GraphQL API Tester
Send GraphQL queries and mutations, then inspect the response, errors and schema
Query
Write a query or load an example.
A JSON object. Leave empty when the operation has no variables.
Response
Direct mode sends the request from your browser, so the endpoint must allow CORS for this site. Ctrl or Cmd + Enter sends the request from any editor.
What it does
GraphQL API Tester sends one GraphQL operation to an endpoint and shows the HTTP status, time, size, response headers and formatted JSON body. GraphQL errors are listed with their response path and query locations, and partial data is called out. The query is parsed locally with graphql-js for syntax errors, operation discovery and prettifying.
Direct and Proxy modes
Direct mode sends the request from your browser, so credentials never pass through CodingTool.dev, but the endpoint must allow CORS. Proxy mode sends one request through the CodingTool.dev relay, which only reaches public http and https addresses: private, loopback, link-local and metadata addresses are blocked after DNS resolution and on every redirect, with a 30 second timeout, a 2 MB request limit and a 5 MB response limit. Cookies and Proxy-Authorization are not forwarded, and nothing is stored.
Variables, headers and GET
Variables are a JSON object validated before sending. Values of Authorization, Cookie, X-API-Key and similar headers are masked with a reveal toggle and never saved. POST sends a JSON body; GET encodes query, variables and operationName as URL parameters and is allowed only for query operations, because mutations over GET are rejected.
Schema and privacy
Fetch schema runs the standard introspection query, prints the schema as SDL and validates your query against it, with errors shown in the editor. The schema stays in memory only. Only the transport choice and the active tab are remembered; the endpoint, query, variables and headers are never stored, logged or sent to analytics.
