine) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint
DELETE /airline/v1/bookings/{id} — Cancel a booking (admin only, then 410) (requires Bearer auth) · Responds with 204 401 403 404 409 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/protocol
TITLE: Protocol Lab API — Mock REST API, 12 endpoints | Fun API
================================================================

Protocol Lab API — free mock REST API for testing

Protocol mechanics the themed APIs do not cover: 202 Accepted with job polling, 301/302 redirects (and a chain), 503 with Retry-After, a guaranteed 504, Accept-based content negotiation with 406, HATEOAS links, RFC 6902 JSON Patch and 410 Gone.

The Protocol Lab is the catalog's HTTP semantics bench, and covers what most mock APIs never do: 202-accepted async jobs you poll to completion, 301 and 302 redirects, 503 and 504 outages, JSON Patch, and content negotiation that answers 406 when it cannot satisfy your Accept header. If a client library is going to surprise you, it will surprise you here.

Base URL: https://funapi.dev/api/protocol/v1 · 12 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/protocol/v1/moved/old-dashboard — Permanently moved — 301. No token, no signup:

curl -i https://funapi.dev/api/protocol/v1/moved/old-dashboard

answers 301 Moved Permanently with:

{
"error": "Moved Permanently",
"message": "The dashboard lives at /moved/new-dashboard now. Note that curl needs -L to follow redirects."
}

Open and run this endpoint

What you can practise here
- Start a job, follow the 202 and its Location header, and poll until it completes.
- Follow a 301 and a 302 and check whether your HTTP client preserves the method and the body.
- Send an Accept header the server cannot satisfy and read the 406.
- Apply a JSON Patch document, then one whose test operation fails, and compare the results.
- Trigger the 503 and 504 endpoints to confirm your timeout and retry policy behaves as designed.

jobs
202 Accepted + poll to completion
POST /protocol/v1/jobs — Start an async job — 202 Accepted · Responds with 202 400 Link to this endpoint
GET /protocol/v1/jobs/{id} — Poll a job — progresses on every poll · Responds with 200 404 Link to this endpoint

redirects
301, 302 and a chain to follow
GET /protocol/v1/moved/old-dashboard — Permanently moved — 301 · Responds with 301 Link to this endpoint
GET /protocol/v1/moved/new-dashboard — Where the 301 leads · Responds with 200 Link to this endpoint
GET /protocol/v1/hop — A 302 redirect chain — follow it down · Responds with 200 302 400 Link to this endpoint

outages
503 & 504 on demand
GET /protocol/v1/maintenance — Scheduled maintenance — 503 + Retry-After · Responds with 503 Link to this endpoint
GET /protocol/v1/gateway-timeout — Slow upstream — waits ~3s, then 504 · Responds with 504 Link to this endpoint

documents
HATEOAS, JSON Patch, 406 & 410
GET /protocol/v1/export/documents — Content negotiation via Accept (406 on anything else) · Responds with 200 406 Link to this endpoint
GET /protocol/v1/documents — List documents (HATEOAS links) · Responds with 200 Link to this endpoint
GET /protocol/v1/documents/{id} — Get a document (410 after deletion) · Responds with 200 404 410 Link to this endpoint
PATCH /protocol/v1/documents/{id} — RFC 6902 JSON Patch (op/path/value) · Responds with 200 400 404 409 Link to this endpoint
DELETE /protocol/v1/documents/{id} — Delete a document (admin only, then 410) (requires Bearer auth) · Responds with 204 401 403 404 410 Link to this endpoint

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Object Storage API — Objects, checksums, ranges & resumable uploads.
- Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/shop
TITLE: Shop API — Mock REST API, 9 endpoints | Fun API Playground
================================================================

Shop API — free mock REST API for testing

A small e-commerce flow: browse products, build a cart, apply coupons and check out. Out-of-stock items return 409, invalid coupons 422, expired coupons 410, and checkout honors Idempotency-Key so retries never double-charge.

The Shop API is a checkout: products with real stock counts, carts, and coupons that expire. Stock is decremented on checkout, so the interesting failures happen between adding an item and paying for it — which is precisely the window most e-commerce test suites skip.

Base URL: https://funapi.dev/api/shop/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/shop/v1/products — List products, filter by category. No token, no signup:

curl -i https://funapi.dev/api/shop/v1/products

answers 200 OK with:

{
"total": 6,
"data": [
{
"id": 1,
"name": "Rubber Duck (QA Edition)",
"price": 9.99,
"stock": 12,
"category": "office"
},
{
"id": 2,
"name": "Mechanical Keyboard, Extra Clicky",
"price": 129,
"stock": 5,
"category": "office"
},
{
"id": 3,
"name": "Limited Sneaker Drop",
"price": 249.99,
"stock": 0,
"category": "fashion"
},
{
"id": 4,
"name": "Coffee Beans, 1kg, Depressingly Strong",
"price": 18.5,
"stock": 40,
"category": "food"
},
{
"id": 5,
"name": "HTTP Status Cats Poster",
"price": 14,
"stock": 7,
"category": "decor"
},
{
"id": 6,
"name": "Infinite TODO Notebook",
"price": 11.25,
"stock": 3,
"category": "office"
}
]
}

Open and run this endpoint

What you can practise here
- Add the last unit to a cart, check out twice, and read the conflict on the second attempt.
- Apply an expired coupon and see the 410 rather than a validation error.
- Check out with an empty cart and read the 422.
- Add a quantity larger than the stock on hand and confirm the error names the constraint.

products
things you do not need
GET /shop/v1/products — List products, filter by category · Responds with 200 Link to this endpoint
GET /shop/v1/products/{id} — Get one product · Responds with 200 404 Link to this endpoint

carts
add, remove, regret
POST /shop/v1/carts — Create an empty cart · Responds with 201 400 Link to this endpoint
GET /shop/v1/carts/{id} — Get a cart with its running total · Responds with 200 404 Link to this endpoint
POST /shop/v1/carts/{id}/items — Add a product (409 when out of stock) · Responds with 200 400 404 409 Link to this endpoint
DELETE /shop/v1/carts/{id}/items/{productId} — Remove a product from the cart · Responds with 200 404 Link to this endpoint

checkout
where the money pretends to move
GET /shop/v1/coupons/{code} — Validate a coupon (410 when expired) · Responds with 200 404 410 Link to this endpoint
POST /shop/v1/carts/{id}/checkout — Check out (idempotent, coupon-aware) · Responds with 201 400 404 409 422 Link to this endpoint
GET /shop/v1/orders/{id} — Get an order · Responds with 200 404 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/cargo
TITLE: Cargo Tracking API — Mock REST API, 9 endpoints | Fun API
================================================================

Cargo Tracking API — free mock REST API for testing

Track parcels through a strict state machine (label-created → picked-up → in-transit → out-for-delivery → delivered). Reads are public; every write needs the header X-API-Key: cargo-key-123 — a different auth style than the Bearer tokens used elsewhere.

The Cargo Tracking API is a shipment state machine — created, picked up, in transit, delivered — where illegal transitions are rejected rather than accepted. It is also the only API in the catalog that authenticates writes with an X-API-Key header instead of a Bearer token, which makes it useful for testing a client that must handle more than one auth scheme.

Base URL: https://funapi.dev/api/cargo/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/cargo/v1/shipments — List shipments, filter by status. No token, no signup:

curl -i https://funapi.dev/api/cargo/v1/shipments

answers 200 OK with:

{
"total": 3,
"data": [
{
"id": "TRK123456",
"recipient": "Wile E. Coyote",
"status": "in-transit",
"attempts": 0
},
{
"id": "TRK777777",
"recipient": "Joey Tribbiani",
"status": "delivered",
"attempts": 1
},
{
"id": "TRK000001",
"recipient": "H. Potter",
"status": "label-created",
"attempts": 0
}
]
}

Open and run this endpoint

What you can practise here
- Authenticate a write with X-API-Key and confirm a Bearer token is not accepted in its place.
- Move a shipment from created straight to delivered and read the rejected transition.
- Track a shipment id that does not exist and check the 404.
- Update a shipment with a stale ETag to trigger the 412.

tracking
where is my package
GET /cargo/v1/shipments — List shipments, filter by status · Responds with 200 400 Link to this endpoint
GET /cargo/v1/shipments/{id} — Track one shipment · Responds with 200 404 Link to this endpoint
GET /cargo/v1/shipments/{id}/events — Tracking history · Responds with 200 404 Link to this endpoint
GET /cargo/v1/shipments/{id}/eta — Estimated delivery (deterministic-mode friendly) · Responds with 200 404 Link to this endpoint
GET /cargo/v1/rates — Shipping quote by weight · Responds with 200 400 Link to this endpoint

operations
writes, gated by X-API-Key
POST /cargo/v1/shipments — Create a shipping label (X-API-Key) · Responds with 201 400 401 Link to this endpoint
POST /cargo/v1/shipments/{id}/advance — Advance the state machine one step (X-API-Key) · Responds with 200 401 404 409 Link to this endpoint
POST /cargo/v1/shipments/{id}/attempt-delivery — Attempt delivery — may fail, 3 strikes returns it (X-API-Key) · Responds with 200 401 404 409 Link to this endpoint
PUT /cargo/v1/shipments/{id}/address — Redirect a parcel (X-API-Key + If-Match) · Responds with 200 400 401 404 409 412 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/space
TITLE: Space Agency API — Mock REST API, 9 endpoints | Fun API
================================================================

Space Agency API — free mock REST API for testing

Run a small space program: schedule launches, scrub them for weather, and actually light the candle — a slow, risky operation that sometimes aborts. Probe pings take seconds, ideal for exercising client timeouts.

The Space Agency API launches rockets, scrubs launches and talks to probes with a deliberate signal delay measured in seconds. The slow probe endpoints exist so you can test timeouts against something that genuinely takes time, rather than mocking a delay and hoping your client behaves the same way.

Base URL: https://funapi.dev/api/space/v1 · 9 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/space/v1/launches — List launches, filter by status. No token, no signup:

curl -i https://funapi.dev/api/space/v1/launches

answers 200 OK with:

{
"total": 3,
"data": [
{
"id": 1,
"mission": "Artemis Redux",
"vehicle": "Kestrel IX",
"window": "2026-08-01T12:00:00Z",
"status": "scheduled",
"scrubCount": 0
},
{
"id": 2,
"mission": "Red Rover Resupply",
"vehicle": "Pelican Heavy",
"window": "2026-07-04T04:30:00Z",
"status": "launched",
"scrubCount": 1
},
{
"id": 3,
"mission": "Solar Sail Trials",
"vehicle": "Kestrel IX",
"window": "2026-06-20T22:00:00Z",
"status": "scrubbed",
"scrubCount": 3
}
]
}

Open and run this endpoint

What you can practise here
- Call a probe endpoint with a client timeout shorter than the signal lag and confirm the timeout actually fires.
- Schedule a launch, scrub it, and try to scrub it again for the conflict.
- Assign crew beyond a mission's capacity and read the error.
- Request telemetry for a probe that is out of range and handle the failure.

launches
countdowns and scrubs
GET /space/v1/launches — List launches, filter by status · Responds with 200 400 Link to this endpoint
GET /space/v1/launches/{id} — Get one launch · Responds with 200 404 Link to this endpoint
POST /space/v1/launches — Schedule a launch (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
POST /space/v1/launches/{id}/scrub — Scrub a scheduled launch (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpoint
POST /space/v1/launches/{id}/launch — Light the candle — slow & occasionally aborts (admin only) (requires Bearer auth) · Responds with 200 401 403 404 409 Link to this endpoint
GET /space/v1/launches/{id}/countdown — T-minus for a scheduled launch · Responds with 200 404 409 Link to this endpoint

crew
astronauts on the roster
GET /space/v1/astronauts — List astronauts · Responds with 200 Link to this endpoint
GET /space/v1/astronauts/{id} — Get one astronaut · Responds with 200 404 Link to this endpoint

probes
deep space, slow answers
GET /space/v1/probes/{id}/ping — Ping a deep-space probe — takes ~3s · Responds with 200 404 Link to this endpoint

Related APIs
- Superhero API — Heroes, powers & nemeses. Great for nested resources.
- Dino Park API — Dinosaurs, enclosures & the occasional breach.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/starfleet
TITLE: Starfleet API — Mock REST API, 10 endpoints | Fun API
================================================================

Starfleet API — free mock REST API for testing

Command a small fleet: crew rosters, warp-speed changes with physics-based validation, a breached warp core that refuses orders, and a tribble endpoint that doubles on every GET — a read that mutates, which your test suite should absolutely complain about.

The Starfleet API runs ships and crews under warp-factor limits, and breeds tribbles that multiply exponentially on every read of their population. That growing number is the point: it is the catalog's only endpoint whose response changes on its own between two identical requests, which is exactly what breaks a naive snapshot test.

Base URL: https://funapi.dev/api/starfleet/v1 · 10 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/starfleet/v1/ships — List ships, filter by class or status. No token, no signup:

curl -i https://funapi.dev/api/starfleet/v1/ships

answers 200 OK with:

{
"total": 4,
"data": [
{
"id": 1,
"name": "USS Curiosity",
"registry": "NCC-1704",
"class": "Constitution",
"status": "active",
"warpCore": "stable",
"currentWarp": 0
},
{
"id": 2,
"name": "USS Paperwork",
"registry": "NCC-9021",
"class": "Miranda",
"status": "active",
"warpCore": "stable",
"currentWarp": 2
},
{
"id": 3,
"name": "USS Redundancy",
"registry": "NCC-4242",
"class": "Excelsior",
"status": "in-refit",
"warpCore": "offline",
"currentWarp": 0
},
{
"id": 4,
"name": "USS Boldly",
"registry": "NCC-1138",
"class": "Defiant",
"status": "active",
"warpCore": "breached",
"currentWarp": 0
}
]
}

Open and run this endpoint

What you can practise here
- Read the tribble population twice and watch a snapshot assertion fail on data that was never written.
- Set a warp factor above the ship's limit and read the validation error.
- Assign a crew member to two ships and check the conflict.
- Reset the sandbox and confirm the population returns to its seed value.

ships
the fleet, mostly functional
GET /starfleet/v1/ships — List ships, filter by class or status · Responds with 200 Link to this endpoint
GET /starfleet/v1/ships/{id} — Get one ship · Responds with 200 404 Link to this endpoint
POST /starfleet/v1/ships — Commission a new ship (requires Bearer auth) · Responds with 201 400 401 409 Link to this endpoint
PUT /starfleet/v1/ships/{id}/warp — Set warp factor (physics says no above 9.9) (requires Bearer auth) · Responds with 200 400 401 404 409 Link to this endpoint

crew
rosters and redshirts
GET /starfleet/v1/crew — List crew, filter by species or ship · Responds with 200 Link to this endpoint
GET /starfleet/v1/crew/{id} — Get one crew member · Responds with 200 404 Link to this endpoint
POST /starfleet/v1/crew — Enlist a crew member (requires Bearer auth) · Responds with 201 400 401 404 Link to this endpoint
DELETE /starfleet/v1/crew/{id} — Discharge a crew member (admin only) (requires Bearer auth) · Responds with 204 401 403 404 Link to this endpoint

tribbles
do NOT keep GETting
GET /starfleet/v1/tribbles — Count tribbles — doubles on EVERY read · Responds with 200 Link to this endpoint
POST /starfleet/v1/tribbles/purge — Beam the tribbles away (admin only) (requires Bearer auth) · Responds with 200 401 403 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/worldcup
TITLE: World Cup 2026 API — Mock REST API, 17 endpoints | Fun API
================================================================

World Cup 2026 API — free mock REST API for testing

A full FIFA World Cup 2026 sandbox spanning the USA, Canada and Mexico: browse the 48-team format, compute live group standings, simulate matches with goal events, chase the Golden Boot, buy limited tickets (409 when sold out) and submit champion predictions.

The World Cup 2026 API is the largest in the catalog — teams, groups, venues across the host cities, squads, match simulation, ticket sales and bracket predictions. Tickets are limited and matches must be played in group order, so it combines contended writes, business-rule validation and a slow simulation endpoint in one surface. It is the closest thing here to a full application backend.

Base URL: https://funapi.dev/api/worldcup/v1 · 17 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/worldcup/v1/teams — List qualified teams (filter by group, confederation or hosts). No token, no signup:

curl -i https://funapi.dev/api/worldcup/v1/teams

answers 200 OK with:

{
"total": 48,
"data": [
{
"id": 1,
"name": "United States",
"code": "USA",
"group": "A",
"confederation": "CONCACAF",
"fifaRank": 17,
"host": true
},
{
"id": 2,
"name": "Wales",
"code": "WAL",
"group": "A",
"confederation": "UEFA",
"fifaRank": 41,
"host": false
},
{
"id": 3,
"name": "Ghana",
"code": "GHA",
"group": "A",
"confederation": "CAF",
"fifaRank": 42,
"host": false
},
{
"id": 4,
"name": "Uzbekistan",
"code": "UZB",
"group": "A",
"confederation": "AFC",
"fifaRank": 48,
"host": false
},
{
"id": 5,
"name": "Mexico",
"code": "MEX",
"group": "B",
"confederation": "CONCACAF",
"fifaRank": 15,
"host": true
},
{
"id": 6,
"name": "Türkiye",
"code": "TUR",
"group": "B",
"confederation": "UEFA",
"fifaRank": 28,
"host": false
},
{
"id": 7,
"name": "Senegal",

(truncated — the full response comes back when you run it)

Open and run this endpoint

What you can practise here
- Buy the last ticket for a venue twice and read the conflict on the second purchase.
- Simulate a knockout match before the group stage is finished and check the rule violation.
- Submit a bracket prediction with an invalid shape and compare the 422 with a plain 400.
- Request a match that has already been played and handle the 410.
- Run the slow simulation endpoint to exercise your client timeout.

teams
national squads and groups
GET /worldcup/v1/teams — List qualified teams (filter by group, confederation or hosts) · Responds with 200 400 Link to this endpoint
GET /worldcup/v1/teams/{id} — Get one national team · Responds with 200 404 Link to this endpoint
GET /worldcup/v1/groups/{letter}/standings — Live group standings computed from finished matches · Responds with 200 400 404 Link to this endpoint

matches
fixtures, simulation and VAR
GET /worldcup/v1/matches — List fixtures (filter by stage, status, group or team) · Responds with 200 400 Link to this endpoint
GET /worldcup/v1/matches/{id} — Get one fixture with team and venue details · Responds with 200 404 Link to this endpoint
POST /worldcup/v1/matches/{id}/simulate — Kick off and simulate a match — updates score, goal events and standings (admin only) (requires Bearer auth) · Responds with 200 404 409 422 Link to this endpoint
GET /worldcup/v1/matches/{id}/events — Goal timeline of a played match (409 before kickoff) · Responds with 200 404 409 Link to this endpoint
GET /worldcup/v1/matches/{id}/var-review — Request a VAR review — the check takes ~3 seconds · Responds with 200 404 Link to this endpoint

venues
2026 host stadiums
GET /worldcup/v1/venues — List 2026 host stadiums, filter by country · Responds with 200 Link to this endpoint
GET /worldcup/v1/venues/{id} — Get a stadium with its scheduled matches · Responds with 200 404 Link to this endpoint

players
Golden Boot race
GET /worldcup/v1/players/top-scorers — Golden Boot race — top scorers so far · Responds with 200 422 Link to this endpoint

tickets
limited seats, real conflicts
POST /worldcup/v1/tickets — Buy match tickets — limited seats, 409 when sold out (requires Bearer auth) · Responds with 201 400 409 422 Link to this endpoint
GET /worldcup/v1/tickets/{id} — Get a ticket order (410 after cancellation) (requires Bearer auth) · Responds with 200 404 410 Link to this endpoint
DELETE /worldcup/v1/tickets/{id} — Cancel a ticket order and release the seats (admin only) (requires Bearer auth) · Responds with 204 404 410 Link to this endpoint

fanzone
mascots and predictions
POST /worldcup/v1/predictions — Predict the 2026 world champion · Responds with 201 422 Link to this endpoint
GET /worldcup/v1/predictions/leaderboard — Most-predicted champions · Responds with 200 Link to this endpoint
GET /worldcup/v1/fanzone/mascots — Meet Maple, Zayu and Clutch — the official 2026 mascots · Responds with 200 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/fiba
TITLE: FIBA World Cup API — Mock REST API, 22 endpoints | Fun API
================================================================

FIBA World Cup API — free mock REST API for testing

A FIBA Basketball World Cup 2027 sandbox in Qatar: 32 teams in eight groups, games simulated quarter by quarter with overtime, ETag-guarded team staff and box scores.

The FIBA World Cup API models the 2027 Basketball World Cup in Qatar, and it is built around the fact that basketball has no draws. Simulating a game plays four quarters possession by possession and then keeps adding five-minute overtimes until somebody is ahead, so the group table can use FIBA’s real classification system — two points for a win, one for a loss — and never needs a draw column. Everything downstream is derived from that one write: the box score, the cursor-paged play-by-play, the tournament leaders and the MVP race all read the plays the simulation produced, and none of them can be written directly.

Base URL: https://funapi.dev/api/fiba/v1 · 22 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/fiba/v1/teams — List qualified teams (filter by group, FIBA zone or hosts). No token, no signup:

curl -i https://funapi.dev/api/fiba/v1/teams

answers 200 OK with:

{
"total": 32,
"data": [
{
"id": 1,
"name": "Qatar",
"code": "QAT",
"group": "A",
"zone": "Asia",
"fibaRank": 24,
"host": true,
"headCoach": null,
"captainPlayerId": null,
"_v": 1
},
{
"id": 2,
"name": "United States",
"code": "USA",
"group": "A",
"zone": "Americas",
"fibaRank": 1,
"host": false,
"headCoach": null,
"captainPlayerId": null,
"_v": 1
},
{
"id": 3,
"name": "Lithuania",
"code": "LTU",
"group": "A",
"zone": "Europe",
"fibaRank": 8,
"host": false,
"headCoach": null,
"captainPlayerId": null,
"_v": 1
},
{
"id": 4,
"name": "Egypt",
"code": "EGY",
"group": "A",
"zone": "Africa",
"fibaRank": 30,
"host": false,
"headCoach": null,
"captainPlayerId": null,
"_v": 1
},
{
"id": 5,
"name": "Germany",
"code": "GER",
"group": "B",
"zone": "Europe",
"fibaRank": 2,

(truncated — the full response comes back when you run it)

Open and run this endpoint

What you can practise here
- GET /teams/32, keep the ETag, then PUT /teams/32/staff with If-Match: v1 — repeat the same request and read the 412 the second, now-stale etag earns.
- Name a captain who plays for another nation and compare that 422 with the 412 above: one is a stale precondition, the other a body that can never be valid.
- GET /groups/A/standings, send its ETag back as If-None-Match for a 304 with no body, then simulate a group A game and watch the same header start returning 200 again.
- POST /games/1/simulate as admin, then walk GET /games/1/play-by-play?limit=5 by following nextCursor until it comes back null.
- POST /games/1/challenge for the home bench (it takes ~3s — a real replay review), then challenge again from the same bench for the 409.
- POST /games/1/highlights for a 202 and a Location, then poll GET /highlights/1 until progress hits 100 and a downloadUrl appears.
- GET /players/63/advanced for a 402 Payment Required that never succeeds, and buy the last seats for a game to turn POST /tickets into a 409.

teams
the 32 qualified nations
GET /fiba/v1/teams — List qualified teams (filter by group, FIBA zone or hosts) · Responds with 200 400 Link to this endpoint
GET /fiba/v1/teams/{id} — Get one national team — carries the ETag its staff update needs · Responds with 200 404 Link to this endpoint
PUT /fiba/v1/teams/{id}/staff — Name the head coach and captain — optimistic concurrency via If-Match (requires Bearer auth) · Responds with 200 401 403 404 412 422 Link to this endpoint
GET /fiba/v1/groups/{letter}/standings — Group table computed from finished games — cacheable (ETag / If-None-Match / 304) · Responds with 200 304 400 404 Link to this endpoint

games
simulation, box scores and reviews
GET /fiba/v1/games — List games (filter by stage, status, group or team) · Responds with 200 Link to this endpoint
GET /fiba/v1/games/{id} — Get one game with team and arena names resolved · Responds with 200 404 Link to this endpoint
POST /fiba/v1/games/{id}/simulate — Tip off — four quarters plus overtime until somebody wins (admin only) (requires Bearer auth) · Responds with 200 401 403 404 409 422 Link to this endpoint
GET /fiba/v1/games/{id}/boxscore — Per-player box score, derived from the play-by-play · Responds with 200 404 409 Link to this endpoint
GET /fiba/v1/games/{id}/play-by-play — Cursor-paged play-by-play — follow nextCursor to the final buzzer · Responds with 200 400 404 409 Link to this endpoint
POST /fiba/v1/games/{id}/challenge — Coach's challenge — a slow (~3s) replay review, one per team (requires Bearer auth) · Responds with 200 401 404 409 422 Link to this endpoint
POST /fiba/v1/games/{id}/highlights — Queue a highlight reel — 202 Accepted, then poll the job (requires Bearer auth) · Responds with 202 401 404 409 422 Link to this endpoint
GET /fiba/v1/highlights/{id} — Poll a highlight job until it is ready · Responds with 200 404 Link to this endpoint

arenas
the Doha host courts
GET /fiba/v1/arenas — List the Qatar host arenas, filter by city · Responds with 200 Link to this endpoint
GET /fiba/v1/arenas/{id} — Get one arena with the games it hosts · Responds with 200 404 Link to this endpoint

players
stat leaders and the MVP race
GET /fiba/v1/players — List players (filter by team or position) · Responds with 200 Link to this endpoint
GET /fiba/v1/players/{id} — Get one player with their running tournament totals · Responds with 200 404 Link to this endpoint
GET /fiba/v1/players/leaders — Tournament leaders for points, rebounds or assists · Responds with 200 422 Link to this endpoint
GET /fiba/v1/players/{id}/advanced — Tracking data — always 402, it is on the paid analytics tier · Responds with 402 404 Link to this endpoint
GET /fiba/v1/fanzone/mvp — The MVP race, ranked by a simplified efficiency index · Responds with 200 Link to this endpoint

tickets
limited seats, real conflicts
POST /fiba/v1/tickets — Buy tickets — seats are limited, so 409 when the game sells out (requires Bearer auth) · Responds with 201 400 401 409 422 Link to this endpoint
GET /fiba/v1/tickets/{id} — Get a ticket order — 410 once it has been cancelled · Responds with 200 404 410 Link to this endpoint
DELETE /fiba/v1/tickets/{id} — Cancel an order and release the seats (requires Bearer auth) · Responds with 204 401 404 410 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/gta
TITLE: GTA API — Mock REST API, 17 endpoints | Fun API Playground
================================================================

GTA API — free mock REST API for testing

A Grand Theft Auto–flavoured sandbox: browse Los Santos characters and vehicles, respray cars at a Pay-n-Spray, buy weapons from the catologue, start missions with prerequisites, plan authenticated heists, run a slow (~2s) police chase that inflates your wanted level (0–5 stars) and bribe the LSPD to clear it. Cash starts at $5000 and 402 fires when you are broke.

