Capture webhooks, send requests with credentials from an encrypted vault, run collections from CI and get alerted when a scheduled check fails. It runs in your browser, with nothing to install.
{
"data": [
{ "id": "ord_8412", "status": "paid", "total": 4200 },
{ "id": "ord_8415", "status": "paid", "total": 1250 }
],
"next_cursor": "ord_8415"
}
The requests you send and the requests you receive live side by side, with the same credentials, environments and history.
Capture and answer incoming HTTP requests.
Build requests with real auth and no pasted secrets.
Run collections on demand, from CI or on a schedule.
Bring collections in and take them out again.
See what came in, what went out and how fast.
Share workspaces with the right level of access.
Sign up and you get a personal organization with a workspace ready to use. Invite teammates when you need them.
Bring in a Postman collection, an OpenAPI file or a cURL command, or start in the request builder. Store each credential in the vault once.
Point webhooks at a capture URL, run collections with assertions, and schedule monitors that alert you when a check fails.
A webhook fails and you can't see what the sender sent.
Give the sender a capture URL at /in/{slug}. Every request lands in a live list with its method, path, query, headers and body. Authorization headers and API keys are masked before they're stored.
Retry-After.
API keys end up in screenshots, chat threads and shell history.
Store a credential once in the vault and point requests, folders or whole collections at it. The builder applies it at send time; the UI never shows the secret again.
You find out an API broke when someone else tells you.
The collection runner sends every request in a collection or folder, runs its assertions and shows a results matrix as it goes. Monitors run the same collections on a schedule.
Your requests are locked inside another tool.
Import what you already have and take it back out whenever you like. Then drive it from your pipeline.
You can't tell whether a journey works until a real customer goes through it.
RandomRoute AEP Lab is a test harness for Adobe Experience Platform development sandboxes. Stream synthetic profiles and events, watch them reach Real-Time Customer Profile, and catch the calls Journey Optimizer makes back out.
This site runs a Postman-echo style API. This route needs no account: it returns the query string as JSON and sets each parameter as a response header.
With a free account and a test token you also get /echo/get, /post and friends, plus Basic, Bearer, HMAC and Digest auth testers.
curl -i "https://api.randomroute.io/echo/response-headers?X-Workbench-Demo=hello"These protections are on for every account. Each one has an automated test behind it.
Credentials, secret variables, OAuth tokens, cookie jars and 2FA seeds are encrypted with libsodium (XChaCha20-Poly1305) and bound to their own record.
Once saved, a secret shows at most its last four characters. History and live responses mask every secret the request used.
Every query is scoped to your workspace and checked again before access. Anyone outside gets a 404, not a hint that something exists.
Outbound requests can't reach private, loopback or cloud metadata addresses. The check runs after DNS lookup and on every redirect.
A nonce-based CSP blocks inline and third-party scripts. Captured and mocked responses are served sandboxed.
TOTP 2FA with single-use backup codes. An organization can require 2FA for every member.
Owner, Admin, Editor and Viewer, with per-workspace overrides, so a contractor can edit one workspace and only read the rest.
Membership, role, token, import and export events are recorded with who did them and when.
RandomRoute API Workbench is free. There's no card to enter: create an account and every feature on this page is yours, within these limits.
Monthly request quotas count inbound captures and outbound sends separately. Usage is shown in organization settings, and admins get a notice at 80%.
Yes. Every account is free, with the limits listed under Free to use. There's no card to enter.
It runs in the browser, so there's nothing to install, and it keeps the receiving side next to the sending side: capture URLs, mock rules and the Echo API sit in the same workspace as your collections. Tests are declarative assertions rather than JavaScript, so Postman pre-request and test scripts are imported as notes and not run.
Yes, collections in v2.0 or v2.1 format and environments. Folders, requests, variables, bodies and saved examples come across. Auth settings become vault credentials with the secret left blank for you to fill in. You can also import OpenAPI 3 files and cURL commands.
Encrypted with libsodium before they reach the database, and bound to the record they belong to. The interface never shows a saved secret again, request history masks every secret a request used, and test and API tokens are stored only as hashes.
Yes. Invite people to an organization by email and give them the Owner, Admin, Editor or Viewer role, with overrides per workspace. An organization can require two-factor authentication for everyone, and admins can read the audit log.
Yes. REST API v1 uses workspace tokens with api:read and api:run scopes. Start a collection run, poll it until it finishes and fail your pipeline unless its status is PASSED. The API reference describes every endpoint, and the OpenAPI document is there to download.
No. RandomRoute AEP Lab only works with Adobe Experience Platform development sandboxes and synthetic data. Production sandboxes, the default sandbox and requests that contain real-looking personal data are refused, and there is no override for anyone. The RandomRoute AEP Lab guide lists the rules.
Captured requests, request history and collection runs are deleted by a nightly job after 7 days. An endpoint can be set to keep its captures for less time.
No. Outbound requests to private, loopback, link-local and cloud metadata addresses are blocked, including through redirects. Call a publicly reachable URL instead.