API & AI Protocols

OpenAPI 3.1, Model Context Protocol (MCP) agents, and HTTP API contract tools for modern developers.

JSON Schema & Contracts OpenAPI & Specifications HTTP & Protocol Debugging API Security & Auth GraphQL & RPC Tool category

Available Tools (50)

← Back to all tools

JSON Schema & Contracts

JSON to JSON Schema

Generate JSON Schema from sample JSON data. Infers types, arrays, required fields, and format constraints automatically.

JSON Schema to Mock JSON

Traverses a submitted JSON Schema with the chosen mode and seed, generates a mock value, and reports actual validation against that schema.

Limited Protobuf Message to JSON Schema

Map supported fields from one protobuf message to a Draft 2020-12 JSON Schema outline.

JSON-LD Schema Generator

Generates a JSON-LD object with schema.org context and a supplied type, defaulting to SoftwareApplication. It does not wrap the object in a script tag or validate Schema.org properties.

Schema.org Validator

Checks only whether JSON-LD has `@context` equal to `https://schema.org` and a nonempty `@type`. It does not validate type-specific properties or value types.

API Response Matrix Mock Builder

Selects one HTTP status from a supplied response map and returns its mock body; defaults to a small 200/404 map.

JSON Schema Version Migrator

JSON Schema Version Migrator: Replaces legacy `id` keyword with `$id` and updates `$schema` URI to Draft 2020-12.

Single JSON Template Mocker

Replace {{key}} values, @name and @int(min,max) in one JSON template, then parse the result. No JSON Schema validation or repeated array generation.

OpenAPI & Specifications

OpenAPI Generator

Builds one OpenAPI 3.1 operation draft from form fields and sample JSON, then validates the generated YAML or JSON and reports issues.

OpenAPI Validator

Parses OpenAPI 3.0.x, 3.1.x or 3.2.x JSON/YAML, checks version-specific structure and local references, and reports design warnings separately.

OpenAPI to MCP Tool Draft Generator

Convert OpenAPI 3.0/3.1 specifications into MCP tool-definition drafts in this page’s tool workspace. Ordinary site requests, extensions, and managed-device services are separate paths.

OpenAPI 3.0 ↔ 3.1 Converter

OpenAPI 3.0 ↔ 3.1 Converter: Updates root version to 3.1.0 and converts legacy OpenAPI 3.0 `nullable: true` to `type: [string, 'null']`.

Swagger 2.0 to OpenAPI 3.x

Swagger 2.0 to OpenAPI 3.x: Replaces host and basePath with OpenAPI 3 `servers: [{ url: 'https://api.example.com/v1' }]` and updates root version.

Converts common OpenAPI 3.x operations into a downloadable Postman Collection v2.1 JSON file with tag folders, path/query/header placeholders, operation descriptions, available inline request/response examples and a basic status assertion. Inputs must be under 10,000,000 UTF-8 bytes.

Postman Collection to OpenAPI

Converts a Postman Collection JSON into OpenAPI 3.0 YAML. Recursively reads nested request folders, maps URL variables and query parameters, infers schemas from raw JSON request bodies, and groups response examples under HTTP 200. Download the generated YAML locally. Input must be smaller than 10,000,000 UTF-8 bytes.

OpenAPI to TypeScript Fetch Client

Generates basic TypeScript fetch functions from supported lowercase OpenAPI operations. Braced path parameters become encoded string arguments; functions return Response. Query and header parameters, schema types, and response parsing remain manual.

OpenAPI to Axios Client

Generates basic Axios request functions from supported lowercase OpenAPI operations, including encoded string path parameters and an optional bearer header. Schema-derived types, query or header parameter mapping, and response contracts remain manual.

OpenAPI Deprecation Builder

Marks a selected OpenAPI operation as deprecated and appends a migration note to its description. It does not add Sunset response-header documentation.

OpenAPI OperationId Linter & Fixer

Reports missing and duplicate operationId values and can generate IDs for missing operations. It does not enforce casing conventions.

RESTful API Design Linter

Checks OpenAPI paths for a leading slash and uppercase letters, and supported operations for a responses field. It does not detect verbs in paths or evaluate resource design.

HTTP & Protocol Debugging

cURL to Code Converter

Parses POSIX-style quotes, escaped spaces and line continuations plus supported cURL method, header, Basic-auth, cookie and body options. Generates JavaScript Fetch or Axios, Python Requests, or Go net/http source. Commands must be under 100,000 UTF-8 bytes; unsupported options are reported. Real browser-captured Chrome, Safari and Postman sample-corpus coverage is not included.