The GTA (Grand Theft Auto) API is a Los Santos–style sandbox spanning characters, vehicles, an ammu-nation weapon catologue, story missions with prerequisites, admin-only heist planning and a 0–5 star wanted system. Cash is the spine of it: respraying cars and buying weapons spend money, completing missions earns it, and every broke path answers 402 Payment Required — the status code production APIs reach for when a metered resource is exhausted.

Base URL: https://funapi.dev/api/gta/v1 · 17 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/gta/v1/characters — List characters (filter by city or affiliation). No token, no signup:

curl -i https://funapi.dev/api/gta/v1/characters

answers 200 OK with:

{
"total": 10,
"data": [
{
"id": 1,
"name": "Tommy Vercetti",
"alias": "The Harwood Butcher",
"city": "Vice City",
"affiliation": "Vercetti Gang",
"status": "alive"
},
{
"id": 2,
"name": "CJ",
"alias": "Carl Johnson",
"city": "Los Santos",
"affiliation": "Grove Street Families",
"status": "alive"
},
{
"id": 3,
"name": "Niko Bellic",
"alias": "The Yugoslav",
"city": "Liberty City",
"affiliation": "Pegorino Family",
"status": "alive"
},
{
"id": 4,
"name": "Michael De Santa",
"alias": "Mikey",
"city": "Los Santos",
"affiliation": "Freelance",
"status": "alive"
},
{
"id": 5,
"name": "Trevor Philips",
"alias": "T",
"city": "Blaine County",
"affiliation": "Trevor Philips Enterprises",
"status": "alive"
},
{
"id": 6,
"name": "Franklin Clinton",
"alias": "Frank",
"city": "Los Santos",
"affiliation": "Freelance",
"status": "alive"

(truncated — the full response comes back when you run it)

Open and run this endpoint

What you can practise here
- Buy a weapon with the admin token, then buy it again and read the 409 "already owned" conflict.
- Respray a vehicle while your wallet is short and confirm the 402, then complete a mission to top up and retry.
- Start a mission whose prerequisite is unmet and compare the 422 with a 409 from starting a second mission while one is active.
- POST /wanted/increase twice for the ~2s police chase, then DELETE /wanted and check the bribe deducts $1000 per star.
- Plan a heist with an approach outside stealth/loud/subtle and read the 422.

characters
heroes and contacts
GET /gta/v1/characters — List characters (filter by city or affiliation) · Responds with 200 Link to this endpoint
GET /gta/v1/characters/{id} — Get one character · Responds with 200 404 Link to this endpoint

vehicles
cars and Pay-n-Spray
GET /gta/v1/vehicles — List vehicles (filter by class) · Responds with 200 Link to this endpoint
GET /gta/v1/vehicles/{id} — Get one vehicle · Responds with 200 404 Link to this endpoint
POST /gta/v1/vehicles/{id}/respray — Respray a vehicle at Pay-n-Spray — spends cash (402 when broke) (requires Bearer auth) · Responds with 200 402 404 422 Link to this endpoint

weapons
the ammu-nation catologue
GET /gta/v1/weapons — Browse the ammu-nation catologue (filter by category) · Responds with 200 Link to this endpoint
POST /gta/v1/weapons/{id}/buy — Buy a weapon — spends cash (402 when broke, 409 if already owned) (requires Bearer auth) · Responds with 200 404 409 402 Link to this endpoint

missions
story jobs with prereqs
GET /gta/v1/missions — List missions (filter by status or city) · Responds with 200 Link to this endpoint
GET /gta/v1/missions/{id} — Get one mission with its prereq · Responds with 200 404 Link to this endpoint
POST /gta/v1/missions/{id}/start — Start a mission (409 if one is active, 422 if prereq not completed) (requires Bearer auth) · Responds with 200 404 409 422 Link to this endpoint
POST /gta/v1/missions/{id}/complete — Complete the active mission — pays out the reward (requires Bearer auth) · Responds with 200 404 409 Link to this endpoint
POST /gta/v1/heists — Plan a heist — choose an approach (admin only) (requires Bearer auth) · Responds with 201 422 Link to this endpoint
GET /gta/v1/heists/{id} — Get a planned heist · Responds with 200 404 Link to this endpoint

wanted
stars, bribes and police chases
GET /gta/v1/wanted — Current wanted level (0–5 stars) · Responds with 200 Link to this endpoint
POST /gta/v1/wanted/increase — Commit a crime — inflates wanted level after a ~2s police chase (requires Bearer auth) · Responds with 200 409 Link to this endpoint
DELETE /gta/v1/wanted — Bribe the LSPD to clear wanted level — costs $1000/star (402 when broke) (requires Bearer auth) · Responds with 200 402 409 Link to this endpoint

radio
in-game stations
GET /gta/v1/radio — List in-game radio stations · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/dragonball
TITLE: Dragon Ball API — Mock REST API, 6 endpoints | Fun API
================================================================

Dragon Ball API — free mock REST API for testing

Explore Dragon Ball fighters and transformations, then run authenticated tournament battles with deterministic sandbox results.

The Dragon Ball API tracks fighters, their transformations and the power levels those transformations produce, plus tournaments that seed brackets from them. Power level is derived rather than stored, which makes it a compact target for testing a client against computed fields it must not try to write.

Base URL: https://funapi.dev/api/dragonball/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/dragonball/v1/fighters — List fighters by race or minimum power. No token, no signup:

curl -i https://funapi.dev/api/dragonball/v1/fighters

answers 200 OK with:

{
"total": 4,
"data": [
{
"id": 1,
"name": "Goku",
"race": "Saiyan",
"powerLevel": 9001,
"transformations": [
"Super Saiyan",
"Ultra Instinct"
]
},
{
"id": 2,
"name": "Vegeta",
"race": "Saiyan",
"powerLevel": 8800,
"transformations": [
"Super Saiyan Blue",
"Ultra Ego"
]
},
{
"id": 3,
"name": "Piccolo",
"race": "Namekian",
"powerLevel": 7200,
"transformations": [
"Orange Piccolo"
]
},
{
"id": 4,
"name": "Frieza",
"race": "Frieza Race",
"powerLevel": 8500,
"transformations": [
"Golden Frieza",
"Black Frieza"
]
}
]
}

Open and run this endpoint

What you can practise here
- Transform a fighter and confirm the power level the API computes rather than the one you sent.
- Enter the same fighter into a tournament twice and read the conflict.
- Submit a transformation the fighter has not unlocked and check the 422.
- Seed a bracket with an odd number of fighters and see how the API resolves it.

fighters
warriors and power levels
GET /dragonball/v1/fighters — List fighters by race or minimum power · Responds with 200 Link to this endpoint
GET /dragonball/v1/fighters/{id} — Get one fighter · Responds with 200 404 Link to this endpoint
GET /dragonball/v1/fighters/{id}/transformations — List a fighter’s transformations · Responds with 200 404 Link to this endpoint
POST /dragonball/v1/fighters/{id}/power-up — Increase a fighter’s power level (requires Bearer auth) · Responds with 200 422 Link to this endpoint

tournaments
battle simulation
POST /dragonball/v1/tournaments — Resolve a tournament match (requires Bearer auth) · Responds with 201 400 409 Link to this endpoint
GET /dragonball/v1/tournaments/{id} — Get a tournament match · Responds with 200 404 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/formula1
TITLE: Formula 1 API — Mock REST API, 7 endpoints | Fun API
================================================================

Formula 1 API — free mock REST API for testing

A Formula 1 testing grid with drivers, constructors, race simulation, lap telemetry and authenticated pit-stop operations.

The Formula 1 API covers drivers, constructors, races, pit stops and lap telemetry. Telemetry returns dense numeric arrays rather than the small object payloads the rest of the catalog serves, which makes it the right page for testing how your client, your assertions and your logging cope with a response that is genuinely large.

Base URL: https://funapi.dev/api/formula1/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/formula1/v1/drivers — List drivers by team. No token, no signup:

curl -i https://funapi.dev/api/formula1/v1/drivers

answers 200 OK with:

{
"total": 4,
"data": [
{
"id": 1,
"code": "VER",
"name": "Max Verstappen",
"teamId": 1,
"number": 1,
"points": 0
},
{
"id": 2,
"code": "LEC",
"name": "Charles Leclerc",
"teamId": 2,
"number": 16,
"points": 0
},
{
"id": 3,
"code": "NOR",
"name": "Lando Norris",
"teamId": 3,
"number": 4,
"points": 0
},
{
"id": 4,
"code": "HAM",
"name": "Lewis Hamilton",
"teamId": 2,
"number": 44,
"points": 0
}
]
}

Open and run this endpoint

What you can practise here
- Pull a full telemetry series and check your parser and assertions handle the array size without truncating it.
- Record a pit stop against a race that has finished and read the conflict.
- Submit a lap time in the wrong unit and see the 422.
- Filter the grid by constructor and confirm the counts agree with the unfiltered list.

grid
drivers and constructors
GET /formula1/v1/drivers — List drivers by team · Responds with 200 Link to this endpoint
GET /formula1/v1/constructors — List constructors with drivers · Responds with 200 Link to this endpoint

races
events and results
GET /formula1/v1/races — List races by status · Responds with 200 Link to this endpoint
POST /formula1/v1/races/{id}/start — Run and finish a race (requires Bearer auth) · Responds with 200 404 409 Link to this endpoint
GET /formula1/v1/races/{id}/results — Get classified race results · Responds with 200 409 Link to this endpoint

telemetry
laps and pit stops
GET /formula1/v1/races/{id}/telemetry — Read lap telemetry after a race · Responds with 200 Link to this endpoint
POST /formula1/v1/races/{id}/pit-stops — Record a pit stop (requires Bearer auth) · Responds with 201 422 Link to this endpoint

Related APIs
- Pizza Orders API — Place & track orders. Includes a guaranteed 500.
- Coffee Shop API — Drinks & orders. Home of the legendary 418.
- Football API — Teams, squads, standings & simulated matches.
- Bank API — Accounts, transfers & cursor pagination. Home of the 402.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/voxel
TITLE: Voxel Worlds API — Mock REST API, 6 endpoints | Fun API
================================================================

Voxel Worlds API — free mock REST API for testing

An original block-building sandbox inspired by voxel games. Practice world seeds, coordinate resources, inventory conflicts and optimistic concurrency.

The Voxel Worlds API models block worlds with players, inventories and integer coordinates. Coordinates are bounded, so it is a compact place to practise boundary testing — the off-by-one at the edge of a valid range, which is the class of bug that unit tests catch and integration tests usually do not.

Base URL: https://funapi.dev/api/voxel/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/voxel/v1/worlds — List worlds. No token, no signup:

curl -i https://funapi.dev/api/voxel/v1/worlds

answers 200 OK with:

{
"total": 1,
"data": [
{
"id": 1,
"name": "Blockshire",
"seed": 424242,
"biome": "meadow",
"difficulty": "normal",
"_v": 1
}
]
}

Open and run this endpoint

What you can practise here
- Place a block exactly on the world boundary, then one block past it, and compare the two responses.
- Add an item beyond a player's inventory capacity and read the error.
- Join a world that is full and check the conflict.
- Send a floating-point coordinate where an integer is required and read the validation failure.

worlds
procedural block worlds
GET /voxel/v1/worlds — List worlds · Responds with 200 Link to this endpoint
GET /voxel/v1/worlds/{id} — Get a world · Responds with 200 404 Link to this endpoint
POST /voxel/v1/worlds — Generate a world from a seed (requires Bearer auth) · Responds with 201 400 401 Link to this endpoint
GET /voxel/v1/worlds/{id}/blocks/{x}/{y}/{z} — Inspect a block at coordinates · Responds with 200 404 Link to this endpoint

players
survival stats and inventory
GET /voxel/v1/players — List players · Responds with 200 Link to this endpoint
POST /voxel/v1/players/{id}/inventory — Add an inventory item (409 on duplicate) (requires Bearer auth) · Responds with 200 404 409 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/anime
TITLE: Anime Tournament API — Mock REST API, 5 endpoints | Fun API
================================================================

Anime Tournament API — free mock REST API for testing

An original anime-style tournament with transformations, rankings and deliberately dramatic power scaling.

The Anime Tournament API uses original characters rather than licensed ones, and exists to exercise bracket logic: fighters with power levels, matches seeded from them, and rounds that only advance when the previous one is complete. Small surface, strict ordering rules.

Base URL: https://funapi.dev/api/anime/v1 · 5 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/anime/v1/fighters — List fighters, filter by rank. No token, no signup:

curl -i https://funapi.dev/api/anime/v1/fighters

answers 200 OK with:

{
"total": 3,
"data": [
{
"id": 1,
"name": "Nova Fist",
"element": "plasma",
"power": 9100,
"rank": "S"
},
{
"id": 2,
"name": "Mochi Ronin",
"element": "wind",
"power": 7200,
"rank": "A"
},
{
"id": 3,
"name": "Captain Kawaii",
"element": "water",
"power": 6800,
"rank": "A"
}
]
}

Open and run this endpoint

What you can practise here
- Report a result for a round that has not started and read the 422.
- Enter a fighter twice and check the duplicate response.
- Advance the bracket and confirm the seeding matches the power levels you supplied.
- Request a match id that does not exist for the 404.

fighters
heroes and rivals
GET /anime/v1/fighters — List fighters, filter by rank · Responds with 200 Link to this endpoint
GET /anime/v1/fighters/{id} — Get fighter power profile · Responds with 200 404 Link to this endpoint
POST /anime/v1/fighters/{id}/transform — Transform a fighter and increase power (requires Bearer auth) · Responds with 200 422 Link to this endpoint

matches
tournament battles
POST /anime/v1/matches — Run a deterministic tournament match (requires Bearer auth) · Responds with 201 400 Link to this endpoint
GET /anime/v1/matches — List match history · Responds with 200 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/retroquest
TITLE: Retro Quest API — Mock REST API, 5 endpoints | Fun API
================================================================

Retro Quest API — free mock REST API for testing

An original 16-bit RPG world for testing quests, inventory, saves and state transitions.

The Retro Quest API is a pixel-era RPG: heroes, quests, loot tables and save games. Saves carry a version, and writing over a newer save is rejected — a save-conflict model that is the simplest, most concrete illustration of optimistic concurrency in the whole catalog.

Base URL: https://funapi.dev/api/retro/v1 · 5 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/retro/v1/heroes — List pixel heroes. No token, no signup:

curl -i https://funapi.dev/api/retro/v1/heroes

answers 200 OK with:

{
"total": 1,
"data": [
{
"id": 1,
"name": "Ada of Bytewood",
"class": "debugger",
"hp": 42,
"xp": 120
}
]
}

Open and run this endpoint

What you can practise here
- Load a save, write it back after another client has written a newer one, and read the conflict.
- Accept the same quest twice and see how the API responds.
- Roll loot from a table and confirm the response shape against your contract test.
- Create a hero with an invalid class and read the validation error.

heroes
pixel adventurers
GET /retro/v1/heroes — List pixel heroes · Responds with 200 Link to this endpoint
POST /retro/v1/heroes — Create a hero (requires Bearer auth) · Responds with 201 400 Link to this endpoint

quests
bugs disguised as monsters
GET /retro/v1/quests — List quests by status · Responds with 200 Link to this endpoint
POST /retro/v1/quests/{id}/accept — Accept a quest (409 if already accepted) (requires Bearer auth) · Responds with 200 409 Link to this endpoint
POST /retro/v1/quests/{id}/complete — Complete an active quest (requires Bearer auth) · Responds with 200 409 Link to this endpoint

Related APIs
- Friends API — Characters, episodes & quotes from the coffee-house gang.
- Movies API — QA-themed cinema. Sort, filter, rate.
- Harry Potter API — Houses, students & spells from a magic school.
- Star Wars API — Characters, planets & starships from a galaxy far away.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/storage
TITLE: Object Storage API — Mock REST API, 4 endpoints | Fun API
================================================================

Object Storage API — free mock REST API for testing

Practice object metadata, base64 content, checksums, Range requests and resumable upload state.

The Object Storage API is a small S3-shaped surface: PUT an object, GET it back, and verify it. It is the only place in the catalog that serves HTTP 206 Partial Content for a Range request and 416 when that range cannot be satisfied — plus checksum validation and resumable uploads, the three things object-storage clients get wrong most often.

Base URL: https://funapi.dev/api/storage/v1 · 4 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/storage/v1/objects — List stored objects. No token, no signup:

curl -i https://funapi.dev/api/storage/v1/objects

answers 200 OK with:

{
"total": 0,
"data": []
}

Open and run this endpoint

What you can practise here
- Request a byte range and read the 206 together with its Content-Range header.
- Ask for a range past the end of the object and handle the 416.
- Upload with a deliberately wrong checksum and confirm the object is rejected, not silently stored.
- Start a resumable upload, interrupt it, and resume from the offset the API reports.

objects
stored test files
GET /storage/v1/objects — List stored objects · Responds with 200 Link to this endpoint
PUT /storage/v1/objects/{key} — Upload a base64 object with checksum (requires Bearer auth) · Responds with 201 412 422 Link to this endpoint
GET /storage/v1/objects/{key} — Download object metadata/content; accepts Range · Responds with 200 206 416 Link to this endpoint
DELETE /storage/v1/objects/{key} — Delete an object (requires Bearer auth) · Responds with 204 404 Link to this endpoint

uploads
resumable sessions

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/identity
TITLE: Modern Identity API — Mock REST API, 6 endpoints | Fun API
================================================================

Modern Identity API — free mock REST API for testing

A modern identity lab complementing the OAuth playground with OIDC discovery, PKCE, device authorization, introspection and revocation.

The Modern Identity API implements the parts of OpenID Connect that clients actually integrate against: a discovery document, PKCE, the device authorization flow and the full token lifecycle. If you are testing a login that runs on a TV, a CLI or anything without a browser redirect, the device-code flow here behaves like the real thing.

Base URL: https://funapi.dev/api/identity/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/identity/v1/.well-known/openid-configuration — OIDC discovery document. No token, no signup:

curl -i https://funapi.dev/api/identity/v1/.well-known/openid-configuration

answers 200 OK with:

{
"issuer": "https://funapi.dev/api/identity/v1",
"authorization_endpoint": "https://funapi.dev/api/identity/v1/authorize",
"token_endpoint": "https://funapi.dev/api/identity/v1/token",
"jwks_uri": "https://funapi.dev/api/identity/v1/jwks",
"code_challenge_methods_supported": [
"S256"
],
"scopes_supported": [
"openid",
"profile",
"email",
"offline_access"
]
}

Open and run this endpoint

What you can practise here
- Fetch the discovery document and drive the rest of the flow from its advertised endpoints rather than hardcoded URLs.
- Complete an authorization-code exchange with PKCE, then retry with the wrong code_verifier and read the rejection.
- Run the device-code flow and poll while it is pending until it is authorized.
- Introspect a token, revoke it, and confirm the next introspection reports it inactive.

discovery
provider metadata
GET /identity/v1/.well-known/openid-configuration — OIDC discovery document · Responds with 200 Link to this endpoint
GET /identity/v1/jwks — Demo JSON Web Key Set · Responds with 200 Link to this endpoint

tokens
PKCE and lifecycle
POST /identity/v1/authorize — Issue an authorization code with real PKCE (S256) · Responds with 200 400 Link to this endpoint
POST /identity/v1/token — Exchange a PKCE code for scoped tokens — verifies BASE64URL(SHA256(codeVerifier)) against the stored codeChallenge · Responds with 200 400 Link to this endpoint
POST /identity/v1/introspect — Introspect an access token · Responds with 200 Link to this endpoint
POST /identity/v1/revoke — Revoke an access token · Responds with 204 Link to this endpoint

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Object Storage API — Objects, checksums, ranges & resumable uploads.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/streams
TITLE: Event Streams API — Mock REST API, 3 endpoints | Fun API
================================================================

Event Streams API — free mock REST API for testing

Practice event-stream consumers, Last-Event-ID resume behavior, duplicates and out-of-order detection.

The Event Streams API serves Server-Sent Events with replay cursors, heartbeats and guaranteed ordering. Streaming is where test suites usually stop, because a long-lived response is awkward to assert on — this one is built to make that assertable, with a Last-Event-ID cursor you can reconnect from.

Base URL: https://funapi.dev/api/streams/v1 · 3 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/streams/v1/events — Read events as JSON or text/event-stream. No token, no signup:

curl -i https://funapi.dev/api/streams/v1/events

answers 200 OK with:

{
"total": 12,
"data": [
{
"id": 1,
"type": "lap.completed",
"lap": 1,
"position": 1
},
{
"id": 2,
"type": "lap.completed",
"lap": 2,
"position": 2
},
{
"id": 3,
"type": "lap.completed",
"lap": 3,
"position": 3
},
{
"id": 4,
"type": "lap.completed",
"lap": 4,
"position": 4
},
{
"id": 5,
"type": "lap.completed",
"lap": 5,
"position": 1
},
{
"id": 6,
"type": "lap.completed",
"lap": 6,
"position": 2
},
{
"id": 7,
"type": "lap.completed",
"lap": 7,
"position": 3
},
{
"id": 8,
"type": "lap.completed",
"lap": 8,
"position": 4
},
{
"id": 9,
"type": "lap.completed",
"lap": 9,
"position": 1
},
{
"id": 10,
"type": "lap.completed",
"lap": 10,
"position": 2
},
{
"id": 11,
"type": "lap.completed",
"lap": 11,
"position": 3
},
{
"id": 12,

(truncated — the full response comes back when you run it)

Open and run this endpoint

What you can practise here
- Open the stream, drop the connection, and reconnect with Last-Event-ID to confirm no event was lost.
- Assert that events arrive in order under a burst rather than only at rest.
- Watch the heartbeat and set your idle timeout above it, not below.
- Publish an event and check how quickly it appears to a connected consumer.

events
stream and replay
GET /streams/v1/events — Read events as JSON or text/event-stream · Responds with 200 Link to this endpoint
GET /streams/v1/events/{id} — Replay one event by id · Responds with 200 404 Link to this endpoint
POST /streams/v1/events — Publish a custom event (requires Bearer auth) · Responds with 202 Link to this endpoint

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Object Storage API — Objects, checksums, ranges & resumable uploads.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/faults
TITLE: Fault Injection API — Mock REST API, 4 endpoints | Fun API
================================================================

Fault Injection API — free mock REST API for testing

Configure deterministic network and server failures inside your isolated sandbox.

The Fault Injection API turns failure into a setting. Configure a target — latency, a status code, a malformed body, or a flaky success rate — then call it and get exactly that. It is the catalog's tool for testing resilience deliberately instead of waiting for production to supply the outage.

Base URL: https://funapi.dev/api/faults/v1 · 4 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/faults/v1/config — Read fault profile. No token, no signup:

curl -i https://funapi.dev/api/faults/v1/config

answers 200 OK with:

{
"latencyMs": 0,
"status": 200,
"malformed": false,
"failureRate": 0
}

Open and run this endpoint

What you can practise here
- Set a 50% failure rate and check that your retry policy converges instead of amplifying the load.
- Inject a malformed JSON body and confirm your client reports a parse error rather than crashing.
- Inject latency just above your timeout, then just below, and verify the boundary behaves as designed.
- Configure a 503 with Retry-After and check your backoff honours the header instead of guessing.

control
fault profile
GET /faults/v1/config — Read fault profile · Responds with 200 Link to this endpoint
PUT /faults/v1/config — Configure fault profile (requires Bearer auth) · Responds with 200 422 Link to this endpoint
DELETE /faults/v1/config — Reset fault profile (requires Bearer auth) · Responds with 204 Link to this endpoint

target
endpoint under test
GET /faults/v1/target — Call the configured flaky target · Responds with 200 500 503 Link to this endpoint

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Object Storage API — Objects, checksums, ranges & resumable uploads.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/searchlab
TITLE: Search & Facets API — Mock REST API, 2 endpoints | Fun API
================================================================

Search & Facets API — free mock REST API for testing

A compact search engine lab with category facets, score sorting, highlights and cursor pagination.

The Search & Facets API is a query surface rather than a CRUD one: full-text search with facet counts, highlighted snippets and cursor pagination. Two endpoints, but the response is the most structurally complex in the catalog — the right target for a contract test that has to survive a nested, variable-shaped payload.

Base URL: https://funapi.dev/api/search/v1 · 2 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/search/v1/items — Search items with facets and cursor. No token, no signup:

curl -i https://funapi.dev/api/search/v1/items

answers 200 OK with:

{
"total": 4,
"data": [
{
"id": 1,
"title": "Moon Pizza",
"category": "food",
"tags": [
"space",
"cheese"
],
"score": 9.1,
"highlight": "Moon Pizza"
},
{
"id": 2,
"title": "Dragon Debugger",
"category": "tools",
"tags": [
"fantasy",
"code"
],
"score": 8.7,
"highlight": "Dragon Debugger"
},
{
"id": 3,
"title": "Pocket Monster Manual",
"category": "books",
"tags": [
"creatures",
"training"
],
"score": 8.3,
"highlight": "Pocket Monster Manual"
},
{
"id": 4,
"title": "Wizard Wireless",
"category": "tools",
"tags": [
"magic",
"network"
],
"score": 7.9,
"highlight": "Wizard Wireless"
}
],
"facets": {
"category": [
{
"value": "food",
"count": 1
},
{
"value": "tools",
"count": 2
},
{
"value": "books",
"count": 1
}
]
},

(truncated — the full response comes back when you run it)

Open and run this endpoint

What you can practise here
- Run a query and assert on facet counts as well as hits, since the two can disagree when filters are applied.
- Page through results by cursor and confirm nothing is duplicated or skipped between pages.
- Send a malformed query expression and read the 400.
- Search for a term with no matches and confirm the empty result is a 200.

search
query and discover
GET /search/v1/items — Search items with facets and cursor · Responds with 200 400 Link to this endpoint
GET /search/v1/suggest — Autocomplete suggestions · Responds with 200 Link to this endpoint

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Object Storage API — Objects, checksums, ranges & resumable uploads.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/docs/datagen
TITLE: Fun Data Bridge API — Mock REST API, 4 endpoints | Fun API
================================================================

Fun Data Bridge API — free mock REST API for testing

Generate small deterministic JSON fixtures using fundata-style schemas, then reuse them in API tests.

