Data Validation — entry 003 of 7
Postman Echo
Postman Echo is a keyless sandbox that mirrors whatever you send it back as JSON — headers, query args, form body, cookies, and basic/digest auth attempts — across GET, POST, PUT, DELETE, and PATCH endpoints, plus helpers for testing redirects, delays, streaming, and gzip/deflate encoding. It's built and maintained by the Postman team as the reference backend for their own client tutorials and public collections, so its request/response shapes double as worked examples. There's no signup or key: every route is open, making it a quick target for scripting HTTP-client tests without standing up your own server.
Postman Echo is a keyless sandbox that mirrors whatever you send it back as JSON — query args, headers, form/JSON body, and Basic/Digest auth attempts — across GET, POST, PUT, DELETE, and PATCH, plus helper routes for testing specific status codes, delays, redirects, and CORS-style response headers. Every route is open with no signup or key required.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/postman-echo/"><img src="https://greatapis.com/badge/postman-echo.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key required — every route is open. The service also ships a Basic Auth test route (
/basic-auth, usernamepostman/ passwordpassword) purely for exercising a client's own auth-handling code, not for gating access to the API itself.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Echo a GET request back as JSON
GEThttps://postman-echo.com/get?foo1=bar1&foo2=bar2
{"args":{"foo1":"bar1","foo2":"bar2"},"headers":{"host":"postman-echo.com","user-agent":"curl/7.88.1","accept":"*/*","x-forwarded-proto":"https","accept-encoding":"gzip, br"},"url":"https://postman-echo.com/get?foo1=bar1&foo2=bar2"}Developer reference
https://postman-echo.comGotchas & limits
- No
Access-Control-Allow-Originheader is sent by default: a live GET to/getand a separate OPTIONS preflight to/post, both sent with anOriginheader, returned neither header at all. The one exception is its own/response-headershelper, which turns query parameters straight into real response headers — a liveGET /response-headers?Access-Control-Allow-Origin=*came back with a genuineaccess-control-allow-origin: *header (and the same pair echoed again in the JSON body), so that's the one route that can simulate any CORS policy on demand. GET /status/{code}sets the real HTTP status to match, not just the body: a liveGET /status/404returned an actual HTTP 404 with body{"status":404}— useful for testing an HTTP client's status-code branching without needing a broken endpoint./basic-authresponds in two different shapes depending on the result: correct credentials (postman/password) return HTTP 200 with JSON{"authenticated":true}, but wrong credentials return HTTP 401 with a plain-textUnauthorizedbody and noContent-Typeheader at all — code that assumes every response is JSON will fail to parse the failure case.- A JSON POST body populates two different fields at once: a live
POST /postwith{"hello":"world"}andContent-Type: application/jsoncame back with the same object under bothdataandjson(withformandfilesleft empty) — sendContent-Type: application/x-www-form-urlencodedinstead to populateform.