Data Validation — entry 003 of 7
Postman Echo
Postman Echo is a keyless sandbox that mirrors whatever you send it back as JSON — headers, query args, form body, cookies, and basic/digest auth attempts — across GET, POST, PUT, DELETE, and PATCH endpoints, plus helpers for testing redirects, delays, streaming, and gzip/deflate encoding. It's built and maintained by the Postman team as the reference backend for their own client tutorials and public collections, so its request/response shapes double as worked examples. There's no signup or key: every route is open, making it a quick target for scripting HTTP-client tests without standing up your own server.
Postman Echo is a keyless sandbox that mirrors whatever you send it back as JSON — query args, headers, form/JSON body, and Basic/Digest auth attempts — across GET, POST, PUT, DELETE, and PATCH, plus helper routes for testing specific status codes, delays, redirects, and CORS-style response headers. Every route is open with no signup or key required.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/postman-echo/"><img src="https://greatapis.com/badge/postman-echo.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key required — every route is open. The service also ships a Basic Auth test route (`/basic-auth`, username `postman` / password `password`) purely for exercising a client's own auth-handling code, not for gating access to the API itself.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Echo a GET request back as JSON
GEThttps://postman-echo.com/get?foo1=bar1&foo2=bar2
{"args":{"foo1":"bar1","foo2":"bar2"},"headers":{"host":"postman-echo.com","user-agent":"curl/7.88.1","accept":"*/*","x-forwarded-proto":"https","accept-encoding":"gzip, br"},"url":"https://postman-echo.com/get?foo1=bar1&foo2=bar2"}Developer reference
https://postman-echo.comGotchas & limits
- No `Access-Control-Allow-Origin` header is sent by default: a live GET to `/get` and a separate OPTIONS preflight to `/post`, both sent with an `Origin` header, returned neither header at all. The one exception is its own `/response-headers` helper, which turns query parameters straight into real response headers — a live `GET /response-headers?Access-Control-Allow-Origin=*` came back with a genuine `access-control-allow-origin: *` header (and the same pair echoed again in the JSON body), so that's the one route that can simulate any CORS policy on demand.
- `GET /status/{code}` sets the real HTTP status to match, not just the body: a live `GET /status/404` returned an actual HTTP 404 with body `{"status":404}` — useful for testing an HTTP client's status-code branching without needing a broken endpoint.
- `/basic-auth` responds in two different shapes depending on the result: correct credentials (`postman`/`password`) return HTTP 200 with JSON `{"authenticated":true}`, but wrong credentials return HTTP 401 with a plain-text `Unauthorized` body and no `Content-Type` header at all — code that assumes every response is JSON will fail to parse the failure case.
- A JSON POST body populates two different fields at once: a live `POST /post` with `{"hello":"world"}` and `Content-Type: application/json` came back with the same object under both `data` and `json` (with `form` and `files` left empty) — send `Content-Type: application/x-www-form-urlencoded` instead to populate `form`.