The Fun Data Bridge generates seeded fixtures from a schema you supply — the same idea as the sibling site fundata.dev, exposed as an API. Given the same seed it returns the same data, which is what makes it usable as a fixture source for tests that must be deterministic rather than merely realistic.

Base URL: https://funapi.dev/api/data/v1 · 4 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/data/v1/types — List supported field types. No token, no signup:

curl -i https://funapi.dev/api/data/v1/types

answers 200 OK with:

{
"data": [
"row",
"integer",
"boolean",
"email",
"uuid",
"name",
"date",
"string"
]
}

Open and run this endpoint

What you can practise here
- Generate with a fixed seed twice and confirm the output is byte-identical, then change the seed and confirm it is not.
- Post a schema with an unsupported field type and read the 422.
- Request a large batch and follow the 202 to the finished result.
- Feed the generated fixtures straight into another API in the catalog as request bodies.

generate
schemas and fixtures
GET /data/v1/types — List supported field types · Responds with 200 Link to this endpoint
POST /data/v1/generate — Generate deterministic JSON rows · Responds with 200 422 Link to this endpoint
POST /data/v1/jobs — Queue a large fixture job (requires Bearer auth) · Responds with 202 422 Link to this endpoint
GET /data/v1/jobs/{id} — Poll fixture job · Responds with 200 404 Link to this endpoint

Related APIs
- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
- Object Storage API — Objects, checksums, ranges & resumable uploads.

All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/category/fandom
TITLE: Fandom & Pop Culture — Mock REST APIs | Fun API Playground
================================================================

Fandom & Pop Culture

Unfamiliar test data costs attention: every assertion needs you to remember what the record was supposed to contain. These APIs borrow worlds you already carry in your head, which leaves the whole of your attention for the part you are actually practising — the requests, the status codes and the headers.

The trade is deliberate. A mock API built on invoice line items makes you hold two unfamiliar things at once — the domain and the protocol — and the domain always wins, because it is the one you have to reason about to know whether the response was right. Borrowing a world you already know collapses that to one.
Start wherever the data is most familiar to you and work outward: list a collection, page through it, filter it, fetch one item, ask for one that does not exist. By the time the shape of the responses is boring, you are ready for the parts that are not — auth, conflicts, concurrency and the error codes each of these APIs is wired to produce on demand.

17 APIs in this category

- Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints)
- Movies API — QA-themed cinema. Sort, filter, rate. (9 endpoints)
- Harry Potter API — Houses, students & spells from a magic school. (10 endpoints)
- Star Wars API — Characters, planets & starships from a galaxy far away. (11 endpoints)
- Sherlock Holmes API — Cases, suspects & clues from Baker Street. (10 endpoints)
- Pokémon API — Creatures, trainers & simulated battles. (10 endpoints)
- Middle-earth API — Fellowship, quests & artifacts from a fantasy realm. (9 endpoints)
- The Office API — Employees, pranks & quotes from a paper company. (8 endpoints)
- Marvel API — Avengers, villains & mission assignments. (10 endpoints)
- Game of Thrones API — Houses, nobles & dragons of Westeros. (12 endpoints)
- Rick and Morty API — Characters, locations & episodes across the multiverse. (9 endpoints)
- Starfleet API — Ships, warp limits & exponentially multiplying tribbles. (10 endpoints)
- GTA API — Characters, vehicles, weapons, missions, heists, a wanted system & radio stations across Los Santos, Vice City and Liberty City. (17 endpoints)
- Dragon Ball API — Fighters, transformations, power levels & tournaments. (6 endpoints)
- Voxel Worlds API — Block worlds, players, inventories & coordinates. (6 endpoints)
- Anime Tournament API — Original fighters, power levels & tournament brackets. (5 endpoints)
- Retro Quest API — Pixel heroes, quests, loot & save-game conflicts. (5 endpoints)

Other categories

- Everyday Life — 10 APIs
- Original Worlds — 3 APIs
- Testing Scenarios — 9 APIs

All 39 mock REST APIs · Testing techniques

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/category/everyday-life
TITLE: Everyday Life — Mock REST APIs | Fun API Playground
================================================================

Everyday Life

These are the shapes most real integrations take: a cart whose stock runs out mid-checkout, a seat two people book at once, a transfer that would overdraw an account. Each one is small enough to hold in your head and strict enough that the interesting failures are reachable.

What makes these worth practising against is that the rules push back. A pizza that has been delivered cannot be cancelled; a seat that is taken cannot be booked twice; a transfer larger than the balance is refused rather than quietly allowed. Every one of those is a conflict your client has to handle, and none of them can be provoked against an API that only ever says yes.
They are also the closest thing here to the integrations you will actually be paid to test. If you want to rehearse a specific failure before production supplies it — a duplicate charge, an overbooked flight, a coupon that expired between the cart and the checkout — this is the group to reach for.

10 APIs in this category

- Pizza Orders API — Place & track orders. Includes a guaranteed 500. (9 endpoints)
- Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints)
- Football API — Teams, squads, standings & simulated matches. (7 endpoints)
- Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints)
- Airline API — Flights, seat conflicts & overbooking drama. (9 endpoints)
- Shop API — Carts, stock drama & expired coupons. (9 endpoints)
- Cargo Tracking API — Shipment state machines. Writes need an X-API-Key. (9 endpoints)
- World Cup 2026 API — Teams, groups, venues, match simulation, tickets & bracket predictions across the 2026 host cities. (17 endpoints)
- FIBA World Cup API — Teams, Doha arenas, quarter-by-quarter game simulation, box scores, coach challenges, cursor-paged play-by-play & ticketing. (22 endpoints)
- Formula 1 API — Drivers, constructors, races, telemetry & pit stops. (7 endpoints)

Other categories

- Fandom & Pop Culture — 17 APIs
- Original Worlds — 3 APIs
- Testing Scenarios — 9 APIs

All 39 mock REST APIs · Testing techniques

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/category/original-worlds
TITLE: Original Worlds — Mock REST APIs | Fun API Playground
================================================================

Original Worlds

Original settings, built around a constraint rather than a licence: enclosures with capacity and compatibility rules, probes that answer slowly enough to make your timeouts matter, nested resources deep enough to make URL construction a real question.

Borrowing a world means borrowing its rules, and real worlds are rarely strict enough to be interesting. These are invented so the constraints can be: an enclosure that will not take another dinosaur, a probe whose round trip is slow enough that your timeout configuration becomes a real decision, a resource tree deep enough that building the URL is itself part of the exercise.
They are the best group here for the awkward parts of REST — nested resources, capacity limits, state machines that refuse a transition, and endpoints that deliberately take long enough to expose a client with no deadline of its own.

3 APIs in this category

- Superhero API — Heroes, powers & nemeses. Great for nested resources. (6 endpoints)
- Dino Park API — Dinosaurs, enclosures & the occasional breach. (9 endpoints)
- Space Agency API — Launches, scrubs & probes with real signal lag. (9 endpoints)

Other categories

- Fandom & Pop Culture — 17 APIs
- Everyday Life — 10 APIs
- Testing Scenarios — 9 APIs

All 39 mock REST APIs · Testing techniques

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/category/testing-scenarios
TITLE: Testing Scenarios — Mock REST APIs | Fun API Playground
================================================================

Testing Scenarios

No theme, no story: each of these exists to make one testing technique reachable. Real OAuth tokens that really expire, HMAC-signed webhook deliveries you can replay, a fault injector that fails on request, and a protocol bench covering the parts of HTTP that mock APIs usually skip.

Everything else in the catalog wraps a technique in a theme. These do not: each one exists so that a specific mechanism is reachable in isolation, with nothing else in the way. The auth playground issues real signed JWTs and runs real OAuth flows; the webhook API signs its deliveries with an HMAC you can verify or deliberately fail; the protocol bench covers redirects, content negotiation, JSON Patch, ranges and conditional requests.
If you arrived here from a specific problem — a token that expires mid-suite, a signature that will not verify, a redirect chain your client follows too far — this is the group that has an endpoint for it.

9 APIs in this category

- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. (6 endpoints)
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints)
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints)
- Object Storage API — Objects, checksums, ranges & resumable uploads. (4 endpoints)
- Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. (6 endpoints)
- Event Streams API — SSE events, replay cursors, heartbeats & ordering. (3 endpoints)
- Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (4 endpoints)
- Search & Facets API — Full-text queries, facets, highlights & cursor pagination. (2 endpoints)
- Fun Data Bridge API — Seeded fixtures from schemas, inspired by fundata.dev. (4 endpoints)

Other categories

- Fandom & Pop Culture — 17 APIs
- Everyday Life — 10 APIs
- Original Worlds — 3 APIs

All 39 mock REST APIs · Testing techniques

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/pagination
TITLE: Pagination testing — mock API examples | Fun API Playground
================================================================

Testing pagination against a real API

Pagination looks trivial until a page boundary lands in the middle of a record set that is still being written to. The APIs below implement both common styles — page numbers with a total, and opaque cursors — so you can write a client against each and find out which assumptions your code is making.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- Walk every page of a collection and assert that the number of records you collected equals the total the API reported.
- Request a page past the end of the collection. Some APIs answer with an empty list and a 200; the Friends API answers 404. Both are defensible, and your client has to handle whichever it meets.
- Check the last page: it is almost always partially full, and off-by-one errors hide there.
- Walk the Bank API by cursor and confirm no record is skipped or repeated — the failure mode cursors are supposed to prevent.
- Combine pagination with a filter and verify the counts still agree.

APIs to try it on

- Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints)
- Star Wars API — Characters, planets & starships from a galaxy far away. (11 endpoints)
- Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints)
- Search & Facets API — Full-text queries, facets, highlights & cursor pagination. (2 endpoints)

Status codes involved

- 200 OK
- 400 Bad Request
- 404 Not Found

Other techniques

- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/rate-limiting
TITLE: Rate limit testing — mock API examples | Fun API Playground
================================================================

Testing rate limits, 429s and backoff

Almost nobody tests rate limiting, because a well-behaved API will not rate limit you on demand — and so the retry policy that turns a slowdown into an outage ships untested. The Coffee Shop API enforces a genuine quota over a live window, so you can exceed it deliberately and watch it reopen.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- Send requests until you get a 429, then read Retry-After and wait exactly that long before retrying.
- Read X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset on successful calls and throttle from them, rather than waiting to be refused.
- Verify your retry policy applies backoff and a ceiling — an immediate retry loop on a 429 is indistinguishable from an attack.
- Check that a 429 is not counted as a permanent failure in your circuit breaker.
- Use the Fault Injection API to combine a rate limit with intermittent 503s and see whether your client still converges.

APIs to try it on

- Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints)
- Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (4 endpoints)

Status codes involved

- 429 Too Many Requests
- 503 Service Unavailable

Other techniques

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/idempotency
TITLE: Idempotency key testing — mock API examples | Fun API
================================================================

Testing idempotency keys and safe retries

A POST that times out is the hardest case in client design: the request may have succeeded, and you cannot tell. Idempotency keys resolve it by making the retry safe. The APIs below accept an Idempotency-Key header and replay the original response rather than performing the work again.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- Create a resource with an Idempotency-Key, then send the identical request again and confirm you get the original response — same id, same body.
- Change the body but keep the key, and see how the API reports the mismatch.
- Send the same body with a different key and confirm you get two distinct resources, which is the correct behaviour.
- Transfer money on the Bank API with a repeated key and verify the balance moved exactly once.
- Combine with the Fault Injection API: inject a timeout, retry with the same key, and check the end state is correct.

APIs to try it on

- Friends API — Characters, episodes & quotes from the coffee-house gang. (14 endpoints)
- Bank API — Accounts, transfers & cursor pagination. Home of the 402. (9 endpoints)
- Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (4 endpoints)

Status codes involved

- 200 OK
- 201 Created
- 409 Conflict

Other techniques

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/optimistic-concurrency
TITLE: ETag and If-Match testing — mock API examples | Fun API
================================================================

Testing optimistic concurrency with ETag and If-Match

Lost updates are the quietest bug in any CRUD application: two clients read the same record, both write, and the second silently discards the first one's work. Optimistic concurrency turns that into a 412 you can handle. Most of the catalog supports it, so you can rehearse both the happy path and the conflict.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- GET a resource and keep its ETag, then PUT it back with If-Match and watch it succeed.
- Have a second request modify the resource, then retry the first PUT with the now-stale ETag and collect the 412.
- Write without an If-Match header at all and notice that nothing stops you — which is the bug this whole mechanism exists to prevent.
- Combine with a conditional GET: send If-None-Match and confirm the 304 when nothing has changed.
- Try the Retro Quest save-conflict endpoints, where the same idea is modelled as save-game versions.

APIs to try it on

- Football API — Teams, squads, standings & simulated matches. (7 endpoints)
- Harry Potter API — Houses, students & spells from a magic school. (10 endpoints)
- Game of Thrones API — Houses, nobles & dragons of Westeros. (12 endpoints)
- Retro Quest API — Pixel heroes, quests, loot & save-game conflicts. (5 endpoints)

Status codes involved

- 304 Not Modified
- 412 Precondition Failed

Other techniques

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/webhook-signatures
TITLE: Webhook signature testing — mock API examples | Fun API
================================================================

Testing webhooks and HMAC signature verification

Webhook receivers are public endpoints that act on data from outside, which makes signature verification the only thing between you and anyone who knows your URL. The Webhooks API signs every delivery with an HMAC and keeps a delivery log you can inspect and replay, so you can test the verifier rather than trusting it.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- Register a subscription, trigger an event, and verify the signature against the shared secret before doing anything with the body.
- Change one byte of the payload and confirm verification fails.
- Replay a stored delivery and check your receiver is idempotent instead of processing it twice.
- Check that your comparison is constant-time — a naive string equality leaks the signature a byte at a time.
- Inspect the delivery log to see exactly which headers arrived, rather than the ones you assumed would.

APIs to try it on

- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints)
- Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (4 endpoints)

Status codes involved

- 200 OK
- 201 Created
- 401 Unauthorized
- 409 Conflict

Other techniques

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/auth-tokens
TITLE: OAuth and JWT testing — mock API examples | Fun API
================================================================

Testing OAuth 2.0, JWTs and token expiry

Most auth testing stops at "a valid token works, an invalid one does not", which leaves the interesting half untested: the token that was valid when the request started and expired before it finished. The APIs below issue genuinely signed, genuinely short-lived tokens, so refresh and expiry are things that actually happen.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- Complete the client-credentials flow and call a protected endpoint with the token you were issued.
- Wait for a short-lived token to expire and confirm your client refreshes transparently instead of failing the user's request.
- Exchange a refresh token, then attempt to reuse the old one and read the rejection.
- Run the authorization-code flow with PKCE, then retry with the wrong code_verifier.
- Drive the device-code flow end to end — the one that matters for CLIs and TVs, and the one nobody tests.
- Send a well-formed but wrongly-signed JWT and confirm it is refused as firmly as a missing one.

APIs to try it on

- Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. (6 endpoints)
- Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints)
- Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. (6 endpoints)

Status codes involved

- 200 OK
- 400 Bad Request
- 401 Unauthorized
- 403 Forbidden

Other techniques

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/negative-testing
TITLE: Negative testing — mock API examples | Fun API Playground
================================================================

Negative testing: every error code on demand

A test suite that only covers the happy path is testing the case that was never going to break. The catalog is built so every error is reachable on purpose: a guaranteed 500, a real rate limit, a teapot, and a fault injector that produces whatever you configure.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- Call the Pizza oven endpoint for a reliable 500 and verify your client retries, falls back, or reports it — but does not hang.
- Use the Fault Injection API to set a status code, a latency and a failure rate, then run your suite against it.
- Separate 400 from 422: one means the request was unreadable, the other that it was understood and refused.
- Separate 401 from 403, and 404 from 410. Each pair is routinely collapsed, and each collapse hides a real bug.
- Inject a malformed body and confirm your client reports a parse error rather than crashing.

APIs to try it on

- Pizza Orders API — Place & track orders. Includes a guaranteed 500. (9 endpoints)
- Coffee Shop API — Drinks & orders. Home of the legendary 418. (6 endpoints)
- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints)
- Fault Injection API — Latency, status codes, malformed payloads & flaky responses. (4 endpoints)

Status codes involved

- 400 Bad Request
- 401 Unauthorized
- 403 Forbidden
- 404 Not Found
- 418 I'm a Teapot
- 422 Unprocessable Content
- 429 Too Many Requests
- 500 Internal Server Error
- 503 Service Unavailable

Other techniques

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/testing/async-jobs
TITLE: Async job testing — mock API examples | Fun API Playground
================================================================

Testing 202 Accepted and async job polling

202 Accepted is the status clients mishandle most, because it is a success response for work that has not happened. The Protocol Lab models the full pattern: submit, receive a 202 with a status URL, poll until the job resolves, and handle the job that fails rather than completes.

Real endpoints from the catalog — every request above is served, and every status code shown is one that endpoint actually returns.

How to practise it

- Submit a job, read the Location header from the 202, and poll it rather than assuming the work is done.
- Poll with a sensible interval and a ceiling — a tight loop against a job that never finishes is its own outage.
- Handle the job that completes with a failure: the poll succeeded, the work did not.
- Check what your client does when the job outlives your overall timeout.
- Combine with the 503 and 504 endpoints to see polling behave under an unreliable upstream.

APIs to try it on

- Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation. (12 endpoints)
- Event Streams API — SSE events, replay cursors, heartbeats & ordering. (3 endpoints)
- Fun Data Bridge API — Seeded fixtures from schemas, inspired by fundata.dev. (4 endpoints)

Status codes involved

- 202 Accepted
- 200 OK
- 503 Service Unavailable
- 504 Gateway Timeout

Other techniques

- Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
- Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
- Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
- ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
- Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
- OAuth and JWT testing — Run real client-credentials, authorization-code and device-code flows, then test what your client does when the token expires mid-session.
- Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/200
TITLE: HTTP 200 OK — Live Example | Fun API Playground
================================================================

HTTP 200 OK

The request succeeded and the response carries the representation you asked for. For a GET this is the body; for a PUT or POST it is the result of the operation.

Defined in RFC 9110 §15.3.1 — 200 OK · MDN reference

On this page
- Where you meet HTTP 200 in production
- Why you would test it
- What your client should do about a 200
- 200 versus the codes it gets confused with
- Endpoints that return 200
- Questions about HTTP 200
- Other success codes

Where you meet HTTP 200 in production
The default answer to a successful GET, and to a PUT or POST whose result is returned inline. It is the code you will see most and inspect least.

Why you would test it

Worth asserting on more carefully than most suites do: a 200 with the wrong body, a stale representation or a missing header is still a 200, and a status-only assertion will pass it.

What your client should do about a 200
Do not stop at the status line. Validate the body against a schema, check the content type is what you asked for, and confirm any caching headers you rely on are present. A 200 carrying an error object in the body is a real and common API design, and a status-only assertion sails straight past it.

200 versus the codes it gets confused with
- 200 vs 201 Created — Use 201 when the request created a new resource. A POST that answers 200 with a body is saying "here is a result", not "here is a thing that now exists at a URL".
- 200 vs 204 No Content — 204 is the same success with a deliberately empty body. If your handler always parses JSON, the two are not interchangeable.

Endpoints that return 200

259 endpoints in this playground answer with 200. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/friends/v1/characters — Paginated character list, with Deprecation/Sunset/Link headers pointing at v2 (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/characters/{id} — The character (Friends API) Open & run this endpoint
- PUT https://funapi.dev/api/friends/v1/characters/{id} — Updated (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters/bulk-delete — All ids existed and were deleted (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/episodes — Episode list (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/quotes/random — One random quote (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/characters/{id}/quotes — Matching quotes (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v2/characters — v2 shape: { apiVersion, data: { items, count } }, occupation replaces job (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/version — Current, supported and deprecated versions (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/characters — Shape depends on negotiated version (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/graphql — GraphQL convention: always 200, with data and/or an errors array (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/superheroes/v1/heroes — Paginated hero list (Superhero API) Open & run this endpoint
- GET https://funapi.dev/api/superheroes/v1/heroes/{id} — The hero (Superhero API) Open & run this endpoint
- GET https://funapi.dev/api/superheroes/v1/heroes/{id}/nemesis — The nemesis (Superhero API) Open & run this endpoint
- GET https://funapi.dev/api/pizza/v1/menu — The menu (Pizza Orders API) Open & run this endpoint
- GET https://funapi.dev/api/pizza/v1/orders/{id} — The order (Pizza Orders API) Open & run this endpoint
- PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Updated (Pizza Orders API) Open & run this endpoint
- PATCH https://funapi.dev/api/pizza/v1/orders/{id} — Updated (Pizza Orders API) Open & run this endpoint
- GET https://funapi.dev/api/pizza/v1/oven/preheat — Preheated, after a deliberate ~3s delay (Pizza Orders API) Open & run this endpoint
- GET https://funapi.dev/api/coffee/v1/drinks — Drink list (Coffee Shop API) Open & run this endpoint
- GET https://funapi.dev/api/coffee/v1/drinks/{id} — The drink (Coffee Shop API) Open & run this endpoint
- GET https://funapi.dev/api/coffee/v1/rush-hour — Got a spot in line (Coffee Shop API) Open & run this endpoint
- PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — Marked ready (Coffee Shop API) Open & run this endpoint
- GET https://funapi.dev/api/football/v1/teams — Paginated team list (Football API) Open & run this endpoint
- GET https://funapi.dev/api/football/v1/teams/{id} — The team (Football API) Open & run this endpoint

…and 234 more endpoints across the catalog.

Questions about HTTP 200
- Can a 200 response contain an error?: Yes, and plenty of APIs do it — a 200 wrapping {"error": …} is common in older SOAP-influenced designs and in some GraphQL setups. It is why an assertion on status alone is weaker than it looks.
- Should a POST return 200 or 201?: 201 if it created a resource you can address with a URL, 200 if it performed an action and is reporting the outcome.

Other success codes

- 201 Created
- 202 Accepted
- 204 No Content
- 206 Partial Content
- 207 Multi-Status

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/201
TITLE: HTTP 201 Created — Live Example | Fun API Playground
================================================================

HTTP 201 Created

A new resource exists as a result of this request. A well-behaved API also sends a Location header pointing at it, and usually the created representation as the body.

Defined in RFC 9110 §15.3.2 — 201 Created · MDN reference

On this page
- Where you meet HTTP 201 in production
- Why you would test it
- What your client should do about a 201
- 201 versus the codes it gets confused with
- Endpoints that return 201
- Questions about HTTP 201
- Other success codes

Where you meet HTTP 201 in production
Sign-ups, orders, uploads, bookings, comments — anything where a POST leaves something behind that has an address of its own afterwards, and where the caller will very likely want to fetch or modify it a moment later.

Why you would test it

Check the Location header, not just the status — clients that build the follow-up URL themselves break the first time the server changes its id scheme.

What your client should do about a 201
Read the Location header and follow it rather than assembling the URL yourself from the id in the body. Servers change id schemes; clients that guess break on the day they do. Where the body carries the created representation, use it instead of an immediate re-fetch.

201 versus the codes it gets confused with
- 201 vs 202 Accepted — 202 means the resource does not exist yet — the work is queued. 201 means it exists now.
- 201 vs 200 OK — A 200 says the request succeeded. A 201 says it succeeded and something new is now addressable.

Endpoints that return 201

44 endpoints in this playground answer with 201. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/friends/v1/characters — Created (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters/bulk — All items created (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/superheroes/v1/heroes — Created (Superhero API) Open & run this endpoint
- POST https://funapi.dev/api/superheroes/v1/heroes/versus — Fight resolved, random winner (Superhero API) Open & run this endpoint
- POST https://funapi.dev/api/pizza/v1/orders — Order placed (Pizza Orders API) Open & run this endpoint
- POST https://funapi.dev/api/coffee/v1/orders — Order placed (Coffee Shop API) Open & run this endpoint
- POST https://funapi.dev/api/football/v1/matches — Match played, random score (Football API) Open & run this endpoint
- POST https://funapi.dev/api/movies/v1/movies — Created (Movies API) Open & run this endpoint
- POST https://funapi.dev/api/movies/v1/movies/{id}/poster — Uploaded (Movies API) Open & run this endpoint
- POST https://funapi.dev/api/wizarding/v1/students — Enrolled (Harry Potter API) Open & run this endpoint
- POST https://funapi.dev/api/galaxy/v1/characters — Created (Star Wars API) Open & run this endpoint
- POST https://funapi.dev/api/holmes/v1/suspects — Created (Sherlock Holmes API) Open & run this endpoint
- POST https://funapi.dev/api/pokemon/v1/pokemon — Created (Pokémon API) Open & run this endpoint
- POST https://funapi.dev/api/pokemon/v1/battles — Battle resolved, random winner (Pokémon API) Open & run this endpoint
- POST https://funapi.dev/api/middleearth/v1/fellowship — Recruited (Middle-earth API) Open & run this endpoint
- POST https://funapi.dev/api/webhooks/v1/subscriptions — Registered, includes a signingSecret (Webhooks API) Open & run this endpoint
- POST https://funapi.dev/api/webhooks/v1/trigger — Delivered to one or more subscriptions (Webhooks API) Open & run this endpoint
- POST https://funapi.dev/api/office/v1/employees — Hired (The Office API) Open & run this endpoint
- POST https://funapi.dev/api/dinopark/v1/dinosaurs — Created (Dino Park API) Open & run this endpoint
- POST https://funapi.dev/api/dinopark/v1/incidents/breach — Incident logged (Dino Park API) Open & run this endpoint
- POST https://funapi.dev/api/marvel/v1/heroes — Recruited (Marvel API) Open & run this endpoint
- POST https://funapi.dev/api/marvel/v1/missions — Mission created (Marvel API) Open & run this endpoint
- POST https://funapi.dev/api/got/v1/nobles — Created (Game of Thrones API) Open & run this endpoint
- POST https://funapi.dev/api/got/v1/battles — Battle resolved (Game of Thrones API) Open & run this endpoint
- POST https://funapi.dev/api/rickandmorty/v1/characters — Created (Rick and Morty API) Open & run this endpoint

…and 19 more endpoints across the catalog.