HTTP Request Headers Builder

Builds a JSON headers object and fetch-options snippet. It validates field-name token syntax, rates compatibility and security risks, flags selected deprecated headers, explains Cache-Control directives and generates Bearer, Basic or API-key headers locally.

HAR File Analyzer & Waterfall

Analyze HAR entries locally with total request timing and DNS, connect, TTFB, and download phases. View a request timeline, filter by domain, content type, or status, inspect response bodies, and find slow or large requests. Import or drop a HAR file up to 100 MB; sensitive values are redacted in displayed details.

SSE Stream Parser

Parses pasted SSE text into event, id, retry and data fields and returns a JSON event list. It does not validate stream termination or connect to a server.

WebSocket Payload Inspector

Inspects pasted WebSocket payload text: when it is JSON, shows top-level keys, byte length, and parsed value; otherwise shows text and byte length. It does not validate JSON-RPC 2.0.

CORS Response Header Builder

Builds Access-Control-Allow-Origin, Methods, Headers and Max-Age lines from JSON. It does not send a preflight request or test a browser.

REST Route Path Matcher

Matches decoded URL path segments against literal and :name pattern segments; reports a match and captured parameters.

Legacy RateLimit Header Formatter

Formats three early-draft RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset lines. The May 2026 IETF draft instead uses RateLimit and RateLimit-Policy; no server quota is enforced.

RSS / Atom Feed Validator

RSS / Atom Feed Validator: Parses RSS 2.0 and Atom XML, checks the supported required feed metadata, and counts items or entries. It does not fetch linked resources or validate every extension and date.

Common HTTP API Error Lookup

Lookup brief troubleshooting hints for a fixed subset of common 4xx and 5xx status codes.

WebSocket URL & Protocol Parser

Parses ws/wss URL fields, rejects fragments and user information, and reports scheme, host, effective port, path and query; no connection or TLS test.

API Security & Auth

Webhook Signature Tester (HMAC)

Generate and verify local HMAC-SHA-256 webhook signatures in generic, Stripe, GitHub, Shopify, or Slack format. Stripe signs timestamp + raw body; Slack signs v0 + timestamp + raw body. Payloads must be valid UTF-8 text smaller than 5,000,000 bytes. Reformatting JSON changes the signature; no request is sent.

OAuth2 PKCE Generator

OAuth2 PKCE Generator: Generates cryptographically random URL-safe verifier, computes SHA-256 hash, and Base64URL encodes to create S256 challenge.

OAuth2 Authorize URL Builder

OAuth2 Authorize URL Builder: Assembles standard RFC 6749 query parameters, adds response_type=code and random state anti-CSRF token.

JWT Token Generator & Signer (Local)

Locally signs a compact JWT by Base64URL-encoding its header and payload and creating an HMAC (HS256/384/512) or RSA PKCS#1 v1.5 (RS256/384/512) signature. It does not verify tokens.

JWKS Metadata Inspector

Summarizes each local JWKS key's kid, kty, use, key_ops, alg, certificate count, and presence of private fields. It does not export PEM or validate key material.

Sitemap XML Validator & Extractor

Sitemap XML Validator & Extractor: Parses XML, checks for a sitemap root, extracts loc values, validates absolute HTTP(S) URLs, and reports duplicates. It does not perform XSD validation or fetch URLs.

robots.txt Directive Counter

Counts User-agent lines, Allow/Disallow/Crawl-delay lines and Sitemap URLs in pasted robots.txt text. Does not generate rules or test path access.

HTTP Security Header Lines Generator

Generates CSP, HSTS, MIME-sniffing, referrer and permissions header lines from JSON settings. Default output does not restrict framing.

Content Security Policy (CSP) Builder

Joins checked directive names and source tokens into CSP text. It does not test browser enforcement or compatibility with a deployed page.

API Key Structural Check

Checks a pasted key for length, character variety and simple weak patterns. Its character-pool bits are only an upper bound; it cannot identify issuer or verify entropy.

Subresource Integrity (SRI) Generator

Subresource Integrity (SRI) Generator: Computes SHA-384 cryptographic digest and encodes result in standard Base64.

OAuth 1.0a Signature Generator

OAuth 1.0a Signature Generator: Encodes HTTP method, URL, and normalized sorted query parameters into standard OAuth 1.0a signature base string.

GraphQL & RPC

GraphQL Brace Indenter

Indent GraphQL selection-set braces without syntax validation or full field reformatting.

Limited GraphQL Type to TypeScript

Convert supported GraphQL object type fields to TypeScript interfaces with nullable scalar/list fields.

GraphQL Query to cURL

Wraps a GraphQL query in a JSON body and generates one cURL POST command for a fixed example endpoint. It does not generate fetch code or include variables.