Send a request. See exactly what arrived.

Echoes the request's query parameters, headers, origin, and URL (GET and HEAD).

Echoes the request's parsed body and uploaded files; same-named multipart fields collect into an array.

Same as /post, for PUT requests.

Same as /post, for PATCH requests.

Same as /post, for DELETE requests.

HEAD-only: echoes the request headers back as X-Echo-* response headers.

OPTIONS-only: echoes the request and returns an Allow header (RFC 9110 §9.3.7).

TRACE-only: echoes the request like /anything (RFC 9110 §9.8).

Echoes the request's URL args and parsed body, like /post (RFC 9430).

Accepts any method and echoes the full request; multipart handling matches /post.

Same as /anything, with extra path segment(s) that are ignored.

Challenges HTTP Basic Auth with the given credentials.

Challenges HTTP Basic Auth with an empty password (username-only check).

Like /basic-auth, but returns 404 instead of 401 on failure.

Like /basic-auth/{user}, but returns 404 instead of 401 on failure.

Checks for a Bearer token in the Authorization header.

Decodes and inspects a JWT Bearer token, without verifying its signature.

Challenges HTTP Digest Auth; adds SHA-512-256 and a qop=none legacy (RFC 2069) mode.

Returns the given status, or a random one from a comma-separated list; supports ?header= injection, a custom body, and trailing path segments.

Returns the request's HTTP headers.

Returns the requester's IP address.

Returns the request's User-Agent header.

Returns the request's HTTP method name.

Returns the request's body verbatim with mirrored headers, for any method including QUERY (RFC 9430); /echo is a compatibility alias.

Returns 304 if If-Modified-Since or If-None-Match is present, 200 otherwise.

Sets a Cache-Control header for the given number of seconds.

Validates If-Match/If-None-Match against the given ETag; supports weak W/"..." validators.

Echoes query parameters as response headers; ?body= and ?status= override the response body and status code.

Returns a sample JSON document.

Returns a sample XML document.

Returns a sample HTML document.

Returns the page that robots.txt disallows.

Returns a UTF-8 encoded page.

Returns an ISO-8859-1 encoded page.

GET returns gzip-encoded JSON; POST gzip-encodes the request body.

GET returns deflate-encoded JSON; POST deflate-encodes the request body.

GET returns brotli-encoded JSON; POST brotli-encodes the request body.

GET returns Zstandard-encoded JSON; POST zstd-encodes the request body.

Returns a UUIDv4.

Decodes a standard base64 string; returns raw bytes for non-UTF-8 content instead of erroring.

Decodes the request body as base64.

Returns n random bytes; over the configured --max-bytes limit returns 404 instead of silently truncating.

Streams n random bytes chunk by chunk; same limit behavior as /bytes.

Streams n JSON lines describing the request.

Streams numbytes bytes; supports Range requests.

Returns a page of n links, starting at offset.

Same as /links/{n}/{offset}, with offset defaulted to 0.

Drips data over a duration; ?chunked=true streams with real chunked transfer-encoding.

Delays the response by up to 10 seconds.

Returns the request's cookies.

Sets cookies from query parameters and redirects to /cookies; supports httponly/secure/samesite/domain/path/max_age attributes.

Sets a single cookie and redirects to /cookies.

Deletes the given cookies and redirects to /cookies.

Returns a random image; format negotiated via the Accept header.

Returns a PNG image.

Returns a JPEG image.

Returns a WEBP image.

Returns an SVG image.

Redirects n times before returning 200.

Same as /redirect/{n}, using relative Location URLs.

Same as /redirect/{n}, using absolute Location URLs.

Redirects to ?url=; POST/PUT/PATCH/DELETE also accept form/JSON bodies, and browser clients see an anti-phishing interstitial instead of a silent redirect.

Streams server-sent events; supports OpenAI-compatible chunk formats.

Same as /sse, with a fixed event count.

Same as /sse, with a fixed count and delay between events.

Streams newline-delimited JSON; supports OpenAI/Ollama-compatible chunk formats.

Same as /ndjson, with a fixed line count.

Same as /ndjson, with a fixed count and delay between lines.

Self-describing index: endpoints, base_url guidance for both SDK families, and the httpcan response-override contract.

Mock OpenAI Chat Completions API: canonical chat.completion shape, SSE streaming with [DONE], and an httpcan.content override. /llm/chat/completions works as a silent alias.

Mock Anthropic Messages API: content blocks, stop_reason, and the full streaming event protocol (message_start through message_stop).

Mock OpenAI Responses API: canonical Response object with output_text convenience field; streaming uses named SSE events (response.created through response.completed) with sequence numbers. /llm/responses works as a silent alias.

Mock OpenAI legacy Completions API (text-in/text-out): echo support, n choices, and SSE streaming with [DONE]. /llm/completions works as a silent alias.

Model list in the OpenAI shape, or the Anthropic shape when an anthropic-version header is present (both SDKs hit this same path).

Single-model lookup that always returns 200 and echoes the requested id — any model name is valid.

Self-describing index: endpoints, supported grants, PKCE methods, and the mock's state semantics.

Authorization endpoint with a consent page. response_type=code issues a one-time authorization code (PKCE supported); response_type=token (implicit, legacy) returns the access token in the redirect fragment.

Token endpoint: authorization_code (+PKCE), password, refresh_token (rotating), and client_credentials grants; Basic and form-body client authentication.

Bearer-protected resource: verifies the access token and returns the mock identity (sub/email/client_id/scope).

Liveness probe: returns 200 whenever the server is up.

Returns all HTTPCAN_* environment variables, for instance identification.

Returns a single HTTPCAN_* environment variable by name.