Questions about HTTP 201
- Does a 201 have to include a body?: No. The Location header is the important part; the body is a convenience that saves the client a round trip.
- What if the resource already existed?: Then it was not created. 200 with the existing representation, or 409 if the request was an unambiguous attempt to create a duplicate.

Other success codes

- 200 OK
- 202 Accepted
- 204 No Content
- 206 Partial Content
- 207 Multi-Status

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/202
TITLE: HTTP 202 Accepted — Live Example | Fun API Playground
================================================================

HTTP 202 Accepted

The request was accepted but has not been carried out yet. The work happens asynchronously, and the response tells you where to look for the result.

Defined in RFC 9110 §15.3.3 — 202 Accepted · MDN reference

On this page
- Where you meet HTTP 202 in production
- Why you would test it
- What your client should do about a 202
- 202 versus the codes it gets confused with
- Endpoints that return 202
- Questions about HTTP 202
- Other success codes

Where you meet HTTP 202 in production
Report generation, video transcoding, bulk imports, index rebuilds and payment captures that clear asynchronously — anywhere the real work outlives the request that asked for it and the server refuses to hold the connection open.

Why you would test it

The status your client is most likely to mishandle: it is a success, but the thing you asked for has not happened. Poll the status URL until it resolves instead of assuming completion.

What your client should do about a 202
Treat it as "not yet", never as "done". Take the Location or the job id, poll with backoff, and give the poll a deadline. The most expensive bug in this shape is a test suite that asserts 202 and then asserts on data the job had not written yet — it passes locally and fails in CI, intermittently, forever.

202 versus the codes it gets confused with
- 202 vs 201 Created — 201 means the resource is there. 202 means someone has agreed to make it.
- 202 vs 200 OK — A 200 finishes the story. A 202 hands you a bookmark.

Endpoints that return 202

4 endpoints in this playground answer with 202. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/protocol/v1/jobs — Accepted. Poll the Location header until status is "done". (Protocol Lab API) Open & run this endpoint
- POST https://funapi.dev/api/fiba/v1/games/{id}/highlights — Render job accepted (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/streams/v1/events — Event accepted (Event Streams API) Open & run this endpoint
- POST https://funapi.dev/api/data/v1/jobs — Job accepted (Fun Data Bridge API) Open & run this endpoint

Questions about HTTP 202
- How do I know when the job is finished?: Poll the status URL the 202 gave you until it reports a terminal state. A well-designed API tells you a suggested interval; if it does not, back off exponentially.
- What if the job fails?: The polling endpoint reports the failure — the 202 itself was correct, because the request to start the work really was accepted.

Other success codes

- 200 OK
- 201 Created
- 204 No Content
- 206 Partial Content
- 207 Multi-Status

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/204
TITLE: HTTP 204 No Content — Live Example | Fun API Playground
================================================================

HTTP 204 No Content

The request succeeded and there is deliberately no body. Most commonly the answer to a successful DELETE.

Defined in RFC 9110 §15.3.5 — 204 No Content · MDN reference

On this page
- Where you meet HTTP 204 in production
- Why you would test it
- What your client should do about a 204
- 204 versus the codes it gets confused with
- Endpoints that return 204
- Questions about HTTP 204
- Other success codes

Where you meet HTTP 204 in production
Successful DELETEs, PUTs that do not echo the updated resource back, endpoints whose whole job is a side effect, and preference or settings writes where the client already knows the new state it just sent.

Why you would test it

Clients that call response.json() unconditionally throw here. Testing a 204 path is how you find out that your error handling has a hole in it.

What your client should do about a 204
Do not call .json() unconditionally. Fetch-based clients throw on an empty body, and the throw surfaces as a network-looking error a long way from its cause. Branch on the status, or check content-length, before parsing.

204 versus the codes it gets confused with
- 204 vs 200 OK — Both are success. 204 promises there is nothing to read; 200 promises there is.
- 204 vs 404 Not Found — Deleting something that was already gone is a design decision: 204 (idempotent, the end state is what you asked for) or 404 (there was nothing to delete). Pick one and be consistent.

Endpoints that return 204

23 endpoints in this playground answer with 204. Every one is free, needs no signup, and can be called from the browser or with curl.

- DELETE https://funapi.dev/api/friends/v1/characters/{id} — Deleted, empty body (Friends API) Open & run this endpoint
- DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Retired (Superhero API) Open & run this endpoint
- DELETE https://funapi.dev/api/pizza/v1/orders/{id} — Cancelled (Pizza Orders API) Open & run this endpoint
- DELETE https://funapi.dev/api/football/v1/teams/{id} — Removed (Football API) Open & run this endpoint
- DELETE https://funapi.dev/api/movies/v1/movies/{id} — Removed (Movies API) Open & run this endpoint
- DELETE https://funapi.dev/api/wizarding/v1/students/{id} — Expelled (Harry Potter API) Open & run this endpoint
- DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Removed (Star Wars API) Open & run this endpoint
- DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Cleared (Sherlock Holmes API) Open & run this endpoint
- DELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — Released (Pokémon API) Open & run this endpoint
- DELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — Removed (Middle-earth API) Open & run this endpoint
- DELETE https://funapi.dev/api/webhooks/v1/subscriptions/{id} — Unsubscribed (Webhooks API) Open & run this endpoint
- DELETE https://funapi.dev/api/office/v1/employees/{id} — Fired (The Office API) Open & run this endpoint
- DELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — Relocated (Dino Park API) Open & run this endpoint
- DELETE https://funapi.dev/api/marvel/v1/heroes/{id} — Retired (Marvel API) Open & run this endpoint
- DELETE https://funapi.dev/api/rickandmorty/v1/characters/{id} — Removed (Rick and Morty API) Open & run this endpoint
- DELETE https://funapi.dev/api/airline/v1/bookings/{id} — Cancelled — subsequent GETs return 410 (Airline API) Open & run this endpoint
- DELETE https://funapi.dev/api/protocol/v1/documents/{id} — Deleted — subsequent GETs return 410 (Protocol Lab API) Open & run this endpoint
- DELETE https://funapi.dev/api/starfleet/v1/crew/{id} — Beamed home safely (Starfleet API) Open & run this endpoint
- DELETE https://funapi.dev/api/worldcup/v1/tickets/{id} — Cancelled (World Cup 2026 API) Open & run this endpoint
- DELETE https://funapi.dev/api/fiba/v1/tickets/{id} — Cancelled (FIBA World Cup API) Open & run this endpoint
- DELETE https://funapi.dev/api/storage/v1/objects/{key} — Deleted (Object Storage API) Open & run this endpoint
- POST https://funapi.dev/api/identity/v1/revoke — Revoked or already absent (Modern Identity API) Open & run this endpoint
- DELETE https://funapi.dev/api/faults/v1/config — Reset (Fault Injection API) Open & run this endpoint

Questions about HTTP 204
- Can a 204 have a body?: No. The specification forbids it, and intermediaries may drop it.
- Is DELETE supposed to return 204?: 204 is the common choice. 200 with a body and 202 for a queued delete are both legitimate too.

Other success codes

- 200 OK
- 201 Created
- 202 Accepted
- 206 Partial Content
- 207 Multi-Status

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/206
TITLE: HTTP 206 Partial Content — Live Example | Fun API Playground
================================================================

HTTP 206 Partial Content

The response carries only the byte range you asked for with a Range header, described by Content-Range. This is how resumable downloads and media seeking work.

Defined in RFC 9110 §15.3.7 — 206 Partial Content · MDN reference

On this page
- Where you meet HTTP 206 in production
- Why you would test it
- What your client should do about a 206
- 206 versus the codes it gets confused with
- Endpoints that return 206
- Questions about HTTP 206
- Other success codes

Where you meet HTTP 206 in production
Video and audio scrubbing, resumable downloads, and any client that asks for part of a large file with a Range header.

Why you would test it

Verify the range you receive is the range you requested, and that Content-Range agrees with the body length — off-by-one errors here corrupt files silently.

What your client should do about a 206
Check the Content-Range header against what you asked for rather than assuming the server honoured the exact range. A server may return a different range, or ignore the request and answer 200 with the whole entity — which is legal, and will quietly blow up a client sized for a chunk.

206 versus the codes it gets confused with
- 206 vs 200 OK — A 200 to a ranged request means the server ignored the Range header and sent everything.
- 206 vs 416 Range Not Satisfiable — 416 means the range you asked for lies outside the resource. 206 means it was satisfiable and here it is.

Endpoints that return 206

1 endpoint in this playground answers with 206. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/storage/v1/objects/{key} — Partial content (Object Storage API) Open & run this endpoint

Questions about HTTP 206
- How do I request a partial response?: Send a Range header, e.g. Range: bytes=0-1023. The server answers 206 with Content-Range if it can satisfy it.
- Is 206 cacheable?: Yes, but partial responses interact with caching in subtle ways — validators must match before a cache may combine ranges.

Other success codes

- 200 OK
- 201 Created
- 202 Accepted
- 204 No Content
- 207 Multi-Status

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/207
TITLE: HTTP 207 Multi-Status — Live Example | Fun API Playground
================================================================

HTTP 207 Multi-Status

One response carrying several independent outcomes, for a request that operated on more than one resource. Each element has its own status.

Defined in RFC 4918 §11.1 — 207 Multi-Status · MDN reference

On this page
- Where you meet HTTP 207 in production
- Why you would test it
- What your client should do about a 207
- 207 versus the codes it gets confused with
- Endpoints that return 207
- Questions about HTTP 207
- Other success codes

Where you meet HTTP 207 in production
Bulk endpoints: create fifty records, delete a list of ids, dispatch a batch of messages. One request, many outcomes, and no single status that honestly describes all of them.

Why you would test it

The trap is treating the 207 itself as success. Individual operations inside it may have failed, and only the per-item statuses will tell you.

What your client should do about a 207
The response is the assertion, not the status. Walk the per-item results and count successes and failures explicitly. A client that sees 2xx and moves on will silently drop the items that failed, and nothing downstream will know.

207 versus the codes it gets confused with
- 207 vs 200 OK — A 200 on a batch endpoint claims the whole batch worked. 207 is honest that some of it may not have.
- 207 vs 422 Unprocessable Content — If the whole batch is rejected before anything runs, that is a 400 or 422 — 207 means some of it happened.

Endpoints that return 207

2 endpoints in this playground answer with 207. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/friends/v1/characters/bulk — Partial success — some items failed validation (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Partial success — some ids did not exist (Friends API) Open & run this endpoint

Questions about HTTP 207
- Is 207 a standard status code?: Yes — it comes from WebDAV (RFC 4918) and is widely reused for batch REST endpoints.
- What should the body look like?: An array or map of per-item results, each with its own status and, on failure, its own error.

Other success codes

- 200 OK
- 201 Created
- 202 Accepted
- 204 No Content
- 206 Partial Content

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/301
TITLE: HTTP 301 Moved Permanently — Live Example | Fun API
================================================================

HTTP 301 Moved Permanently

The resource has a new URL, given in the Location header, and clients should use it from now on.

Defined in RFC 9110 §15.4.2 — 301 Moved Permanently · MDN reference

On this page
- Where you meet HTTP 301 in production
- Why you would test it
- What your client should do about a 301
- 301 versus the codes it gets confused with
- Endpoints that return 301
- Questions about HTTP 301
- Other redirection codes

Where you meet HTTP 301 in production
Domain moves, HTTPS upgrades, trailing-slash normalisation, and any URL you want search engines to forget in favour of a new one.

Why you would test it

Check whether your client follows the redirect, and whether it preserves the method and body when it does — many libraries silently turn a redirected POST into a GET.

What your client should do about a 301
Follow the Location header, and update anything you have stored — the whole point of "permanently" is that the old URL should not be requested again. Note that many clients historically rewrite the method to GET when following a 301 after a POST; if the method must be preserved, the server should send 308.

301 versus the codes it gets confused with
- 301 vs 302 Found — 302 is temporary: keep using the original URL. 301 says stop using it.
- 301 vs 308 — 308 is 301 that guarantees the method and body survive the redirect. Use it for anything that is not a GET.

Endpoints that return 301

1 endpoint in this playground answers with 301. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/protocol/v1/moved/old-dashboard — Always. Follow the Location header — real HTTP clients do it automatically. (Protocol Lab API) Open & run this endpoint

Questions about HTTP 301
- Does a 301 pass SEO signals?: Yes — a permanent redirect is the standard way to move ranking signals from an old URL to a new one.
- Will a 301 be cached?: Aggressively, by browsers and intermediaries. That is what makes it hard to undo, and why it should be a considered decision.

Other redirection codes

- 302 Found
- 304 Not Modified

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/302
TITLE: HTTP 302 Found — Live Example | Fun API Playground
================================================================

HTTP 302 Found

The resource is temporarily at a different URL. Unlike a 301, the original URL stays authoritative and should still be used for future requests.

Defined in RFC 9110 §15.4.3 — 302 Found · MDN reference

On this page
- Where you meet HTTP 302 in production
- Why you would test it
- What your client should do about a 302
- 302 versus the codes it gets confused with
- Endpoints that return 302
- Questions about HTTP 302
- Other redirection codes

Where you meet HTTP 302 in production
Post/Redirect/Get after a form submission, load-balancing a caller to a regional host, short-lived redirects to a signed download URL, and login flows that bounce a visitor through an identity provider and back.

Why you would test it

Confirm your client does not cache a 302 as if it were permanent, and that redirect loops are bounded rather than hanging.

What your client should do about a 302
Follow it, but keep the original URL — it is still the canonical address. Cap redirect following at a small number of hops so a redirect loop fails fast instead of hanging. If the method matters, remember that many clients turn the follow-up into a GET.

302 versus the codes it gets confused with
- 302 vs 301 Moved Permanently — 301 is permanent and will be cached. 302 is not.
- 302 vs 307 — 307 is the temporary redirect that preserves the method and body. Where a POST must stay a POST, 307 says so explicitly and 302 does not.

Endpoints that return 302

1 endpoint in this playground answers with 302. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/protocol/v1/hop — Redirects to /hop?hops=n-1 (Protocol Lab API) Open & run this endpoint

Questions about HTTP 302
- Why is 302 sometimes described as "Found"?: That is its formal name. The behaviour people mean by it — "temporarily somewhere else" — is closer to what 307 defines precisely.
- Is 302 bad for SEO?: Not bad, but it tells search engines to keep indexing the original URL. If the move is permanent, use 301.

Other redirection codes

- 301 Moved Permanently
- 304 Not Modified

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/304
TITLE: HTTP 304 Not Modified — Live Example | Fun API Playground
================================================================

HTTP 304 Not Modified

The answer to a conditional GET whose If-None-Match matched the current ETag: your cached copy is still valid, so no body is sent.

Defined in RFC 9110 §15.4.5 — 304 Not Modified · MDN reference

On this page
- Where you meet HTTP 304 in production
- Why you would test it
- What your client should do about a 304
- 304 versus the codes it gets confused with
- Endpoints that return 304
- Questions about HTTP 304
- Other redirection codes

Where you meet HTTP 304 in production
Every well-cached asset and API response with a validator. It is the code behind most of the bandwidth a busy site does not spend.

Why you would test it

The cheapest performance win most clients never claim. Test that you store the ETag, send it back, and treat the empty 304 body as a cache hit rather than an error.

What your client should do about a 304
A 304 has no body, and that is the point — serve the cached copy. Send back exactly the validator you were given: the ETag in If-None-Match, or the Last-Modified date in If-Modified-Since. Do not synthesise a validator, and do not strip the quotes or weak-prefix off an ETag.

304 versus the codes it gets confused with
- 304 vs 200 OK — A 200 to a conditional request means the representation changed and here is the new one.
- 304 vs 412 Precondition Failed — Both compare validators. 304 answers a read — "you already have it". 412 refuses a write — "what you have is out of date".

Endpoints that return 304

3 endpoints in this playground answer with 304. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/football/v1/standings — Not Modified — If-None-Match matched the current etag (Football API) Open & run this endpoint
- GET https://funapi.dev/api/bank/v1/exchange-rates — On the live API: repeat with If-None-Match: "rates-v1" (Bank API) Open & run this endpoint
- GET https://funapi.dev/api/fiba/v1/groups/{letter}/standings — Not Modified — If-None-Match matched (FIBA World Cup API) Open & run this endpoint

Questions about HTTP 304
- Why is my conditional request always returning 200?: Usually the validator is not being echoed exactly, or the server generates a fresh ETag per response. Compare the ETag you received with the one you sent, byte for byte.
- Does a 304 count against a rate limit?: That is the server's choice, but a well-built API charges less for one, because it did less work.

Other redirection codes

- 301 Moved Permanently
- 302 Found

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/400
TITLE: HTTP 400 Bad Request — Live Example | Fun API Playground
================================================================

HTTP 400 Bad Request

The server could not understand the request — malformed JSON, a missing required field, or a parameter of the wrong type.

Defined in RFC 9110 §15.5.1 — 400 Bad Request · MDN reference

On this page
- Where you meet HTTP 400 in production
- Why you would test it
- What your client should do about a 400
- 400 versus the codes it gets confused with
- Endpoints that return 400
- Questions about HTTP 400
- Other client error codes

Where you meet HTTP 400 in production
Malformed JSON, a query parameter of the wrong type, a missing required field, a payload the parser cannot make sense of at all.

Why you would test it

The baseline negative test. It is also the code most often used where 422 would be more accurate, so check which one your API actually sends.

What your client should do about a 400
Never retry a 400 unchanged — the request is wrong and will be wrong the second time. Surface the server's error detail rather than a generic failure message; the whole value of a 400 is that it says what it did not understand.

400 versus the codes it gets confused with
- 400 vs 422 Unprocessable Content — 400 means the request could not be parsed or is structurally invalid. 422 means it parsed fine but the content is not acceptable — a well-formed date in a field that requires a future date.
- 400 vs 404 Not Found — An id that does not exist is a 404. An id that is not a number when a number is required is a 400.

Endpoints that return 400

105 endpoints in this playground answer with 400. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/friends/v1/characters — Invalid page parameter, or an unknown query parameter (strict mode) (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/characters/{id} — Invalid id (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters — Missing name / invalid JSON (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters/bulk — Body is not a JSON array (Friends API) Open & run this endpoint
- PUT https://funapi.dev/api/friends/v1/characters/{id} — Empty body / invalid JSON (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters/bulk-delete — "ids" is missing, empty, or not an array of integers (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/episodes — Non-integer season (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v2/characters — Invalid page parameter (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/graphql — Missing "query" string, or completely unrecognized syntax (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/superheroes/v1/heroes — Invalid page (Superhero API) Open & run this endpoint
- POST https://funapi.dev/api/superheroes/v1/heroes — Missing name or power (Superhero API) Open & run this endpoint
- POST https://funapi.dev/api/superheroes/v1/heroes/versus — Same hero twice or unknown id (Superhero API) Open & run this endpoint
- GET https://funapi.dev/api/pizza/v1/menu — Invalid vegetarian value (Pizza Orders API) Open & run this endpoint
- POST https://funapi.dev/api/pizza/v1/orders — Unknown pizzaId, bad size, or missing address (Pizza Orders API) Open & run this endpoint
- PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Invalid status value (Pizza Orders API) Open & run this endpoint
- PATCH https://funapi.dev/api/pizza/v1/orders/{id} — Empty body, invalid JSON, or bad size (Pizza Orders API) Open & run this endpoint
- GET https://funapi.dev/api/coffee/v1/drinks — Invalid type (Coffee Shop API) Open & run this endpoint
- POST https://funapi.dev/api/coffee/v1/orders — Unknown drinkId or missing name (Coffee Shop API) Open & run this endpoint
- GET https://funapi.dev/api/football/v1/teams — Invalid page (Football API) Open & run this endpoint
- POST https://funapi.dev/api/football/v1/matches — Same team twice or unknown team (Football API) Open & run this endpoint
- GET https://funapi.dev/api/movies/v1/movies — Invalid sort or page, or an unknown query parameter (strict mode) (Movies API) Open & run this endpoint
- GET https://funapi.dev/api/movies/v1/search/fuzzy — Missing "q" or invalid maxDistance (Movies API) Open & run this endpoint
- POST https://funapi.dev/api/movies/v1/movies — Missing title (Movies API) Open & run this endpoint
- PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — Rating outside the inclusive 0–10 range (Movies API) Open & run this endpoint
- POST https://funapi.dev/api/movies/v1/movies/{id}/poster — Missing filename or sizeBytes (Movies API) Open & run this endpoint

…and 80 more endpoints across the catalog.

Questions about HTTP 400
- Is 400 a catch-all for client errors?: It is often used that way, but a specific code — 401, 403, 404, 409, 422 — tells the caller far more, and lets their client behave differently for each.
- Should a 400 have a body?: Yes. A 400 with no explanation makes the caller guess, and guessing is how retries begin.

Other client error codes

- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/401
TITLE: HTTP 401 Unauthorized — Live Example | Fun API Playground
================================================================

HTTP 401 Unauthorized

Authentication is missing or invalid. Despite the name, this is about identity, not permission — the server does not know who you are.

Defined in RFC 9110 §15.5.2 — 401 Unauthorized · MDN reference

On this page
- Where you meet HTTP 401 in production
- Why you would test it
- What your client should do about a 401
- 401 versus the codes it gets confused with
- Endpoints that return 401
- Questions about HTTP 401
- Other client error codes

Where you meet HTTP 401 in production
A missing Authorization header, an expired access token, a signature that does not verify, a session that has been revoked.

Why you would test it

Test the missing-header case and the invalid-token case separately. They are different bugs and they fail in different places.

What your client should do about a 401
A 401 means "authenticate and try again" — refresh the token once and retry, then stop. A refresh loop that never gives up is how a single expired credential becomes a sustained load spike. A compliant server sends a WWW-Authenticate header telling you which scheme it wants.

401 versus the codes it gets confused with
- 401 vs 403 Forbidden — This is the pair people get wrong most. 401 means the server does not know who you are. 403 means it knows exactly who you are and the answer is still no.
- 401 vs 419 — Some frameworks invent codes for expired sessions. 401 with a clear error body is the standard answer.

Endpoints that return 401

88 endpoints in this playground answer with 401. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/friends/v1/characters — Missing or invalid token (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters/bulk — Missing or invalid token (Friends API) Open & run this endpoint
- PUT https://funapi.dev/api/friends/v1/characters/{id} — Missing or invalid token (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Missing or invalid token (Friends API) Open & run this endpoint
- DELETE https://funapi.dev/api/friends/v1/characters/{id} — Missing or invalid token (Friends API) Open & run this endpoint
- POST https://funapi.dev/api/superheroes/v1/heroes — Missing or invalid token (Superhero API) Open & run this endpoint
- DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Missing or invalid token (Superhero API) Open & run this endpoint
- POST https://funapi.dev/api/superheroes/v1/heroes/versus — Missing or invalid token (Superhero API) Open & run this endpoint
- PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Missing or invalid token (Pizza Orders API) Open & run this endpoint
- POST https://funapi.dev/api/football/v1/matches — Missing or invalid token (Football API) Open & run this endpoint
- DELETE https://funapi.dev/api/football/v1/teams/{id} — Missing or invalid token (Football API) Open & run this endpoint
- POST https://funapi.dev/api/movies/v1/movies — Missing or invalid token (Movies API) Open & run this endpoint
- PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — Missing or invalid token (Movies API) Open & run this endpoint
- DELETE https://funapi.dev/api/movies/v1/movies/{id} — Missing or invalid token (Movies API) Open & run this endpoint
- POST https://funapi.dev/api/movies/v1/movies/{id}/poster — Missing or invalid token (Movies API) Open & run this endpoint
- POST https://funapi.dev/api/wizarding/v1/students — Missing or invalid token (Harry Potter API) Open & run this endpoint
- PUT https://funapi.dev/api/wizarding/v1/students/{id} — Missing or invalid token (Harry Potter API) Open & run this endpoint
- DELETE https://funapi.dev/api/wizarding/v1/students/{id} — Missing or invalid token (Harry Potter API) Open & run this endpoint
- POST https://funapi.dev/api/galaxy/v1/characters — Missing or invalid token (Star Wars API) Open & run this endpoint
- PUT https://funapi.dev/api/galaxy/v1/characters/{id} — Missing or invalid token (Star Wars API) Open & run this endpoint
- DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Missing or invalid token (Star Wars API) Open & run this endpoint
- POST https://funapi.dev/api/holmes/v1/suspects — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint
- PUT https://funapi.dev/api/holmes/v1/suspects/{id} — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint
- DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint
- PATCH https://funapi.dev/api/holmes/v1/cases/{id} — Missing or invalid token (Sherlock Holmes API) Open & run this endpoint

…and 63 more endpoints across the catalog.

Questions about HTTP 401
- Why is it called Unauthorized when it means unauthenticated?: A naming mistake in the original specification that is now permanent. Read 401 as "unauthenticated".
- Should I retry after a 401?: Once, after refreshing the credential. If the refreshed credential is also rejected, the problem is not transient.

Other client error codes

- 400 Bad Request
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/402
TITLE: HTTP 402 Payment Required — Live Example | Fun API
================================================================

HTTP 402 Payment Required

Reserved in the original spec and now used in practice for quota, billing and insufficient-funds conditions.

Defined in RFC 9110 §15.5.3 — 402 Payment Required · MDN reference

On this page
- Where you meet HTTP 402 in production
- Why you would test it
- What your client should do about a 402
- 402 versus the codes it gets confused with
- Endpoints that return 402
- Questions about HTTP 402
- Other client error codes

Where you meet HTTP 402 in production
Rare in public APIs and increasingly common in SaaS ones: an exhausted quota, an unpaid invoice, a feature behind a plan the caller is not on.

Why you would test it

Rare enough that most clients have never seen one, which is exactly why it is worth provoking before a payment provider sends you one in production.

What your client should do about a 402
Never retry. A 402 is resolved by a human doing something commercial, not by the client trying again. Surface the message and the upgrade path; a retry loop here just burns quota that is already exhausted.

402 versus the codes it gets confused with
- 402 vs 403 Forbidden — 403 is a permissions decision. 402 is a billing one — the same account with the same role would succeed on a different plan.
- 402 vs 429 Too Many Requests — 429 is "too fast, slow down". 402 is "you have used your allowance for the period".

Endpoints that return 402

6 endpoints in this playground answer with 402. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/bank/v1/transfers — Insufficient funds (Bank API) Open & run this endpoint
- GET https://funapi.dev/api/bank/v1/premium/statements — Always. Payment Required on demand, like the pizza oven’s 500. (Bank API) Open & run this endpoint
- GET https://funapi.dev/api/fiba/v1/players/{id}/advanced — Payment Required (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/gta/v1/vehicles/{id}/respray — Not enough cash (GTA API) Open & run this endpoint
- POST https://funapi.dev/api/gta/v1/weapons/{id}/buy — Not enough cash (GTA API) Open & run this endpoint
- DELETE https://funapi.dev/api/gta/v1/wanted — Not enough cash (GTA API) Open & run this endpoint

Questions about HTTP 402
- Is 402 actually used?: It was reserved for future use for decades, but plan-limited APIs have made it genuinely common.
- What should a 402 body contain?: What limit was hit, what the current plan allows, and where to change it.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/403
TITLE: HTTP 403 Forbidden — Live Example | Fun API Playground
================================================================

HTTP 403 Forbidden

The server knows who you are and is refusing anyway. Authentication succeeded; authorization did not.

Defined in RFC 9110 §15.5.4 — 403 Forbidden · MDN reference

On this page
- Where you meet HTTP 403 in production
- Why you would test it
- What your client should do about a 403
- 403 versus the codes it gets confused with
- Endpoints that return 403
- Questions about HTTP 403
- Other client error codes

Where you meet HTTP 403 in production
A reader trying to write, a tenant reaching for another tenant's data, a request from a blocked region, a valid token missing a scope.

Why you would test it

The 401-versus-403 distinction is the single most common auth bug. Test the same endpoint with no token, a valid read-only token and an admin token, and assert all three.

What your client should do about a 403
Do not retry, and do not re-authenticate — the credential is fine. Re-authenticating on a 403 is a common and costly bug: it turns a clean permission error into a login storm. Show the user what they lack, or fail the operation.

403 versus the codes it gets confused with
- 403 vs 401 Unauthorized — 401 is about identity, 403 is about permission. If refreshing the token could conceivably help, it was a 401.
- 403 vs 404 Not Found — Some APIs answer 404 instead of 403 deliberately, so that the existence of a resource is not leaked to someone not allowed to see it. Both are defensible; be deliberate about which you use.

Endpoints that return 403

24 endpoints in this playground answer with 403. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Viewer token not allowed (Friends API) Open & run this endpoint
- DELETE https://funapi.dev/api/friends/v1/characters/{id} — Viewer token not allowed (Friends API) Open & run this endpoint
- DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Viewer token not allowed (Superhero API) Open & run this endpoint
- DELETE https://funapi.dev/api/football/v1/teams/{id} — Viewer token not allowed (Football API) Open & run this endpoint
- DELETE https://funapi.dev/api/movies/v1/movies/{id} — Viewer token not allowed (Movies API) Open & run this endpoint
- DELETE https://funapi.dev/api/wizarding/v1/students/{id} — Viewer token not allowed (Harry Potter API) Open & run this endpoint
- DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Viewer token not allowed (Star Wars API) Open & run this endpoint
- DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Viewer token not allowed (Sherlock Holmes API) Open & run this endpoint
- DELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — Viewer token not allowed (Pokémon API) Open & run this endpoint
- DELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — Viewer token not allowed (Middle-earth API) Open & run this endpoint
- DELETE https://funapi.dev/api/webhooks/v1/subscriptions/{id} — Viewer token not allowed (Webhooks API) Open & run this endpoint
- DELETE https://funapi.dev/api/office/v1/employees/{id} — Viewer token not allowed (The Office API) Open & run this endpoint
- DELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — Viewer token not allowed (Dino Park API) Open & run this endpoint
- DELETE https://funapi.dev/api/marvel/v1/heroes/{id} — Viewer token not allowed (Marvel API) Open & run this endpoint
- POST https://funapi.dev/api/got/v1/nobles/{id}/kill — Viewer token not allowed (Game of Thrones API) Open & run this endpoint
- DELETE https://funapi.dev/api/rickandmorty/v1/characters/{id} — Viewer token not allowed (Rick and Morty API) Open & run this endpoint
- POST https://funapi.dev/api/bank/v1/accounts/{id}/freeze — Viewer token not allowed (Bank API) Open & run this endpoint
- DELETE https://funapi.dev/api/airline/v1/bookings/{id} — Viewer token not allowed (Airline API) Open & run this endpoint
- DELETE https://funapi.dev/api/protocol/v1/documents/{id} — Viewer token not allowed (Protocol Lab API) Open & run this endpoint
- POST https://funapi.dev/api/space/v1/launches/{id}/launch — Viewer token cannot push the big red button (Space Agency API) Open & run this endpoint
- DELETE https://funapi.dev/api/starfleet/v1/crew/{id} — Viewer token not allowed (Starfleet API) Open & run this endpoint
- POST https://funapi.dev/api/starfleet/v1/tribbles/purge — Viewer token not allowed (Starfleet API) Open & run this endpoint
- PUT https://funapi.dev/api/fiba/v1/teams/{id}/staff — Viewer token not allowed (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/fiba/v1/games/{id}/simulate — Viewer token not allowed (FIBA World Cup API) Open & run this endpoint

Questions about HTTP 403
- Should a 403 explain why?: Enough for a legitimate caller to act on, and no more — an over-detailed 403 can leak the shape of the permission model.
- Can a 403 ever be fixed by retrying?: Only if permissions changed in between. As a client behaviour, treat it as terminal.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/404
TITLE: HTTP 404 Not Found — Live Example | Fun API Playground
================================================================

HTTP 404 Not Found

There is no resource at this URL. The server will not say whether there ever was one.

Defined in RFC 9110 §15.5.5 — 404 Not Found · MDN reference

On this page
- Where you meet HTTP 404 in production
- Why you would test it
- What your client should do about a 404
- 404 versus the codes it gets confused with
- Endpoints that return 404
- Questions about HTTP 404
- Other client error codes

Where you meet HTTP 404 in production
Deleted records, mistyped ids, a page past the end of a collection, a route that no longer exists after a refactor.

Why you would test it

Test both halves: an id that never existed, and one that was deleted. Also check that a filter matching nothing returns an empty 200 rather than a 404.

What your client should do about a 404
Do not retry. Distinguish "this id does not exist" from "this endpoint does not exist" — they are the same status and completely different bugs. If your client cannot tell them apart, an API rename will look like missing data for as long as it takes someone to open the network tab.

404 versus the codes it gets confused with
- 404 vs 410 Gone — 410 says it existed and is deliberately gone, permanently. 404 leaves open the possibility it never existed or may come back.
- 404 vs 400 Bad Request — A structurally invalid id is a 400. A well-formed id with nothing behind it is a 404.

Endpoints that return 404

169 endpoints in this playground answer with 404. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/friends/v1/characters — Page out of range (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/characters/{id} — Unknown id (Friends API) Open & run this endpoint
- PUT https://funapi.dev/api/friends/v1/characters/{id} — Unknown id (Friends API) Open & run this endpoint
- DELETE https://funapi.dev/api/friends/v1/characters/{id} — Unknown id (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v1/characters/{id}/quotes — Unknown character (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/friends/v2/characters — Page out of range (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/superheroes/v1/heroes — Page out of range (Superhero API) Open & run this endpoint
- GET https://funapi.dev/api/superheroes/v1/heroes/{id} — Unknown id (Superhero API) Open & run this endpoint
- GET https://funapi.dev/api/superheroes/v1/heroes/{id}/nemesis — Unknown hero or no nemesis (Superhero API) Open & run this endpoint
- DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Unknown id (Superhero API) Open & run this endpoint
- GET https://funapi.dev/api/pizza/v1/orders/{id} — Unknown order (Pizza Orders API) Open & run this endpoint
- PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — Unknown order (Pizza Orders API) Open & run this endpoint
- PATCH https://funapi.dev/api/pizza/v1/orders/{id} — Unknown order (Pizza Orders API) Open & run this endpoint
- DELETE https://funapi.dev/api/pizza/v1/orders/{id} — Unknown order (Pizza Orders API) Open & run this endpoint
- GET https://funapi.dev/api/coffee/v1/drinks/{id} — Unknown id (Coffee Shop API) Open & run this endpoint
- PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — Unknown order (Coffee Shop API) Open & run this endpoint
- GET https://funapi.dev/api/football/v1/teams — Page out of range (Football API) Open & run this endpoint
- GET https://funapi.dev/api/football/v1/teams/{id} — Unknown id (Football API) Open & run this endpoint
- GET https://funapi.dev/api/football/v1/teams/{id}/players — Unknown team (Football API) Open & run this endpoint
- GET https://funapi.dev/api/football/v1/teams/{id}/matches — Unknown team (Football API) Open & run this endpoint
- DELETE https://funapi.dev/api/football/v1/teams/{id} — Unknown id (Football API) Open & run this endpoint
- GET https://funapi.dev/api/movies/v1/movies — Page out of range (Movies API) Open & run this endpoint
- GET https://funapi.dev/api/movies/v1/movies/{id} — Unknown id (Movies API) Open & run this endpoint
- PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — Unknown id (Movies API) Open & run this endpoint
- DELETE https://funapi.dev/api/movies/v1/movies/{id} — Unknown id (Movies API) Open & run this endpoint

…and 144 more endpoints across the catalog.

Questions about HTTP 404
- Should an empty list be a 404?: No. A collection with no matching items is a 200 with an empty array — the collection exists.
- Is it acceptable to return 404 instead of 403?: Yes, as a deliberate choice to avoid confirming that a resource exists to someone not allowed to know.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/405
TITLE: HTTP 405 Method Not Allowed — Live Example | Fun API
================================================================

HTTP 405 Method Not Allowed

The URL exists but not with this method. The response must include an Allow header listing what is permitted.

Defined in RFC 9110 §15.5.6 — 405 Method Not Allowed · MDN reference

On this page
- Where you meet HTTP 405 in production
- Why you would test it
- What your client should do about a 405
- 405 versus the codes it gets confused with
- Endpoints that return 405
- Questions about HTTP 405
- Other client error codes

Where you meet HTTP 405 in production
A DELETE against a read-only collection, a POST to a URL that only supports GET, a client that has drifted from the API it was written against.

Why you would test it

Read the Allow header rather than guessing. It is the machine-readable answer to "what can I do with this resource?".

What your client should do about a 405
Read the Allow header — a compliant 405 lists the methods that would have worked, which is the fastest route from the error to the fix. Never retry with the same method.

405 versus the codes it gets confused with
- 405 vs 404 Not Found — A 404 means the path is unknown. A 405 means the path is known and the verb is not supported on it.
- 405 vs 501 — 501 means the server does not implement the method at all, anywhere. 405 is about this resource.

Endpoints that return 405

1 endpoint in this playground answers with 405. Every one is free, needs no signup, and can be called from the browser or with curl.

- DELETE https://funapi.dev/api/pizza/v1/menu — Always. GET is the only supported method on /menu. (Pizza Orders API) Open & run this endpoint

Questions about HTTP 405
- Is the Allow header required?: Yes — the specification requires a 405 to include it. Many servers omit it anyway, which is worth checking for in a contract test.
- Why do I get 405 on OPTIONS?: Usually a CORS preflight hitting a server that has no OPTIONS handler. It surfaces in the browser as a CORS failure rather than as the 405 it is.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 406 Not Acceptable
- 409 Conflict
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/406
TITLE: HTTP 406 Not Acceptable — Live Example | Fun API Playground
================================================================

HTTP 406 Not Acceptable

The server cannot produce a representation matching your Accept header.

Defined in RFC 9110 §15.5.7 — 406 Not Acceptable · MDN reference

On this page
- Where you meet HTTP 406 in production
- Why you would test it
- What your client should do about a 406
- 406 versus the codes it gets confused with
- Endpoints that return 406
- Questions about HTTP 406
- Other client error codes

Where you meet HTTP 406 in production
Content negotiation that cannot be satisfied — a client asking for text/csv from an endpoint that only speaks JSON, or a version in an Accept header the server has retired.

Why you would test it

Worth provoking if your client sends a narrow Accept header, because the failure looks like a server fault and is actually a negotiation failure.

What your client should do about a 406
Do not retry with the same Accept header. Either fall back to a type the server does offer, or fail with a message naming what you asked for. A 406 that a client turns into "server error" wastes an on-call engineer's evening on a header.

406 versus the codes it gets confused with
- 406 vs 415 Unsupported Media Type — The mirror image. 415 is about the type you *sent* (Content-Type). 406 is about the type you *asked for* (Accept).
- 406 vs 400 Bad Request — A malformed Accept header is a 400. A well-formed one the server cannot satisfy is a 406.

Endpoints that return 406

2 endpoints in this playground answer with 406. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/friends/characters — Accept header requests an unsupported media type (Friends API) Open & run this endpoint
- GET https://funapi.dev/api/protocol/v1/export/documents — Unsupported Accept value (Protocol Lab API) Open & run this endpoint

Questions about HTTP 406
- Is it better to return 406 or just ignore the Accept header?: Many APIs serve JSON regardless, which is pragmatic but hides a client bug. 406 is the honest answer.
- Does Accept: */* ever produce a 406?: It should not — it means the client will take anything.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 409 Conflict
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/409
TITLE: HTTP 409 Conflict — Live Example | Fun API Playground
================================================================

HTTP 409 Conflict

The request is valid but clashes with the current state — a duplicate, a seat already taken, a state transition that is not allowed from here.

Defined in RFC 9110 §15.5.10 — 409 Conflict · MDN reference

On this page
- Where you meet HTTP 409 in production
- Why you would test it
- What your client should do about a 409
- 409 versus the codes it gets confused with
- Endpoints that return 409
- Questions about HTTP 409
- Other client error codes

Where you meet HTTP 409 in production
Double-booked seats, duplicate usernames, deleting a record that something else still points at, cancelling an order that already shipped, and any state machine asked to make a transition it does not have.

Why you would test it

A 409 is a state problem, not a transport problem, so blind retries make it worse. Test that your retry policy distinguishes it from a 503.

What your client should do about a 409
A 409 is about state, so a blind retry usually fails identically — the seat is still taken. Re-read the current state, decide whether the operation still makes sense, and only then try again. This is the status where an automatic retry policy does the most damage for the least benefit.

409 versus the codes it gets confused with
- 409 vs 412 Precondition Failed — 412 is a conflict the client explicitly asked to be checked, by sending a validator. 409 is a conflict the server detected on its own.
- 409 vs 422 Unprocessable Content — 422 rejects the content of the request. 409 accepts the content and rejects it against the current state of the resource.

Endpoints that return 409

46 endpoints in this playground answer with 409. Every one is free, needs no signup, and can be called from the browser or with curl.

- DELETE https://funapi.dev/api/pizza/v1/orders/{id} — Order already delivered — cannot cancel (Pizza Orders API) Open & run this endpoint
- PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — Order is already ready (Coffee Shop API) Open & run this endpoint
- DELETE https://funapi.dev/api/football/v1/teams/{id} — Team has played matches (Football API) Open & run this endpoint
- PATCH https://funapi.dev/api/holmes/v1/cases/{id} — Case is already in that status (Sherlock Holmes API) Open & run this endpoint
- POST https://funapi.dev/api/webhooks/v1/deliveries/{id}/replay — Max attempts (3) already reached (Webhooks API) Open & run this endpoint
- POST https://funapi.dev/api/dinopark/v1/dinosaurs — Enclosure is at capacity (Dino Park API) Open & run this endpoint
- POST https://funapi.dev/api/marvel/v1/missions/{id}/complete — Mission is already complete (Marvel API) Open & run this endpoint
- POST https://funapi.dev/api/got/v1/nobles/{id}/kill — Noble is already dead (Game of Thrones API) Open & run this endpoint
- POST https://funapi.dev/api/got/v1/battles — A house cannot fight itself (Game of Thrones API) Open & run this endpoint
- POST https://funapi.dev/api/bank/v1/transfers — An account is frozen (Bank API) Open & run this endpoint
- POST https://funapi.dev/api/bank/v1/accounts/{id}/freeze — Already frozen (Bank API) Open & run this endpoint
- POST https://funapi.dev/api/airline/v1/bookings — Seat taken, flight cancelled, or flight full (overbooked) (Airline API) Open & run this endpoint
- PUT https://funapi.dev/api/airline/v1/bookings/{id}/seat — Seat taken or booking checked-in (Airline API) Open & run this endpoint
- POST https://funapi.dev/api/airline/v1/bookings/{id}/checkin — Already checked-in, or the flight is cancelled (Airline API) Open & run this endpoint
- DELETE https://funapi.dev/api/airline/v1/bookings/{id} — Cannot cancel after check-in (Airline API) Open & run this endpoint
- PATCH https://funapi.dev/api/protocol/v1/documents/{id} — A "test" operation failed (Protocol Lab API) Open & run this endpoint
- POST https://funapi.dev/api/shop/v1/carts/{id}/items — Not enough stock (product 3 is always out) (Shop API) Open & run this endpoint
- POST https://funapi.dev/api/shop/v1/carts/{id}/checkout — Cart already checked out, or stock ran out since adding (Shop API) Open & run this endpoint
- POST https://funapi.dev/api/cargo/v1/shipments/{id}/advance — Shipment is in a terminal state (Cargo Tracking API) Open & run this endpoint
- POST https://funapi.dev/api/cargo/v1/shipments/{id}/attempt-delivery — Not out-for-delivery (Cargo Tracking API) Open & run this endpoint
- PUT https://funapi.dev/api/cargo/v1/shipments/{id}/address — Already delivered (Cargo Tracking API) Open & run this endpoint
- POST https://funapi.dev/api/space/v1/launches/{id}/scrub — Already launched or already scrubbed (Space Agency API) Open & run this endpoint
- POST https://funapi.dev/api/space/v1/launches/{id}/launch — Not scheduled, or an auto-abort at T-0 (~25% chance) (Space Agency API) Open & run this endpoint
- GET https://funapi.dev/api/space/v1/launches/{id}/countdown — Launch is not scheduled (Space Agency API) Open & run this endpoint
- POST https://funapi.dev/api/starfleet/v1/ships — A ship with that name already exists (Starfleet API) Open & run this endpoint

…and 21 more endpoints across the catalog.

Questions about HTTP 409
- Should a 409 body say what conflicted?: Yes, and specifically enough for the client to resolve it — "seat 14A is taken" beats "conflict".
- Is a duplicate POST a 409?: 409 if the duplicate is genuinely unacceptable. If the caller sent an Idempotency-Key, replaying the original response is friendlier.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 410 Gone

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/410
TITLE: HTTP 410 Gone — Live Example | Fun API Playground
================================================================

HTTP 410 Gone

The resource existed and has been permanently removed. Unlike a 404, the server is stating that it will not come back.

Defined in RFC 9110 §15.5.11 — 410 Gone · MDN reference

On this page
- Where you meet HTTP 410 in production
- Why you would test it
- What your client should do about a 410
- 410 versus the codes it gets confused with
- Endpoints that return 410
- Questions about HTTP 410
- Other client error codes

Where you meet HTTP 410 in production
Retired API versions, expired share links, records removed at a user's request, and endpoints deliberately sunset after a deprecation window — anywhere the absence is a decision rather than an accident.

Why you would test it

Most clients collapse 410 into 404 and keep retrying a URL that will never work again. Test it separately and stop retrying.

What your client should do about a 410
Stop asking. A 410 is the server saying the URL will not come back, which means the right client behaviour is to remove it from whatever list keeps producing it — not to retry on a schedule.

410 versus the codes it gets confused with
- 410 vs 404 Not Found — 404 is "not here". 410 is "not here, on purpose, and not coming back". Search engines drop a 410 faster than a 404.
- 410 vs 301 Moved Permanently — If there is a replacement, redirect to it. 410 is for when there is not.

Endpoints that return 410

8 endpoints in this playground answer with 410. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/airline/v1/bookings/{id} — Existed once, cancelled since — Gone (Airline API) Open & run this endpoint
- GET https://funapi.dev/api/protocol/v1/documents/{id} — Deleted — Gone (Protocol Lab API) Open & run this endpoint
- DELETE https://funapi.dev/api/protocol/v1/documents/{id} — Already deleted (Protocol Lab API) Open & run this endpoint
- GET https://funapi.dev/api/shop/v1/coupons/{code} — Existed once, expired since (Shop API) Open & run this endpoint
- GET https://funapi.dev/api/worldcup/v1/tickets/{id} — Order cancelled (World Cup 2026 API) Open & run this endpoint
- DELETE https://funapi.dev/api/worldcup/v1/tickets/{id} — Already cancelled (World Cup 2026 API) Open & run this endpoint
- GET https://funapi.dev/api/fiba/v1/tickets/{id} — Order was cancelled (FIBA World Cup API) Open & run this endpoint
- DELETE https://funapi.dev/api/fiba/v1/tickets/{id} — Already cancelled (FIBA World Cup API) Open & run this endpoint

Questions about HTTP 410
- Do I have to use 410 instead of 404?: No, 404 is always acceptable. 410 is more informative when you know the removal is permanent.
- Is 410 good for deprecating an API version?: Yes, after a deprecation window in which the endpoint still works and announces its end date.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/412
TITLE: HTTP 412 Precondition Failed — Live Example | Fun API
================================================================

HTTP 412 Precondition Failed

A condition in the request headers was not met — almost always an If-Match ETag that no longer reflects the current state of the resource.

Defined in RFC 9110 §15.5.13 — 412 Precondition Failed · MDN reference

On this page
- Where you meet HTTP 412 in production
- Why you would test it
- What your client should do about a 412
- 412 versus the codes it gets confused with
- Endpoints that return 412
- Questions about HTTP 412
- Other client error codes

Where you meet HTTP 412 in production
Optimistic concurrency — two people editing the same record, and the second write arriving with a version the server has already moved past.

Why you would test it

The core of optimistic concurrency. If you never see a 412 in testing, your client is probably not sending If-Match at all, and lost updates are going unnoticed.

What your client should do about a 412
This is the code that stops a lost update, so treat it as a real outcome rather than an error. Re-fetch the resource, decide whether the change still applies to the new version, merge or prompt, and retry with the fresh ETag. Retrying with the same stale validator will produce the same 412 forever.

412 versus the codes it gets confused with
- 412 vs 409 Conflict — Both are conflicts. 412 happens because the client asked for the check with If-Match; 409 happens without being asked.
- 412 vs 304 Not Modified — Same machinery, opposite direction: 304 is a read that did not need to happen, 412 is a write that must not.

Endpoints that return 412

31 endpoints in this playground answer with 412. Every one is free, needs no signup, and can be called from the browser or with curl.

- PUT https://funapi.dev/api/friends/v1/characters/{id} — If-Match does not match current version (Friends API) Open & run this endpoint
- DELETE https://funapi.dev/api/friends/v1/characters/{id} — If-Match does not match current version (Friends API) Open & run this endpoint
- DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — If-Match does not match current version (Superhero API) Open & run this endpoint
- PUT https://funapi.dev/api/pizza/v1/orders/{id}/status — If-Match does not match current version (Pizza Orders API) Open & run this endpoint
- PUT https://funapi.dev/api/coffee/v1/orders/{id}/ready — If-Match does not match current version (Coffee Shop API) Open & run this endpoint
- DELETE https://funapi.dev/api/football/v1/teams/{id} — If-Match does not match current version (Football API) Open & run this endpoint
- PUT https://funapi.dev/api/movies/v1/movies/{id}/rating — If-Match does not match current version (Movies API) Open & run this endpoint
- DELETE https://funapi.dev/api/movies/v1/movies/{id} — If-Match does not match current version (Movies API) Open & run this endpoint
- PUT https://funapi.dev/api/wizarding/v1/students/{id} — If-Match does not match current version (Harry Potter API) Open & run this endpoint
- DELETE https://funapi.dev/api/wizarding/v1/students/{id} — If-Match does not match current version (Harry Potter API) Open & run this endpoint
- PUT https://funapi.dev/api/galaxy/v1/characters/{id} — If-Match does not match current version (Star Wars API) Open & run this endpoint
- DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — If-Match does not match current version (Star Wars API) Open & run this endpoint
- PUT https://funapi.dev/api/holmes/v1/suspects/{id} — If-Match does not match current version (Sherlock Holmes API) Open & run this endpoint
- DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — If-Match does not match current version (Sherlock Holmes API) Open & run this endpoint
- PUT https://funapi.dev/api/pokemon/v1/pokemon/{id} — If-Match does not match current version (Pokémon API) Open & run this endpoint
- DELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — If-Match does not match current version (Pokémon API) Open & run this endpoint
- PUT https://funapi.dev/api/middleearth/v1/fellowship/{id} — If-Match does not match current version (Middle-earth API) Open & run this endpoint
- DELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — If-Match does not match current version (Middle-earth API) Open & run this endpoint
- PUT https://funapi.dev/api/office/v1/employees/{id} — If-Match does not match current version (The Office API) Open & run this endpoint
- DELETE https://funapi.dev/api/office/v1/employees/{id} — If-Match does not match current version (The Office API) Open & run this endpoint
- PUT https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — If-Match does not match current version (Dino Park API) Open & run this endpoint
- DELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — If-Match does not match current version (Dino Park API) Open & run this endpoint
- PUT https://funapi.dev/api/marvel/v1/heroes/{id} — If-Match does not match current version (Marvel API) Open & run this endpoint
- DELETE https://funapi.dev/api/marvel/v1/heroes/{id} — If-Match does not match current version (Marvel API) Open & run this endpoint
- PUT https://funapi.dev/api/got/v1/nobles/{id} — If-Match does not match current version (Game of Thrones API) Open & run this endpoint

…and 6 more endpoints across the catalog.

Questions about HTTP 412
- How do I get the ETag to send?: From the ETag response header of a prior GET. Send it back verbatim in If-Match.
- What is If-Match: * for?: It requires that the resource exists at all, without pinning a specific version.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/413
TITLE: HTTP 413 Content Too Large — Live Example | Fun API
================================================================

HTTP 413 Content Too Large

The request body exceeds what the server will accept. Still widely known by its old reason phrase, Payload Too Large.

Defined in RFC 9110 §15.5.14 — 413 Content Too Large · MDN reference
RFC 7231 called this "Payload Too Large"; RFC 9110 renamed it. Both refer to the same code.

On this page
- Where you meet HTTP 413 in production
- Why you would test it
- What your client should do about a 413
- 413 versus the codes it gets confused with
- Endpoints that return 413
- Questions about HTTP 413
- Other client error codes

Where you meet HTTP 413 in production
File uploads past a limit, oversized JSON payloads, batch requests with too many items — often enforced by a proxy before the application ever sees the request.

Why you would test it

Test at the boundary, not far past it. A client that streams uploads may fail differently from one that buffers.

What your client should do about a 413
Do not retry the same payload. Compress it, chunk it, or reject it client-side with a clear message. Check the limit before uploading where the API publishes one; failing at the browser is far cheaper than failing after a 40 MB upload.

413 versus the codes it gets confused with
- 413 vs 400 Bad Request — A 400 says the request was malformed. A 413 says it was well-formed and too big.
- 413 vs 414 — 414 is specifically an over-long URI — usually a GET that should have been a POST.

Endpoints that return 413

1 endpoint in this playground answers with 413. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/movies/v1/movies/{id}/poster — sizeBytes over the 5 MB limit (Movies API) Open & run this endpoint

Questions about HTTP 413
- Who enforces the limit?: Often a reverse proxy or gateway, which is why a 413 can arrive without any application log line to match it.
- Can the server say what the limit is?: It should, in the body — and a Retry-After is appropriate if the limit is temporary.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/415
TITLE: HTTP 415 Unsupported Media Type — Live Example | Fun API
================================================================

HTTP 415 Unsupported Media Type

The body is in a format the endpoint does not accept — usually a Content-Type mismatch.

Defined in RFC 9110 §15.5.16 — 415 Unsupported Media Type · MDN reference

On this page
- Where you meet HTTP 415 in production
- Why you would test it
- What your client should do about a 415
- 415 versus the codes it gets confused with
- Endpoints that return 415
- Questions about HTTP 415
- Other client error codes

Where you meet HTTP 415 in production
Posting form-encoded data to a JSON-only endpoint, uploading a file type the server will not take, or omitting Content-Type entirely and having the server refuse to guess.

Why you would test it

Frequently caused by the client, not the server: a forgotten Content-Type header, or a form encoding where JSON was expected.

What your client should do about a 415
Do not retry unchanged. Fix the Content-Type header or convert the payload. Most occurrences are a missing header rather than genuinely unsupported content, which makes it worth logging the header you actually sent.

415 versus the codes it gets confused with
- 415 vs 406 Not Acceptable — The mirror image: 415 is about what you sent, 406 about what you asked to receive.
- 415 vs 422 Unprocessable Content — 415 means the server will not parse this media type. 422 means it parsed it and disagreed with the contents.

Endpoints that return 415

1 endpoint in this playground answers with 415. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/movies/v1/movies/{id}/poster — contentType is not an accepted image type (Movies API) Open & run this endpoint

Questions about HTTP 415
- Does the charset matter?: Sometimes. application/json and application/json; charset=utf-8 are treated as equivalent by most servers and as different by some strict ones.
- What should the response include?: The media types that are supported — an Accept-Post header or a body listing them.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/416
TITLE: HTTP 416 Range Not Satisfiable — Live Example | Fun API
================================================================

HTTP 416 Range Not Satisfiable

The Range header asks for bytes that do not exist — typically an offset past the end of the resource.

Defined in RFC 9110 §15.5.17 — 416 Range Not Satisfiable · MDN reference

On this page
- Where you meet HTTP 416 in production
- Why you would test it
- What your client should do about a 416
- 416 versus the codes it gets confused with
- Endpoints that return 416
- Questions about HTTP 416
- Other client error codes

Where you meet HTTP 416 in production
Resumable downloads restarting from an offset past the end of a file, usually after the file was replaced by a shorter one.

Why you would test it

The edge case of resumable transfers. A client that resumes from a stale offset lands here, and should restart rather than retry.

What your client should do about a 416
Re-read the current length from the Content-Range header on the 416 response, then either restart the transfer or request a valid range. Retrying the same range is guaranteed to fail again.

416 versus the codes it gets confused with
- 416 vs 206 Partial Content — 206 is the success case for the same request shape.
- 416 vs 400 Bad Request — A syntactically invalid Range header is a 400; a valid one that does not overlap the resource is a 416.

Endpoints that return 416

1 endpoint in this playground answers with 416. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/storage/v1/objects/{key} — Invalid range (Object Storage API) Open & run this endpoint

Questions about HTTP 416
- What does the 416 response tell me?: A compliant server includes Content-Range: bytes */<length>, which is the current size — exactly what you need to correct the request.
- Can a server ignore Range and send 200?: Yes, and it is legal. Clients must handle a full-body response to a ranged request.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/418
TITLE: HTTP 418 I'm a Teapot — Live Example | Fun API Playground
================================================================

HTTP 418 I'm a Teapot

From the 1998 April Fools' hypertext coffee-pot spec. It is a real, registered code, and a teapot cannot brew coffee.

Defined in RFC 9110 §15.5.19 — 418 (Unused) · MDN reference · RFC 2324 §2.3.2 — Hyper Text Coffee Pot Control Protocol
RFC 9110 reserves 418 rather than defining it. The teapot comes from RFC 2324 §2.3.2, an April Fools' joke from 1998 that made the code permanently unusable for anything serious.

On this page
- Where you meet HTTP 418 in production
- Why you would test it
- What your client should do about a 418
- 418 versus the codes it gets confused with
- Endpoints that return 418
- Questions about HTTP 418
- Other client error codes

Where you meet HTTP 418 in production
Nowhere, deliberately. It came out of an April Fools' RFC for coffee pots and survives as the canonical joke status — which makes it genuinely useful as an unmistakable marker in tests and health checks.

Why you would test it

Genuinely useful as a canary: pick a code nothing in your stack handles specially, and assert it survives your client, your proxy and your logging untouched.

What your client should do about a 418
Treat it as an unexpected status: log it loudly and fail. Its practical value in a test suite is that no real error path produces it, so a 418 in a log is always the thing you put there on purpose.

418 versus the codes it gets confused with
- 418 vs 400 Bad Request — If you need a real "I will not do this" for a client error, 400 or 422 is the honest code.
- 418 vs 451 — 451, for content blocked on legal grounds, is the other famous specialty code — and that one is entirely serious.

Endpoints that return 418

1 endpoint in this playground answers with 418. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/coffee/v1/teapot — Always. It is, in fact, a teapot. (Coffee Shop API) Open & run this endpoint

Questions about HTTP 418
- Is 418 a real HTTP status code?: It is registered, and it is a joke — from RFC 2324, the Hyper Text Coffee Pot Control Protocol. Attempts to remove it have been resisted with some feeling.
- Should I use 418 in production?: Not for anything a real client has to interpret. As a deliberate sentinel in test infrastructure, it is ideal.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/422
TITLE: HTTP 422 Unprocessable Content — Live Example | Fun API
================================================================

HTTP 422 Unprocessable Content

The syntax is fine and the server understood the request, but the content is semantically wrong — a valid date in the past where a future one is required, a transfer that would overdraw an account.

Defined in RFC 9110 §15.5.21 — 422 Unprocessable Content · MDN reference
Defined for WebDAV in RFC 4918 §11.2 as "Unprocessable Entity", then generalised and renamed by RFC 9110.

On this page
- Where you meet HTTP 422 in production
- Why you would test it
- What your client should do about a 422
- 422 versus the codes it gets confused with
- Endpoints that return 422
- Questions about HTTP 422
- Other client error codes

Where you meet HTTP 422 in production
Validation failures: an email that is not an email, an end date before a start date, a quantity of zero on an order line, a field that is fine in isolation and wrong in context.

Why you would test it

The distinction from 400 is the point: 400 means "I could not read this", 422 means "I read it, and no". Clients should surface them to users differently.

What your client should do about a 422
Do not retry. Map the per-field errors onto the form the user is looking at — this is the one error class where the API can tell the client exactly what to fix, and a client that flattens it to "invalid input" throws that away.

422 versus the codes it gets confused with
- 422 vs 400 Bad Request — The distinction worth holding: 400 means the request could not be understood, 422 means it was understood and rejected. If a parser threw, it is a 400.
- 422 vs 409 Conflict — 422 is about the request in isolation. 409 is about the request against the current state.

Endpoints that return 422

23 endpoints in this playground answer with 422. Every one is free, needs no signup, and can be called from the browser or with curl.

- POST https://funapi.dev/api/bank/v1/accounts — Negative opening deposit (Bank API) Open & run this endpoint
- POST https://funapi.dev/api/bank/v1/transfers — Amount is not a positive number (Bank API) Open & run this endpoint
- POST https://funapi.dev/api/shop/v1/carts/{id}/checkout — Coupon invalid or expired (Shop API) Open & run this endpoint
- POST https://funapi.dev/api/worldcup/v1/matches/{id}/simulate — Knockout pairing not decided (World Cup 2026 API) Open & run this endpoint
- GET https://funapi.dev/api/worldcup/v1/players/top-scorers — Invalid limit (World Cup 2026 API) Open & run this endpoint
- POST https://funapi.dev/api/worldcup/v1/tickets — Invalid category or quantity (World Cup 2026 API) Open & run this endpoint
- POST https://funapi.dev/api/worldcup/v1/predictions — Unknown team (World Cup 2026 API) Open & run this endpoint
- PUT https://funapi.dev/api/fiba/v1/teams/{id}/staff — Missing coach, or a captain from another squad (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/fiba/v1/games/{id}/simulate — Knockout pairing not decided yet (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/fiba/v1/games/{id}/challenge — team must be home or away (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/fiba/v1/games/{id}/highlights — seconds must be 60, 120 or 300 (FIBA World Cup API) Open & run this endpoint
- GET https://funapi.dev/api/fiba/v1/players/leaders — Unknown stat, or limit outside 1–20 (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/fiba/v1/tickets — Invalid tier or quantity (FIBA World Cup API) Open & run this endpoint
- POST https://funapi.dev/api/gta/v1/vehicles/{id}/respray — Missing color (GTA API) Open & run this endpoint
- POST https://funapi.dev/api/gta/v1/missions/{id}/start — Prerequisite not completed (GTA API) Open & run this endpoint
- POST https://funapi.dev/api/gta/v1/heists — Invalid approach or crew size (GTA API) Open & run this endpoint
- POST https://funapi.dev/api/dragonball/v1/fighters/{id}/power-up — Invalid amount (Dragon Ball API) Open & run this endpoint
- POST https://funapi.dev/api/formula1/v1/races/{id}/pit-stops — Invalid pit stop (Formula 1 API) Open & run this endpoint
- POST https://funapi.dev/api/anime/v1/fighters/{id}/transform — Invalid multiplier (Anime Tournament API) Open & run this endpoint
- PUT https://funapi.dev/api/storage/v1/objects/{key} — Invalid base64 (Object Storage API) Open & run this endpoint
- PUT https://funapi.dev/api/faults/v1/config — Invalid profile (Fault Injection API) Open & run this endpoint
- POST https://funapi.dev/api/data/v1/generate — Invalid schema (Fun Data Bridge API) Open & run this endpoint
- POST https://funapi.dev/api/data/v1/jobs — Invalid job (Fun Data Bridge API) Open & run this endpoint

Questions about HTTP 422
- Is 422 only for WebDAV?: It originated there (RFC 4918) but is now standard in RFC 9110 and used widely for validation across REST APIs.
- What should a 422 body look like?: A list of field-level errors: which field, what rule, and what was received.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/429
TITLE: HTTP 429 Too Many Requests — Live Example | Fun API
================================================================

HTTP 429 Too Many Requests

You are being rate limited. The response should carry Retry-After, and usually X-RateLimit-Limit, -Remaining and -Reset.

Defined in RFC 6585 §4 — 429 Too Many Requests · MDN reference

On this page
- Where you meet HTTP 429 in production
- Why you would test it
- What your client should do about a 429
- 429 versus the codes it gets confused with
- Endpoints that return 429
- Questions about HTTP 429
- Other client error codes

Where you meet HTTP 429 in production
Any API with a quota — and it usually arrives all at once, when a deploy, a retry storm or a batch job pushes a normally quiet client over the line.

Why you would test it

Test that your client backs off on Retry-After rather than retrying immediately — an aggressive retry on a 429 is how a slowdown becomes an outage.

What your client should do about a 429
Honour Retry-After. If it is absent, back off exponentially with jitter — synchronised retries from many clients recreate exactly the spike the limit exists to prevent. Cap the number of attempts, and never retry a 429 in a tight loop. The X-RateLimit-Remaining and -Reset headers, where present, let you slow down before you are told to.

429 versus the codes it gets confused with
- 429 vs 503 Service Unavailable — Both mean "come back later". 429 is about you specifically — you are over your allowance. 503 is about the server being unable to serve anyone right now.
- 429 vs 402 Payment Required — 402 is a quota that resets with a payment, not with time.

Endpoints that return 429

1 endpoint in this playground answers with 429. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/coffee/v1/rush-hour — Too many requests — wait for Retry-After seconds (Coffee Shop API) Open & run this endpoint

Questions about HTTP 429
- What does Retry-After contain?: Either a number of seconds or an HTTP date. Both forms are valid and a client has to handle each.
- Does a failed request count towards the limit?: Usually yes. Rate limits are typically counted on requests received, not on requests that succeeded.

Other client error codes

- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 409 Conflict

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/500
TITLE: HTTP 500 Internal Server Error — Live Example | Fun API
================================================================

HTTP 500 Internal Server Error

The server failed and cannot say anything more useful. Nothing about the request needs to be wrong.

Defined in RFC 9110 §15.6.1 — 500 Internal Server Error · MDN reference

On this page
- Where you meet HTTP 500 in production
- Why you would test it
- What your client should do about a 500
- 500 versus the codes it gets confused with
- Endpoints that return 500
- Questions about HTTP 500
- Other server error codes

Where you meet HTTP 500 in production
An unhandled exception, a null dereference, a failed database call with no catch around it — the code that means the server hit something it did not plan for.

Why you would test it

Nearly impossible to provoke on demand against a healthy API, which is why retry, fallback and error-reporting paths so often ship untested.

What your client should do about a 500
A single retry is defensible for an idempotent request. For anything that writes, retrying a 500 risks doing the work twice, because a 500 does not tell you whether the operation completed before the failure — send an Idempotency-Key so the retry is safe, or do not retry at all.

500 versus the codes it gets confused with
- 500 vs 502 — 502 means an upstream server gave an invalid response. 500 means this server failed on its own.
- 500 vs 503 Service Unavailable — 503 is a deliberate, temporary refusal. 500 is an accident.

Endpoints that return 500

2 endpoints in this playground answer with 500. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/pizza/v1/oven/status — Always. The oven is on fire. (Pizza Orders API) Open & run this endpoint
- GET https://funapi.dev/api/faults/v1/target — Configured failure (Fault Injection API) Open & run this endpoint

Questions about HTTP 500
- Should a 500 body include the stack trace?: Never in production. A correlation id the caller can quote to support is the useful thing to return.
- Is it safe to retry a 500?: Only if the request is idempotent, or carries an idempotency key. Otherwise a retry can duplicate a completed write.

Other server error codes

- 503 Service Unavailable
- 504 Gateway Timeout

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/503
TITLE: HTTP 503 Service Unavailable — Live Example | Fun API
================================================================

HTTP 503 Service Unavailable

The server is temporarily unable to handle the request — overloaded, or down for maintenance. Often accompanied by Retry-After.

Defined in RFC 9110 §15.6.4 — 503 Service Unavailable · MDN reference

On this page
- Where you meet HTTP 503 in production
- Why you would test it
- What your client should do about a 503
- 503 versus the codes it gets confused with
- Endpoints that return 503
- Questions about HTTP 503
- Other server error codes

Where you meet HTTP 503 in production
Planned maintenance, a deploy in progress, a dependency that is down, or a load shedder deliberately turning traffic away to protect what is left.

Why you would test it

Unlike a 500, a 503 is explicitly retryable. Test that your client treats them differently instead of collapsing both into "error".

What your client should do about a 503
Retry with backoff, and honour Retry-After when the server sends one — a 503 with a Retry-After is a server telling you precisely when to come back, and ignoring it is how a recovering service is pushed back over. Fail open or degrade gracefully where the call is not essential.

503 versus the codes it gets confused with
- 503 vs 500 Internal Server Error — 500 is unplanned. 503 usually is not — it often means someone chose to return it.
- 503 vs 429 Too Many Requests — 429 limits you. 503 affects everyone.

Endpoints that return 503

2 endpoints in this playground answer with 503. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/protocol/v1/maintenance — Always, with a Retry-After header. Good retry/backoff practice. (Protocol Lab API) Open & run this endpoint
- GET https://funapi.dev/api/faults/v1/target — Configured outage (Fault Injection API) Open & run this endpoint

Questions about HTTP 503
- Should maintenance pages be 503?: Yes. A maintenance page served as 200 tells search engines the thin page is the real content.
- How long should I wait?: As long as Retry-After says. Without it, exponential backoff with jitter and an overall deadline.

Other server error codes

- 500 Internal Server Error
- 504 Gateway Timeout

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/status/504
TITLE: HTTP 504 Gateway Timeout — Live Example | Fun API Playground
================================================================

HTTP 504 Gateway Timeout

An upstream server did not respond in time. The failure is in the chain behind the endpoint, not at the endpoint itself.

Defined in RFC 9110 §15.6.5 — 504 Gateway Timeout · MDN reference

On this page
- Where you meet HTTP 504 in production
- Why you would test it
- What your client should do about a 504
- 504 versus the codes it gets confused with
- Endpoints that return 504
- Questions about HTTP 504
- Other server error codes

Where you meet HTTP 504 in production
A gateway or load balancer giving up on an upstream that did not answer in time — most often a slow query, a saturated pool, or a downstream call with no timeout of its own.

Why you would test it

Test what your own timeout does when it is shorter than the gateway's — you will get a client-side abort rather than the 504, and your logs will disagree with theirs.

What your client should do about a 504
The critical thing about a 504 is that the work may still be running. The gateway stopped waiting; the upstream did not necessarily stop working. Retrying a write after a 504 can duplicate it, so make it idempotent or check the state before retrying. Set a client timeout shorter than the gateway's so you keep control of the deadline.

504 versus the codes it gets confused with
- 504 vs 502 — 502 means the upstream answered with something invalid. 504 means it did not answer at all in time.
- 504 vs 503 Service Unavailable — 503 means the service declined to serve. 504 means something in front of it stopped waiting.

Endpoints that return 504

1 endpoint in this playground answers with 504. Every one is free, needs no signup, and can be called from the browser or with curl.

- GET https://funapi.dev/api/protocol/v1/gateway-timeout — Always, after ~3 seconds. Pair it with a 2s client timeout. (Protocol Lab API) Open & run this endpoint

Questions about HTTP 504
- Is a 504 the client's fault?: Rarely — but a client that retries aggressively into a struggling upstream makes it considerably worse.
- Did my request go through?: A 504 cannot tell you. That ambiguity is the reason idempotency keys exist.

Other server error codes

- 500 Internal Server Error
- 503 Service Unavailable

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary
TITLE: API Testing Glossary — Fun API Playground
================================================================

API testing glossary

The concepts these APIs exercise, each defined in a paragraph and then demonstrated by an endpoint you can call. Every entry names the misconception people actually hold about it, because that is usually the part standing between reading the definition and getting it right.

- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.
- HMAC signature — A keyed hash proving a payload came from someone holding the shared secret and has not been altered.
- Content negotiation — Client and server agreeing on the format of a response, through headers rather than separate URLs.
- Safe and idempotent methods — Two independent properties of HTTP methods that decide what a client is allowed to retry.
- CORS — The browser rule that decides whether JavaScript on one origin may read a response from another.

Testing techniques · Every HTTP status code · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/compare
TITLE: Free Mock API Tools Compared — Fun API Playground
================================================================

Free mock APIs compared

Honest comparisons with the other free mock APIs, including what each of them does better. Most of the disappointment with tools in this space comes from a tool being asked to do a job it was never for, so each page starts with what the other one is actually built to do.
The free options fall into three groups. Fixed public datasets — JSONPlaceholder, reqres — hand you a body to render and quietly discard your writes. Protocol reflectors — httpbin, Postman Echo — tell you exactly what your client sent but have no domain behind them, so there is nothing to conflict with. Configurable mock servers — Mockoon, WireMock, Beeceptor, Prism — let you declare the responses yourself, which is ideal for reproducing one specific contract and useless for discovering how your client copes with rules you did not write.
This playground is a fourth thing: a simulated API with per-caller state and constraints that push back. You do not configure the responses, which is the point — a seat that is already taken, a version that moved under you and a rate limit you actually exceeded are failures with a cause, and those are the ones worth rehearsing before production supplies them.

- A JSONPlaceholder alternative that keeps what you write — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference.
- An httpbin alternative with resources, not just reflections — httpbin shows you the request. This shows you an API. They answer different questions.
- A reqres alternative with more than users and a login — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path.
- Free mock APIs compared: which one for which job — Six free options, what each is genuinely for, and how to tell which one your problem needs.

API testing glossary · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tools
TITLE: Free API Testing Tools — Fun API Playground
================================================================

API testing tools

Three small utilities that run entirely in the page. No signup, no upload, no request to a server — which for two of them is the point rather than a nicety, because people paste live credentials and signing secrets into tools like these.
They exist because the playground already had the hard parts. It generates request code in nine languages, issues real signed JWTs from its auth endpoints, and signs every webhook delivery with an HMAC you are meant to verify. These take those three capabilities out of the docs pages and make each one usable on its own, against your own input.

- Convert a curl command to code — Paste a curl command, get the same request in nine languages — fetch, axios, Python, Go, C#, RestAssured, Playwright, k6 and HTTPie.
- Decode a JWT and read its claims — Paste a JSON Web Token to read its header and claims, and see whether it has expired. Nothing leaves the page.
- Verify an HMAC webhook signature — Check a webhook signature against the payload and the shared secret, with HMAC-SHA256, SHA-1 or SHA-512. Nothing leaves the page.

API testing glossary · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary
TITLE: API Testing Glossary — Fun API Playground
================================================================

API testing glossary

The concepts these APIs exercise, each defined in a paragraph and then demonstrated by an endpoint you can call. Every entry names the misconception people actually hold about it, because that is usually the part standing between reading the definition and getting it right.

- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.
- HMAC signature — A keyed hash proving a payload came from someone holding the shared secret and has not been altered.
- Content negotiation — Client and server agreeing on the format of a response, through headers rather than separate URLs.
- Safe and idempotent methods — Two independent properties of HTTP methods that decide what a client is allowed to retry.
- CORS — The browser rule that decides whether JavaScript on one origin may read a response from another.

Testing techniques · Every HTTP status code · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/mock-api
TITLE: What is a mock API? — Fun API Playground
================================================================

Mock API

A mock API answers requests the way a real service would — same URLs, same status codes, same response shapes — without any of the system the real one depends on. It exists so that a client can be built, demonstrated or tested before the real service is ready, or when calling the real one would be slow, expensive, rate-limited or destructive.

How it works

Mocks come in three broad shapes. A static mock always returns the same canned payload. A configurable mock lets you declare, per endpoint, what to return. A simulated mock — which is what this playground is — actually keeps state: a POST creates something a later GET can find, a DELETE removes it, and constraints such as stock levels, seat availability and version conflicts are enforced rather than described.

The misconception

The common assumption is that a mock cannot exercise error handling, because a mock always succeeds. That is a property of most mocks, not of mocking. It is precisely the failure paths — 409, 412, 429, 503 — that are hardest to provoke against a real service and most valuable to rehearse, which is why an API that only ever returns 200 makes for a weak practice target.

Try it here

Every API here runs both ways: entirely in your browser with no network at all, or against a live backend over HTTPS. The browser engine is the same code, so the responses match.

Related
- Negative testing: every error code on demand
- How this playground is actually served

Other terms
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/rest-api
TITLE: What is a REST API? — Fun API Playground
================================================================

REST API

REST is an architectural style, not a specification. What makes an API RESTful in practice: things in the system have URLs, the HTTP method says what you want done to them, the status code says what happened, and the server keeps no per-client session between requests. Everything the server needs to handle a request arrives with that request.

How it works

A collection lives at a path — /characters — and an item within it at /characters/1. GET reads, POST creates, PUT replaces, PATCH modifies, DELETE removes. Filtering, sorting and pagination ride on the query string. Representation is negotiated with Accept and Content-Type rather than baked into the URL. The response status is the primary result: a client that reads only the body is throwing away half the answer.

The misconception

That REST means JSON over HTTP. It does not — REST says nothing about JSON, and plenty of JSON-over-HTTP APIs are not RESTful at all (a single /api endpoint taking an action name in the body is RPC wearing REST's clothes). The distinguishing property is that resources are addressable and the method carries the verb.

Try it here

The catalog is 39 REST APIs with 337 endpoints between them. Any of them will do for the basics; the Protocol Lab is the one built specifically around the parts of HTTP that most mock APIs skip.

Related
- Getting started guide
- Safe and idempotent methods

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/etag
TITLE: What is an ETag? — Fun API Playground
================================================================

ETag

An ETag is a string the server attaches to a response that identifies that particular version of that particular representation. It is opaque: it might be a hash, a version number or a timestamp, and a client must never try to interpret it — only send it back.

How it works

On a read, the client returns the ETag in If-None-Match; if it still matches, the server answers 304 Not Modified with no body and the client uses its cached copy. On a write, the client sends it in If-Match; if it no longer matches, the server answers 412 Precondition Failed and the write is refused. Same value, two headers, two entirely different jobs — one saves bandwidth, the other prevents a lost update.

The misconception

That an ETag mismatch means something went wrong. A 412 is the mechanism working: it means somebody else changed the resource since you read it, and your write would have silently overwritten theirs. The correct response is to re-read, reconcile, and try again with the new ETag — not to retry with the old one, which will fail identically forever.

Try it here

The Football and FIBA standings endpoints answer conditional reads with 304. The character, hero and movie writes accept If-Match and produce a real 412 when the version is stale.

Related
- Testing optimistic concurrency with ETag and If-Match
- HTTP 412 Precondition Failed
- HTTP 304 Not Modified

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/hateoas
TITLE: What is HATEOAS? — Fun API Playground
================================================================

HATEOAS

HATEOAS is the constraint that a client should discover what it can do from the responses it receives, rather than from URLs hard-coded against documentation. Each representation carries links, and those links are what drives the client from one state to the next.

How it works

A response includes a links structure — commonly `_links` — naming the available transitions and their URLs: self, next, cancel, approve. A client follows the link named for what it wants to do. Because the available links depend on the current state, an order that has shipped simply does not carry a cancel link, and the client needs no rule of its own about when cancelling is allowed.

The misconception

That HATEOAS is academic and nobody ships it. Partial HATEOAS is everywhere: the `next` URL in a paginated response is exactly this idea, and a client that follows it rather than incrementing a page counter is already benefiting — it keeps working when the server moves to cursor pagination.

Try it here

The Protocol Lab document endpoints attach `_links` to every item. The Bank transaction list uses a cursor the client is meant to follow rather than construct.

Related
- Testing pagination against a real API
- What a REST API is

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/bearer-token
TITLE: What is a bearer token? — Fun API Playground
================================================================

Bearer token

A bearer token is sent in an Authorization header as `Authorization: Bearer <token>` and authorises the request purely by being presented. There is no signature over the request, no proof the sender is the party the token was issued to: the token is the whole credential, which is what "bearer" means.

How it works

The server validates the token — by looking it up, or by verifying a signature if it is self-contained like a JWT — and derives the caller's identity and permissions from it. A missing or invalid token is a 401. A valid token whose holder is not allowed to do this particular thing is a 403; the difference matters, because only one of them can be fixed by getting a new token.

The misconception

That a bearer token is safe to put in a URL because it expires. Anything in a URL ends up in server logs, browser history, referrer headers and analytics. Bearer tokens belong in a header, over TLS, with a short lifetime and a refresh mechanism.

Try it here

Every endpoint marked with a lock takes `qa-admin-token` or `qa-viewer-token`. Using the viewer token on a DELETE is the cleanest way to see the 401/403 distinction: the token is valid, and the answer is still no.

Related
- Testing OAuth 2.0, JWTs and token expiry
- HTTP 401 Unauthorized
- HTTP 403 Forbidden

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/jwt
TITLE: What is a JWT? — Fun API Playground
================================================================

JWT (JSON Web Token)

A JWT is three base64url-encoded segments separated by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. Because the signature proves the payload has not been altered, the server can trust the claims inside it without storing any session state.

How it works

The client sends it as a bearer token. The server verifies the signature with the key, then reads the claims — `sub` for the subject, `exp` for expiry, `iat` for issue time, plus whatever roles or scopes the issuer chose to include. Expiry is enforced by the server checking `exp`, not by anything in the token stopping it from being sent.

The misconception

That a JWT is encrypted. It is signed, not encrypted: anybody holding the token can decode the payload and read every claim in it. Nothing secret belongs in a JWT. The second misconception is that a JWT can be revoked — a stateless token stays valid until it expires, which is why short lifetimes and refresh tokens exist.

Try it here

`POST /auth/v1/login` with admin/admin123 issues a genuinely signed JWT. Decode the middle segment and read your own claims; then wait for it to expire and watch the 401 arrive.

Related
- Testing OAuth 2.0, JWTs and token expiry
- What a bearer token is

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/webhook
TITLE: What is a webhook? — Fun API Playground
================================================================

Webhook

A webhook inverts the usual direction. Rather than the client asking repeatedly whether anything has changed, it registers a URL of its own, and the server makes an HTTP request to that URL when an event occurs. The client becomes, for those requests, a server.

How it works

You subscribe by giving the provider a URL and usually receiving a shared secret. When an event fires, the provider POSTs a payload to that URL, signing it — typically an HMAC over the raw body, in a header. Your endpoint verifies the signature, responds quickly with a 2xx, and does the actual work afterwards. Providers retry non-2xx responses, so deliveries can and will arrive more than once.

The misconception

That receiving a webhook means the event is true. An unverified webhook endpoint is a public URL anybody can POST anything to. The signature is not optional, and it must be computed over the exact raw bytes received — parsing and re-serialising the JSON first is the single most common reason a correct implementation fails to verify.

Try it here

The Webhooks API lets you subscribe, trigger a delivery, read the `x-funapi-signature` header and verify it — then tamper with the payload and watch verification fail.

Related
- Testing webhooks and HMAC signature verification
- What an HMAC signature is

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/hmac-signature
TITLE: What is an HMAC signature? — Fun API Playground
================================================================

HMAC signature

HMAC — hash-based message authentication code — combines a secret key with a message under a hash function to produce a short value that can only be reproduced by someone who has the same key and the same message. It gives you authenticity and integrity together, without public-key cryptography.

How it works

The sender computes HMAC(secret, body) and puts the result in a header. The receiver computes the same thing over the body it received and compares. If either the body or the key differs, the values do not match. The comparison must be constant-time: a normal string comparison returns early on the first differing byte, which leaks enough timing information to reconstruct a valid signature given enough attempts.

The misconception

That a signature proves freshness. It does not — a valid signed payload stays valid forever, so an attacker who captures one can replay it. That is why signatures are normally computed over a timestamp as well as the body, and why receivers reject anything older than a few minutes.

Try it here

Trigger a webhook delivery and verify `x-funapi-signature` against the secret you were given at subscription time. Change one byte of the payload and the verification fails, which is the whole point.

Related
- Testing webhooks and HMAC signature verification
- What a webhook is

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/content-negotiation
TITLE: What is content negotiation? — Fun API Playground
================================================================

Content negotiation

Content negotiation is how one URL can serve several representations. The client states what it can accept; the server picks from what it can produce; the response says which was chosen. The resource is the same either way — only its rendering differs.

How it works

The client sends Accept with the media types it wants, optionally weighted with q-values. The server replies with Content-Type naming what it actually sent, and should send Vary: Accept so caches do not serve a JSON response to a client that asked for CSV. If nothing the client will accept can be produced, the answer is 406 Not Acceptable. The mirror case — the client sending a body in a type the server will not parse — is 415 Unsupported Media Type.

The misconception

That Accept is advisory and can be ignored. Many APIs do ignore it and always return JSON, which works until a client genuinely needs something else and gets JSON with a 200, silently. The honest answer to an unsatisfiable Accept header is a 406.

Try it here

The Protocol Lab negotiates for real: `GET /protocol/v1/export/documents` will produce JSON, CSV or XML depending on your Accept header, sets Content-Type to whatever it chose, and answers 406 rather than silently falling back when you ask for something it cannot make. The Friends API pairs it with a 415 on the way in.

Related
- HTTP 406 Not Acceptable
- HTTP 415 Unsupported Media Type

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/safe-and-idempotent-methods
TITLE: Safe vs idempotent HTTP methods — Fun API Playground
================================================================

Safe and idempotent methods

A method is safe if it does not change server state: GET, HEAD and OPTIONS. A method is idempotent if making the same request many times has the same effect as making it once: GET, HEAD, OPTIONS, PUT and DELETE. Every safe method is idempotent; the reverse is not true, because a DELETE changes state and is still idempotent.

How it works

These properties are what make automatic retries possible. A proxy, a browser or an HTTP library may retry an idempotent request after a timeout without asking, because repeating it cannot make things worse. POST and PATCH are neither safe nor idempotent, which is why nothing retries them for you — and why an Idempotency-Key header exists, to give a POST the property it lacks by nature.

The misconception

That idempotent means "returns the same response". It means the same *effect* on the server. A second DELETE of the same resource is idempotent even though the first returns 204 and the second returns 404: the end state — the thing is gone — is identical.

Try it here

`GET /starfleet/v1/tribbles` is a deliberate anti-pattern: a GET that doubles the count every time you read it. It is the clearest demonstration here of what "safe" is protecting you from.

Related
- Testing idempotency keys and safe retries
- What a REST API is

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/glossary/cors
TITLE: What is CORS? — Fun API Playground
================================================================

CORS

Cross-Origin Resource Sharing is a browser security mechanism. By default a page may send a request to another origin but not read the response. CORS is the set of response headers by which the target server opts in, telling the browser that this particular origin is allowed to see the result.

How it works

For simple requests the browser sends the request, then withholds the response from the page unless Access-Control-Allow-Origin matches. For anything else — a custom header, a JSON content type, a method beyond GET/POST/HEAD — the browser first sends an OPTIONS preflight and only proceeds if the answer permits the method and headers it intends to use. Credentials require both Access-Control-Allow-Credentials and a specific origin, never the wildcard.

The misconception

That a CORS error means the request failed. Usually it succeeded — the server received it, acted on it and answered — and the browser refused to hand the response to your code. A "CORS error" on a POST can mean the record was created and you simply cannot see the confirmation. It is also not a server-side protection: anything that is not a browser ignores CORS entirely.

Try it here

Run any request in Live API mode from your own page and watch the preflight. A missing OPTIONS handler surfaces as a CORS failure in the console and a plain 405 in the network tab.

Related
- HTTP 405 Method Not Allowed
- How the live API is served

Other terms
- Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
- REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
- ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
- HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
- Bearer token — A credential where possession alone grants access — whoever holds it can use it.
- JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary
TITLE: API Test Sözlüğü — Fun API Playground
================================================================

API test sözlüğü

Bu API’lerin çalıştırdığı kavramlar: her biri bir paragrafta tanımlanıyor, sonra çağırabileceğiniz bir uç noktayla gösteriliyor. Her madde, o kavram hakkında insanların gerçekte tuttuğu yanlış inanışı da söylüyor — çünkü tanımı okumakla doğru anlamak arasında duran şey genellikle odur.

- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.
- Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı.
- HMAC imzası — Bir yükün, paylaşılan gizli anahtarı bilen birinden geldiğini ve değiştirilmediğini kanıtlayan anahtarlı özet.
- İçerik uzlaşımı — İstemci ile sunucunun yanıtın biçiminde, ayrı adresler üzerinden değil başlıklarla anlaşması.
- Güvenli ve idempotent metotlar — Bir istemcinin neyi yeniden deneyebileceğini belirleyen, birbirinden bağımsız iki HTTP metodu özelliği.
- CORS — Bir kaynaktaki JavaScript’in başka bir kaynaktan gelen yanıtı okuyup okuyamayacağına karar veren tarayıcı kuralı.

Read this page in English

Test teknikleri · Her HTTP durum kodu · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/mock-api
TITLE: Mock API nedir? — Fun API Playground
================================================================

Mock API

Bir mock API, isteklere gerçek bir servisin döneceği gibi cevap verir — aynı adresler, aynı durum kodları, aynı yanıt biçimleri — ama gerçek servisin bağlı olduğu hiçbir şeye ihtiyaç duymadan. Var olma sebebi, gerçek servis hazır değilken bir istemcinin yazılabilmesi, gösterilebilmesi ya da test edilebilmesi; ya da gerçeğini çağırmanın yavaş, pahalı, kotalı veya geri alınamaz olması.

Nasıl çalışır

Mock’lar kabaca üç biçimde gelir. Statik mock her seferinde aynı hazır yanıtı döner. Yapılandırılabilir mock, her uç nokta için ne döneceğini sizin bildirmenize izin verir. Simüle edilmiş mock — bu oyun alanının olduğu tür — gerçekten durum tutar: POST ettiğiniz şeyi sonraki GET bulur, DELETE onu siler, stok seviyesi, koltuk doluluğu ve sürüm çakışması gibi kısıtlar anlatılmaz, uygulanır.

Yaygın yanılgı

Yaygın varsayım, mock’un hata yönetimini sınayamayacağıdır, çünkü mock her zaman başarılı olur. Bu, mock’lamanın değil çoğu mock’un özelliğidir. Oysa asıl değerli olan hata yollarıdır — 409, 412, 429, 503 — çünkü bunları gerçek bir serviste kasten üretmek en zor olanıdır. Sadece 200 dönen bir API, tam da bu yüzden zayıf bir alıştırma hedefidir.

Burada deneyin

Buradaki her API iki şekilde çalışır: hiç ağ kullanmadan tamamen tarayıcınızın içinde, ya da HTTPS üzerinden canlı bir arka uca karşı. Tarayıcıdaki motor aynı koddur, dolayısıyla yanıtlar birebir örtüşür.

İlgili
- Negatif test: istediğiniz an her hata kodu
- Bu oyun alanı gerçekte nasıl sunuluyor

Diğer terimler
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.
- Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/rest-api
TITLE: REST API nedir? — Fun API Playground
================================================================

REST API

REST bir mimari üsluptur, bir şartname değil. Pratikte bir API’yi RESTful yapan şunlardır: sistemdeki şeylerin birer adresi vardır, HTTP metodu onlara ne yapılmasını istediğinizi söyler, durum kodu ne olduğunu söyler, ve sunucu istekler arasında istemciye özel oturum tutmaz. Sunucunun bir isteği karşılamak için ihtiyaç duyduğu her şey o istekle birlikte gelir.

Nasıl çalışır

Bir koleksiyon bir yolda durur — /characters — ve içindeki tekil öğe /characters/1 adresinde. GET okur, POST yaratır, PUT değiştirir, PATCH kısmen günceller, DELETE siler. Filtreleme, sıralama ve sayfalama sorgu dizesinde taşınır. Temsil biçimi URL’ye gömülmez, Accept ve Content-Type ile anlaşılır. Asıl sonuç durum kodudur: yalnızca gövdeyi okuyan bir istemci cevabın yarısını atıyor demektir.

Yaygın yanılgı

REST’in “HTTP üzerinden JSON” demek olduğu sanılır. Değildir — REST JSON hakkında hiçbir şey söylemez, ve JSON dönen pek çok HTTP API’si hiç de RESTful değildir (gövdesinde eylem adı taşıyan tek bir /api uç noktası, REST kılığına girmiş RPC’dir). Ayırt edici özellik, kaynakların adreslenebilir olması ve fiili metodun taşımasıdır.

Burada deneyin

Katalogda 39 REST API ve aralarında 337 uç nokta var. Temelleri çalışmak için herhangi biri yeterli; Protocol Lab ise özellikle çoğu mock API’nin atladığı HTTP ayrıntıları üzerine kurulu olanı.

İlgili
- Başlangıç rehberi
- Güvenli ve idempotent metotlar

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.
- Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/etag
TITLE: ETag nedir? — Fun API Playground
================================================================

ETag

ETag, sunucunun yanıta iliştirdiği ve o kaynağın tam olarak o sürümünü tanımlayan bir dizedir. Opaktır: bir özet, bir sürüm numarası ya da bir zaman damgası olabilir, ve istemci onu asla yorumlamaya çalışmamalı — yalnızca geri göndermelidir.

Nasıl çalışır

Okumada istemci ETag’i If-None-Match ile geri yollar; hâlâ eşleşiyorsa sunucu gövdesiz bir 304 Not Modified döner ve istemci kendi kopyasını kullanır. Yazmada aynı değeri If-Match ile yollar; artık eşleşmiyorsa sunucu 412 Precondition Failed döner ve yazma reddedilir. Aynı değer, iki başlık, bambaşka iki iş — biri bant genişliği kazandırır, diğeri kaybolan güncellemeyi önler.

Yaygın yanılgı

ETag uyuşmazlığının bir arıza olduğu sanılır. 412 tam tersine mekanizmanın çalıştığı andır: siz okuduktan sonra bir başkası kaynağı değiştirmiştir ve sizin yazmanız onun değişikliğini sessizce ezecekti. Doğru tepki yeniden okuyup uzlaştırmak ve yeni ETag ile tekrar denemektir — eskisiyle tekrar denemek sonsuza kadar aynı 412’yi üretir.

Burada deneyin

Football ve FIBA puan durumu uç noktaları koşullu okumalara 304 ile cevap verir. Karakter, kahraman ve film yazmaları If-Match kabul eder ve sürüm eskimişse gerçek bir 412 üretir.

İlgili
- ETag ve If-Match ile iyimser eşzamanlılık testi
- HTTP 412 Precondition Failed
- HTTP 304 Not Modified

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.
- Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/hateoas
TITLE: HATEOAS nedir? — Fun API Playground
================================================================

HATEOAS

HATEOAS, bir istemcinin ne yapabileceğini dokümantasyona bakıp URL gömerek değil, aldığı yanıtlardan keşfetmesi gerektiğini söyleyen kısıttır. Her temsil bağlantılar taşır ve istemciyi bir durumdan diğerine götüren o bağlantılardır.

Nasıl çalışır

Yanıt, mevcut geçişleri ve adreslerini adlandıran bir bağlantı yapısı içerir — genellikle `_links`: self, next, cancel, approve. İstemci yapmak istediği şeyin adını taşıyan bağlantıyı izler. Hangi bağlantıların bulunacağı mevcut duruma bağlı olduğundan, kargoya verilmiş bir sipariş cancel bağlantısını hiç taşımaz ve istemcinin iptalin ne zaman mümkün olduğuna dair kendi kuralına ihtiyacı kalmaz.

Yaygın yanılgı

HATEOAS’ın akademik olduğu ve kimsenin uygulamadığı sanılır. Kısmi HATEOAS her yerdedir: sayfalanmış bir yanıttaki `next` adresi tam olarak bu fikirdir, ve sayfa sayacını artırmak yerine o bağlantıyı izleyen istemci şimdiden kazanmaktadır — sunucu cursor sayfalamaya geçtiğinde çalışmayı sürdürür.

Burada deneyin

Protocol Lab’in doküman uç noktaları her öğeye `_links` ekler. Bank işlem listesi ise istemcinin kurgulaması değil izlemesi beklenen bir cursor kullanır.

İlgili
- Gerçek bir API’ye karşı sayfalama testi
- REST API nedir

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.
- Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/bearer-token
TITLE: Bearer token nedir? — Fun API Playground
================================================================

Bearer token

Bearer token, Authorization başlığında `Authorization: Bearer <token>` biçiminde gönderilir ve isteği sadece sunulmuş olmakla yetkilendirir. İstek üzerinde bir imza yoktur, gönderenin token’ın verildiği taraf olduğuna dair bir kanıt yoktur: token’ın kendisi kimlik bilgisinin tamamıdır — “bearer”, yani “hamiline”, tam olarak bu demektir.

Nasıl çalışır

Sunucu token’ı doğrular — ya kayıtlarında arayarak ya da JWT gibi kendi içinde taşıyorsa imzasını sınayarak — ve çağıranın kimliğini ve yetkilerini oradan çıkarır. Eksik ya da geçersiz token 401’dir. Geçerli ama bu işlemi yapmaya yetkisi olmayan bir token 403’tür; aradaki fark önemlidir, çünkü ikisinden yalnızca biri yeni bir token alarak çözülür.

Yaygın yanılgı

Süresi dolduğu için bearer token’ı URL’ye koymanın güvenli olduğu sanılır. URL’ye giren her şey sunucu günlüklerine, tarayıcı geçmişine, referrer başlıklarına ve analitiğe girer. Bearer token’ın yeri, TLS üzerinde bir başlıktır: kısa ömürlü ve bir yenileme mekanizmasına bağlı.

Burada deneyin

Kilit işaretli her uç nokta `qa-admin-token` ya da `qa-viewer-token` kabul eder. 401/403 ayrımını görmenin en temiz yolu viewer token’ı bir DELETE üzerinde denemektir: token geçerlidir, cevap yine de hayırdır.

İlgili
- OAuth 2.0, JWT ve token süresi testi
- HTTP 401 Unauthorized
- HTTP 403 Forbidden

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.
- Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/jwt
TITLE: JWT nedir? — Fun API Playground
================================================================

JWT (JSON Web Token)

JWT, noktayla ayrılmış üç base64url parçadır: imza algoritmasını bildiren bir başlık, iddiaların (claim) bulunduğu bir yük, ve ilk ikisinin üzerine atılmış bir imza. İmza yükün değiştirilmediğini kanıtladığı için sunucu, hiçbir oturum durumu saklamadan içindeki iddialara güvenebilir.

Nasıl çalışır

İstemci onu bearer token olarak yollar. Sunucu imzayı anahtarıyla doğrular, sonra iddiaları okur — özne için `sub`, sona erme için `exp`, düzenlenme zamanı için `iat`, artı düzenleyicinin eklemeyi seçtiği roller veya kapsamlar. Süre dolumunu sunucunun `exp` denetimi uygular; token’ın içinde onun gönderilmesini engelleyen hiçbir şey yoktur.

Yaygın yanılgı

JWT’nin şifreli olduğu sanılır. İmzalıdır, şifreli değil: token’ı eline geçiren herkes yükü çözüp içindeki her iddiayı okuyabilir. Gizli hiçbir şeyin JWT’de işi yoktur. İkinci yanılgı JWT’nin iptal edilebileceğidir — durumsuz bir token süresi dolana kadar geçerli kalır, kısa ömürler ve refresh token’lar tam da bu yüzden vardır.

Burada deneyin

`POST /auth/v1/login` ile admin/admin123 gerçekten imzalanmış bir JWT verir. Ortadaki parçayı çözüp kendi iddialarınızı okuyun; sonra süresinin dolmasını bekleyip 401’in gelişini izleyin.

İlgili
- OAuth 2.0, JWT ve token süresi testi
- Bearer token nedir

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- Webhook — Siz sorup durmayasınız diye, bir şey olduğunda sunucunun size gönderdiği HTTP geri çağrısı.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/webhook
TITLE: Webhook nedir? — Fun API Playground
================================================================

Webhook

Webhook alışıldık yönü tersine çevirir. İstemci bir şeyin değişip değişmediğini tekrar tekrar sormak yerine kendine ait bir adres kaydeder, ve olay gerçekleştiğinde sunucu o adrese bir HTTP isteği yapar. İstemci, o istekler süresince, sunucu hâline gelir.

Nasıl çalışır

Sağlayıcıya bir adres verip genellikle paylaşılan bir gizli anahtar alarak abone olursunuz. Olay tetiklendiğinde sağlayıcı o adrese bir yük POST eder ve bunu imzalar — tipik olarak ham gövde üzerinden bir HMAC, bir başlıkta. Uç noktanız imzayı doğrular, hızlıca 2xx döner ve asıl işi sonrasında yapar. Sağlayıcılar 2xx olmayan yanıtları yeniden dener, dolayısıyla teslimatlar birden fazla kez gelebilir ve gelecektir.

Yaygın yanılgı

Webhook almanın olayın doğru olduğu anlamına geldiği sanılır. Doğrulanmayan bir webhook uç noktası, herkesin her şeyi POST edebileceği açık bir adrestir. İmza isteğe bağlı değildir, ve gelen tam baytlar üzerinden hesaplanmalıdır — JSON’u önce ayrıştırıp yeniden serileştirmek, doğru yazılmış bir uygulamanın doğrulamada başarısız olmasının en sık sebebidir.

Burada deneyin

Webhooks API’si abone olmanıza, bir teslimat tetiklemenize, `x-funapi-signature` başlığını okuyup doğrulamanıza — sonra yükü kurcalayıp doğrulamanın çöküşünü izlemenize izin verir.

İlgili
- Webhook ve HMAC imza doğrulama testi
- HMAC imzası nedir

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/hmac-signature
TITLE: HMAC imzası nedir? — Fun API Playground
================================================================

HMAC imzası

HMAC — hash-based message authentication code — gizli bir anahtarı bir mesajla birlikte bir özet fonksiyonundan geçirerek, yalnızca aynı anahtara ve aynı mesaja sahip olanın üretebileceği kısa bir değer verir. Açık anahtarlı kriptografiye gerek kalmadan hem özgünlüğü hem bütünlüğü aynı anda sağlar.

Nasıl çalışır

Gönderen HMAC(gizli, gövde) hesaplar ve sonucu bir başlığa koyar. Alıcı aynı hesabı aldığı gövde üzerinde yapar ve karşılaştırır. Gövde ya da anahtar farklıysa değerler tutmaz. Karşılaştırma sabit zamanlı olmalıdır: sıradan bir dize karşılaştırması ilk farklı baytta döner, ve bu zamanlama farkı yeterince denemeyle geçerli bir imzanın yeniden kurulmasına izin verecek kadar bilgi sızdırır.

Yaygın yanılgı

İmzanın tazeliği kanıtladığı sanılır. Kanıtlamaz — geçerli imzalı bir yük sonsuza kadar geçerli kalır, dolayısıyla birini yakalayan saldırgan onu tekrar oynatabilir. İmzalar bu yüzden normalde gövdeyle birlikte bir zaman damgası üzerinden hesaplanır ve alıcılar birkaç dakikadan eskisini reddeder.

Burada deneyin

Bir webhook teslimatı tetikleyin ve `x-funapi-signature` başlığını abonelikte size verilen gizli anahtara karşı doğrulayın. Yükün tek bir baytını değiştirin, doğrulama başarısız olur — bütün mesele bu.

İlgili
- Webhook ve HMAC imza doğrulama testi
- Webhook nedir

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/content-negotiation
TITLE: İçerik uzlaşımı (content negotiation) nedir? — Fun API
================================================================

İçerik uzlaşımı

İçerik uzlaşımı, tek bir adresin birden çok temsil sunabilmesinin yoludur. İstemci neyi kabul edebileceğini bildirir; sunucu üretebildikleri arasından seçer; yanıt hangisinin seçildiğini söyler. Kaynak her iki durumda da aynıdır — değişen yalnızca sunuluş biçimidir.

Nasıl çalışır

İstemci istediği ortam türlerini Accept ile, gerekirse q değerleriyle ağırlıklandırarak yollar. Sunucu gerçekte ne gönderdiğini Content-Type ile bildirir ve Vary: Accept göndermelidir, yoksa önbellek CSV isteyen bir istemciye JSON servis eder. İstemcinin kabul edeceği hiçbir şey üretilemiyorsa cevap 406 Not Acceptable’dır. Aynanın öbür yüzü — istemcinin sunucunun ayrıştıramayacağı bir türde gövde göndermesi — 415 Unsupported Media Type’tır.

Yaygın yanılgı

Accept başlığının tavsiye niteliğinde olduğu ve yok sayılabileceği sanılır. Pek çok API onu yok sayıp hep JSON döner; bu, bir istemcinin gerçekten başka bir şeye ihtiyacı olana kadar çalışır, sonra sessizce 200 ile JSON döner. Karşılanamayan bir Accept başlığının dürüst cevabı 406’dır.

Burada deneyin

Protocol Lab bunu gerçekten yapar: `GET /protocol/v1/export/documents` Accept başlığınıza göre JSON, CSV veya XML üretir, seçtiğini Content-Type ile bildirir, ve üretemediği bir şey istediğinizde sessizce geri düşmek yerine 406 döner.

İlgili
- HTTP 406 Not Acceptable
- HTTP 415 Unsupported Media Type

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/safe-and-idempotent-methods
TITLE: Güvenli ve idempotent HTTP metotları — Fun API Playground
================================================================

Güvenli ve idempotent metotlar

Bir metot sunucu durumunu değiştirmiyorsa güvenlidir: GET, HEAD, OPTIONS. Aynı isteği çok kez yapmak bir kez yapmakla aynı etkiyi bırakıyorsa idempotenttir: GET, HEAD, OPTIONS, PUT ve DELETE. Her güvenli metot idempotenttir; tersi doğru değildir, çünkü DELETE durumu değiştirdiği hâlde idempotenttir.

Nasıl çalışır

Otomatik yeniden denemeyi mümkün kılan tam olarak bu özelliklerdir. Bir vekil sunucu, bir tarayıcı ya da bir HTTP kütüphanesi, zaman aşımından sonra idempotent bir isteği size sormadan tekrarlayabilir, çünkü tekrarlamak durumu kötüleştiremez. POST ve PATCH ne güvenli ne idempotenttir; hiçbir katman onları sizin yerinize tekrarlamaz — ve Idempotency-Key başlığı, bir POST’a doğuştan sahip olmadığı özelliği vermek için vardır.

Yaygın yanılgı

İdempotentin “aynı yanıtı döner” demek olduğu sanılır. Sunucu üzerindeki aynı *etki* demektir. Aynı kaynağın ikinci DELETE’i, birincisi 204 ve ikincisi 404 dönse bile idempotenttir: son durum — o şeyin artık olmaması — aynıdır.

Burada deneyin

`GET /starfleet/v1/tribbles` bilinçli bir anti-örnektir: her okumada sayıyı ikiye katlayan bir GET. “Güvenli” olmanın neyi koruduğunu buradaki en net gösteren şey odur.

İlgili
- Idempotency key ve güvenli yeniden deneme testi
- REST API nedir

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tr/glossary/cors
TITLE: CORS nedir? — Fun API Playground
================================================================

CORS

Cross-Origin Resource Sharing bir tarayıcı güvenlik mekanizmasıdır. Öntanımlı olarak bir sayfa başka bir kaynağa istek gönderebilir ama yanıtı okuyamaz. CORS, hedef sunucunun bu belirli kaynağın sonucu görmesine izin verdiğini tarayıcıya bildirdiği yanıt başlıkları kümesidir.

Nasıl çalışır

Basit isteklerde tarayıcı isteği gönderir, sonra Access-Control-Allow-Origin eşleşmiyorsa yanıtı sayfadan saklar. Bunun dışındaki her şeyde — özel bir başlık, JSON içerik türü, GET/POST/HEAD dışında bir metot — tarayıcı önce bir OPTIONS ön uçuşu gönderir ve ancak cevap kullanacağı metoda ve başlıklara izin veriyorsa devam eder. Kimlik bilgisi taşıyan istekler hem Access-Control-Allow-Credentials hem de joker değil belirli bir kaynak ister.

Yaygın yanılgı

CORS hatasının isteğin başarısız olduğu anlamına geldiği sanılır. Genellikle başarılı olmuştur — sunucu isteği almış, işlemiş ve cevap vermiştir — tarayıcı yalnızca yanıtı kodunuza vermeyi reddetmiştir. Bir POST’ta “CORS hatası”, kayıt yaratıldı ama onayını göremiyorsunuz demek olabilir. CORS bir sunucu tarafı koruması da değildir: tarayıcı olmayan hiçbir şey onu dikkate almaz.

Burada deneyin

Herhangi bir isteği kendi sayfanızdan Live API kipinde çalıştırıp ön uçuşu izleyin. Eksik bir OPTIONS işleyicisi konsola CORS hatası, ağ sekmesine düpedüz 405 olarak düşer.

İlgili
- HTTP 405 Method Not Allowed
- Canlı API nasıl sunuluyor

Diğer terimler
- Mock API — Arkasındaki gerçek sistem olmadan, gerçekçi yanıtlar döndüren bir API taklidi.
- REST API — Bir sistemi adreslenebilir kaynaklar olarak modelleyen ve onları standart HTTP metotlarıyla değiştiren API.
- ETag — Bir temsilin sürümünü belirten opak bir kimlik: hem yeniden göndermeyi önler hem de çakışan yazmaları yakalar.
- HATEOAS — Uygulama durumunun motoru olarak hipermedya — yanıtlar, bundan sonra ne yapabileceğinizin bağlantılarını taşır.
- Bearer token — Yalnızca elinde bulundurmanın erişim sağladığı kimlik bilgisi — kim taşıyorsa o kullanabilir.
- JWT (JSON Web Token) — Sunucunun veritabanına gitmeden doğrulayabildiği, imzalı ve kendi içinde taşınan bir token.

Read this page in English

Tüm sözlük maddeleri · Test teknikleri · 39 mock REST API’nin tamamı

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/compare/jsonplaceholder-alternative
TITLE: JSONPlaceholder alternative — Fun API Playground
================================================================

A JSONPlaceholder alternative that keeps what you write

JSONPlaceholder is the free fake REST API almost every tutorial reaches for, and deservedly: six resources, no signup, no configuration, and a URL short enough to type from memory. It is close to perfect for the thing it was built for — giving a front-end something to render while the real API does not exist yet.

At a glance

JSONPlaceholder compared with this playground, checked 2026-09.
JSONPlaceholderFun API PlaygroundWrites persistNo — the response looks right, the data does not changeYes, for the life of your sandboxResources6 fixed collections39 APIs, 337 endpointsAuthNoneBearer roles, signed JWTs, full OAuth 2.0 flowsError codes on demand404 only, from unknown ids28 codes, each from an endpoint that means itConcurrencyNot modelledETag / If-Match with a real 412Spec exportNoneOpenAPI 3.1 and Postman, per API and mergedWorks offlineNoYes — the engine runs in the browserRecognisabilityUniversal; in every tutorialNew, and has to be explained
Where it stops

It accepts POST, PUT, PATCH and DELETE and pretends to honour them. The response looks right, complete with a new id, and nothing has changed: fetch the resource afterwards and your write is not there. That is a deliberate design decision for a shared public service, and it is also the point at which it stops being useful for testing rather than prototyping — you cannot verify a create, you cannot test a conflict, and you cannot chain one request into the next.

What is different here

Here, writes persist. Create a character and it is in the collection; delete it and the next GET returns 404. Callers are isolated from one another — by an X-Sandbox-ID header against the live API, and by running the whole engine locally in the browser — which is what makes persistence safe on a public service. Beyond that the surface is much wider: 39 domains rather than 6 resources, real Bearer and JWT auth with a role that gets a 403, ETag and If-Match concurrency, Idempotency-Key replay, rate limits that really limit, webhooks with verifiable HMAC signatures, and every HTTP status code in the catalog reachable on demand.

What JSONPlaceholder does better

- Universally recognised — a JSONPlaceholder URL in a code sample needs no explanation, and it appears in tutorials, courses and StackOverflow answers everywhere.
- A smaller surface to learn: six resources with obvious names, and nothing else to understand.
- Its shape (posts, comments, users, todos) is the canonical example for front-end tutorials, and matches what most sample UIs expect.

What this playground does better

- Writes persist, so a create can be verified and requests can be chained.
- 39 APIs and 337 endpoints across fandoms, business domains and pure protocol exercises.
- Real auth: Bearer tokens with roles, signed JWTs, and complete OAuth 2.0 flows.
- Error paths on demand — 409, 412, 413, 415, 422, 429, 503 — rather than only the happy one.
- OpenAPI 3.1 and Postman exports per API, plus a merged spec for the whole catalog.
- Runs entirely in the browser, so it works with no network and cannot be rate-limited by other people's traffic.

Which to use

Use JSONPlaceholder when you need a body to render and nothing else. Come here when the thing you are testing is the HTTP: the failures, the auth, the concurrency and the retries.

Checked against JSONPlaceholder as of 2026-09.

Other comparisons
- httpbin — httpbin shows you the request. This shows you an API. They answer different questions.
- reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path.
- the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs.

All 39 mock REST APIs · Getting started guide · About this playground

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/compare/httpbin-alternative
TITLE: httpbin alternative — Fun API Playground
================================================================

An httpbin alternative with resources, not just reflections

httpbin is a request-and-response inspector: send it something and it tells you exactly what arrived. Headers, IP, auth schemes, redirects, delays, compression, and a /status/:code endpoint that will return any status you name. It is the tool of choice for debugging what your client is actually sending, and it is also easy to self-host from its Docker image, which matters in a locked-down network.

At a glance

httpbin compared with this playground, checked 2026-09.
httpbinFun API PlaygroundRequest inspectionIts whole purpose — headers, body, encoding, IPNot offered; use httpbin for thisSelf-hostingOne Docker commandNot packaged for self-hostingDomain resourcesNone by design39 APIs with persistent stateStatus codesAny code, on request, with nothing behind it28 codes, each caused by real behaviour409 ConflictReturned because you askedReturned because the seat is takenAuthSchemes echoed back, no token lifecycleTokens that are issued, expire and refreshWebhooksNot offeredSubscribe, trigger, verify the HMAC signatureInteractive docsA single reference pageSwagger-style, with Try it out and nine languages
Where it stops

What it deliberately does not have is a domain. There are no resources to create, list, filter or conflict with, so there is nothing to test a client against — only the protocol layer, reflected back. Asking httpbin for a 409 gives you a 409 with no conflict behind it, which is fine for checking your error handler compiles and useless for checking that it does the right thing.

What is different here

This playground has the protocol layer too — the Protocol Lab covers redirects and redirect chains, 202 job polling, JSON Patch, content negotiation, ranges, conditional requests and on-demand 503s and 504s — but it hangs that layer off resources with real state. A 409 here is a seat that is genuinely taken; a 412 is a version that genuinely moved; a 429 is a limit you genuinely exceeded. The error is the consequence of something, which is what makes the handling of it testable.

What httpbin does better

- Self-hostable in one Docker command, which is often the deciding factor inside a corporate network.
- Unbeatable for inspecting exactly what your client sent — headers, encoding, body, and the IP it arrived from.
- Every status code, including ones no real API would produce, with no catalog to navigate.
- Zero state means zero surprises: it behaves identically on the thousandth request.

What this playground does better

- Status codes arrive as the outcome of real behaviour rather than on request.
- Persistent resources, so a test can create, read, modify and conflict.
- Interactive documentation with a Try it out panel and generated code in nine languages.
- Auth flows with actual token lifecycles, not just a scheme that echoes back.
- Webhook deliveries you can subscribe to, trigger and verify.

Which to use

They are complements more than competitors. Reach for httpbin to find out what your client is sending; reach for this to find out how it behaves when a real API answers badly.

Checked against httpbin as of 2026-09.

Other comparisons
- JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference.
- reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path.
- the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs.

All 39 mock REST APIs · Getting started guide · About this playground

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/compare/reqres-alternative
TITLE: reqres alternative — Fun API Playground
================================================================

A reqres alternative with more than users and a login

reqres.in is a small hosted REST API — a paginated list of users, a couple of resource collections, register and login endpoints that hand back a token, and a delay parameter for testing spinners. Its virtue is how quickly it can be understood: the whole surface fits on one page, and the pagination is correct enough to build a real list view against.

At a glance

reqres.in compared with this playground, checked 2026-09.
reqres.inFun API PlaygroundSurfaceOne page — users, a couple of collections, login39 APIs across four categoriesTokensA string handed back; nothing verifies itSigned JWTs with real claims and a real expiryOAuth 2.0Not offeredAuthorization code, client credentials, refreshRolesNoneViewer token reads, and gets a 403 on DELETEWrites persistNoYes, so requests can be chainedPaginationPage-number, correct enough to build againstPage-number and cursor, with the edge casesArtificial delayA ?delay parameterAsync 202 job polling insteadLearning curveMinutes — the whole API fits in your headA catalog to navigate
Where it stops

Its writes are not persisted, its tokens are not real credentials that anything verifies, and its error surface is a handful of cases rather than a system. For a UI demo that needs a plausible user list and a login screen, that is plenty. For testing what your client does when a token expires halfway through a suite, or when two writes collide, there is nothing there to test against.

What is different here

The auth here is the part that differs most. `POST /auth/v1/login` issues a genuinely signed JWT with real claims and a real expiry; the OAuth 2.0 endpoints run authorization-code, client-credentials and refresh-token flows properly, so a token can be obtained, used, expired and refreshed within one test run. Role separation is real too: the viewer token succeeds on reads and returns 403 on a DELETE, which is the case most auth tests never cover.

What reqres.in does better

- Very small and immediately comprehensible — you can hold the entire API in your head.
- A built-in delay parameter that makes loading states easy to demonstrate.
- A user-list shape that drops straight into most tutorial UIs.

What this playground does better

- JWTs that are actually signed and actually expire, and OAuth flows that actually complete.
- Role-based access with a genuine 403, not just a 401 for a missing token.
- Writes that persist for the duration of your sandbox, so requests can be chained.
- Pagination in both page-number and cursor form, with the edge cases that break clients.
- 39 domains instead of one, so the data is not the thing you are concentrating on.

Which to use

reqres is the better choice for a quick UI mock-up with a login screen. This is the better choice once the auth behaviour itself is what you are testing.

Checked against reqres.in as of 2026-09.

Other comparisons
- JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference.
- httpbin — httpbin shows you the request. This shows you an API. They answer different questions.
- the free mock API landscape — Six free options, what each is genuinely for, and how to tell which one your problem needs.

All 39 mock REST APIs · Getting started guide · About this playground

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/compare/free-mock-api-tools
TITLE: Free mock APIs compared — Fun API Playground
================================================================

Free mock APIs compared: which one for which job

The free tools in this space fall into three groups, and most of the frustration people have with them comes from reaching into the wrong group. Knowing which is which takes about a minute and saves an afternoon.

At a glance

the free mock API landscape compared with this playground, checked 2026-09.
Fixed datasetReflectorConfigurable mockThis playgroundJSONPlaceholder, reqreshttpbin, Postman EchoMockoon, WireMock, Beeceptorfunapi.devSetup requiredNoneNoneYou define every responseNoneWrites persistNoN/A — no resourcesIf you configure itYesWho wrote the rulesThe maintainersNobody — it reflectsYou didSomebody else, which is the pointStateful failuresNoNoOnly ones you scriptedYes — 409, 412, 429 with a causeRuns offlineNoIf self-hostedYesYes — the engine is in the browserSpec exportNoNoUsually spec-driven alreadyOpenAPI 3.1 and PostmanBest forA body to renderWhat did my client sendReproducing one exact contractRehearsing how an API misbehaves
Where it stops

The groups are: fixed public datasets you cannot change (JSONPlaceholder, reqres); protocol reflectors with no domain (httpbin, Postman Echo); and configure-your-own mock servers where you define the responses yourself (Mockoon, WireMock, Beeceptor, Prism, Mocky). Each is good at its own job and poor at the others, and none of the first two lets you provoke a stateful failure.

What is different here

This playground is a fourth thing: a simulated API with persistent per-caller state and behaviour that pushes back. You do not configure the responses — the point is that you did not write them, so you find out how your client copes with rules somebody else chose. That is closer to integrating with a real third-party API than any config file can be, and it is the gap the other three groups leave.

What the free mock API landscape does better

- A fixed public dataset is better when you want a body to render and nothing more.
- A protocol reflector is better when the question is "what did my client actually send".
- A configurable mock server is better when you must reproduce one specific third-party contract exactly, or run entirely offline inside CI with no external dependency at all.
- A self-hosted option is better where the network will not allow outbound calls.

What this playground does better

- Nothing to configure, install or sign up for.
- Stateful behaviour with real constraints, so failures happen for reasons.
- Every HTTP status code in the catalog reachable from a documented endpoint.
- The full engine runs in the browser, so it also works with no network at all.
- OpenAPI 3.1 and Postman exports, so anything you practise here moves into your own tooling.

Which to use

Pick by the question you are asking. Rendering a list: a fixed dataset. Debugging your client: a reflector. Reproducing one exact contract: a configurable mock. Learning or rehearsing how an API behaves when things go wrong: this.

Checked against the free mock API landscape as of 2026-09.

Other comparisons
- JSONPlaceholder — JSONPlaceholder fakes its writes. If you need a POST that a later GET can find, that is the difference.
- httpbin — httpbin shows you the request. This shows you an API. They answer different questions.
- reqres.in — reqres is a clean, tiny user API with fake auth. The gap is everything past the happy path.

All 39 mock REST APIs · Getting started guide · About this playground

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tools/curl-converter
TITLE: curl to code converter — Fun API Playground
================================================================

Convert a curl command to code

Paste any curl command — including one copied straight out of your browser's network tab with "Copy as cURL" — and get the same request written out in nine languages. The command is parsed in the page: method, URL, headers and body are read out of it and then re-rendered, so what comes back is the request you pasted rather than a template with your URL dropped into it.

Worked example

This command:

curl -X POST 'https://funapi.dev/api/friends/v1/characters' \
-H 'Authorization: Bearer qa-admin-token' \
-H 'Content-Type: application/json' \
-d '{"name":"Gunther","job":"Head barista"}'

is parsed as POST https://funapi.dev/api/friends/v1/characters with 2 header(s) and a 39-byte body, and converts to:

JavaScript (fetch)
const res = await fetch("https://funapi.dev/api/friends/v1/characters", {
method: "POST",
headers: {
"Authorization": "Bearer qa-admin-token",
"Content-Type": "application/json"
},
body: "{\"name\":\"Gunther\",\"job\":\"Head barista\"}"
});
console.log(res.status, await res.json());
JavaScript (axios)
import axios from 'axios';

const res = await axios({
method: "post",
url: "https://funapi.dev/api/friends/v1/characters",
headers: {
"Authorization": "Bearer qa-admin-token",
"Content-Type": "application/json"
},
data: {"name":"Gunther","job":"Head barista"}
});
console.log(res.status, res.data);
Python (requests)
import requests

url = "https://funapi.dev/api/friends/v1/characters"
headers = {
"Authorization": "Bearer qa-admin-token",
"Content-Type": "application/json"
}
payload = {"name":"Gunther","job":"Head barista"}

res = requests.post(url, headers=headers, json=payload)
print(res.status_code, res.json())
Go (net/http)
package main

import (
"fmt"
"io"
"net/http"
"strings"
)

func main() {
req, _ := http.NewRequest("POST", "https://funapi.dev/api/friends/v1/characters", strings.NewReader("{\"name\":\"Gunther\",\"job\":\"Head barista\"}"))
req.Header.Set("Authorization", "Bearer qa-admin-token")
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
out, _ := io.ReadAll(res.Body)
fmt.Println(res.StatusCode, string(out))
}
C# (HttpClient)
using var client = new HttpClient();
var req = new HttpRequestMessage(HttpMethod.Post, "https://funapi.dev/api/friends/v1/characters");
req.Headers.TryAddWithoutValidation("Authorization", "Bearer qa-admin-token");
req.Content = new StringContent("{\"name\":\"Gunther\",\"job\":\"Head barista\"}", Encoding.UTF8, "application/json");
var res = await client.SendAsync(req);
Console.WriteLine((int)res.StatusCode);
Console.WriteLine(await res.Content.ReadAsStringAsync());
Java (RestAssured)
given()
.header("Authorization", "Bearer qa-admin-token")
.header("Content-Type", "application/json")
.body("{\"name\":\"Gunther\",\"job\":\"Head barista\"}")
.when()
.post("https://funapi.dev/api/friends/v1/characters")
.then()
.statusCode(200);
Playwright
import { test, expect } from '@playwright/test';

test('POST request', async ({ request }) => {
const res = await request.post("https://funapi.dev/api/friends/v1/characters", {
headers: {
"Authorization": "Bearer qa-admin-token",
"Content-Type": "application/json"
},
data: {"name":"Gunther","job":"Head barista"}
});
expect(res.status()).toBe(200);
});
k6
import http from 'k6/http';
import { check } from 'k6';

export default function () {
const res = http.request("POST", "https://funapi.dev/api/friends/v1/characters", "{\"name\":\"Gunther\",\"job\":\"Head barista\"}", { headers: {
"Authorization": "Bearer qa-admin-token",
"Content-Type": "application/json"
} });
check(res, { 'status is 200': r => r.status === 200 });
}
HTTPie
echo "{\"name\":\"Gunther\",\"job\":\"Head barista\"}" | http POST "https://funapi.dev/api/friends/v1/characters" Authorization:"Bearer qa-admin-token" Content-Type:"application/json"

What it handles
Backslash line continuations and the caret form cmd.exe uses, single and double quoting with escapes, repeated -H headers, repeated -d bodies joined the way curl joins them, -u basic auth normalised into an Authorization header, and the pile of flags a devtools copy brings along (--compressed, -s, -L, --max-time and friends), which are recognised and dropped rather than mistaken for the URL.
The two things it makes explicit
curl defaults to POST when you give it a body and no method, and it sets a content type you never wrote. Every other client in the list does neither. Both are therefore made explicit in the output — an inferred POST and an inferred Content-Type — because the most common way a converted request stops working is that the implicit half of the curl command did not come with it.
When it refuses
An unknown flag that might take a value stops the conversion instead of being skipped, because skipping it would swallow the URL that followed it and produce a plausible, wrong result. An unbalanced quote does the same. A converter that fails loudly is worth more than one that guesses.

Related
- Getting started guide
- The Friends API this example calls
- What a bearer token is

Other tools
- JWT decoder — Paste a JSON Web Token to read its header and claims, and see whether it has expired. Nothing leaves the page.
- HMAC signature verifier — Check a webhook signature against the payload and the shared secret, with HMAC-SHA256, SHA-1 or SHA-512. Nothing leaves the page.

All tools · Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tools/jwt-decoder
TITLE: JWT decoder — Fun API Playground
================================================================

Decode a JWT and read its claims

A JWT is three base64url segments: a header naming the signing algorithm, a payload of claims, and a signature. The first two are not encrypted — anybody holding the token can read them — so decoding one needs no key and no server. This does it in the page, works out whether the token is still valid from its exp claim, and renders the timestamps as dates.

Nothing is uploaded
The decoding happens in your browser and the token never crosses the network. That matters more here than it sounds: a JWT is a live credential, and pasting a production token into a tool that posts it to a server is a credential disclosure. Load this page, disconnect, and it still works.
What it cannot tell you
It does not verify the signature, and no decoder that only has the token can. Verification needs the signing key, which is exactly the thing you are not going to paste into a web page. Read the output as "this is what the token claims", not as "this token is genuine" — anybody can craft a JWT that decodes cleanly and is signed with nothing.
The claims worth reading
exp is expiry and iat is issue time, both as seconds since the epoch rather than milliseconds, which is the off-by-1000 that breaks most first attempts. sub is the subject, aud the intended audience and iss the issuer; a token valid for a different audience is a real and easily-missed cause of a 401. Scopes and roles are conventions rather than standards, so they appear under whatever name the issuer chose.

Related
- What a JWT is
- Testing OAuth 2.0, JWTs and token expiry
- The Auth Playground that issues real signed JWTs
- HTTP 401 Unauthorized

Other tools
- curl converter — Paste a curl command, get the same request in nine languages — fetch, axios, Python, Go, C#, RestAssured, Playwright, k6 and HTTPie.
- HMAC signature verifier — Check a webhook signature against the payload and the shared secret, with HMAC-SHA256, SHA-1 or SHA-512. Nothing leaves the page.

All tools · Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026

================================================================
URL: https://funapi.dev/tools/hmac-verifier
TITLE: HMAC signature verifier — Fun API Playground
================================================================

Verify an HMAC webhook signature

Paste the raw request body, the shared secret and the signature you received, and this computes the HMAC and compares them. It is the check every webhook receiver has to do and the one that most often fails on the first attempt for a reason that has nothing to do with the cryptography.

Why a correct implementation still fails
Almost always because the payload changed before it was hashed. The signature covers the exact bytes that arrived, so a receiver that parses the JSON and re-serialises it before hashing is signing a different string — key order, whitespace and number formatting all shift. Capture the raw body first and hash that. The other frequent cause is a signature header that carries a prefix ("sha256=") or a different encoding, hex versus base64.
Constant-time comparison
In production, compare with a constant-time function — crypto.timingSafeEqual in Node, hmac.compare_digest in Python. A normal string comparison returns on the first differing byte, and the timing difference is enough to reconstruct a valid signature given enough attempts. This page compares in constant time too, though against a secret you pasted yourself it is a demonstration rather than a defence.
A signature is not a freshness check
A validly signed payload stays validly signed forever, so anyone who captures one can replay it. Real webhook providers sign a timestamp alongside the body and expect receivers to reject anything older than a few minutes. If the provider gives you a timestamp, it is part of the signed string, not a header to ignore.

Related
- What an HMAC signature is
- Testing webhooks and HMAC signature verification
- The Webhooks API that signs its deliveries

Other tools
- curl converter — Paste a curl command, get the same request in nine languages — fetch, axios, Python, Go, C#, RestAssured, Playwright, k6 and HTTPie.
- JWT decoder — Paste a JSON Web Token to read its header and claims, and see whether it has expired. Nothing leaves the page.

All tools · Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026