A modern, high-performance superset of httpbin.org for testing HTTP clients, proxies, and AI agents — with mock OpenAI/Anthropic LLM APIs and a full OAuth 2.0 server. Built with Rust and Actix Web.
You're on a live instance — https://httpcan.org. Try an endpoint now:
curl https://httpcan.org/getWant your own? Run HTTPCan locally or in production:
# Docker
docker run -p 8080:8080 ghcr.io/seedvector/httpcan:latest
# Cargo
cargo install httpcan && httpcan
curl http://localhost:8080/getHTTPCan is a 84-endpoint superset of httpbin.org: every httpbin.org endpoint is covered and drop-in compatible, plus 33 endpoints httpbin.org doesn't have and 18 it has but httpcan fixes or extends (see the badges below). On top of that:
/llm endpoints: point any SDK base_url at it (streaming included) and test AI clients without a paid provider./oauth2: four RFC 6749 grants with PKCE, one-time codes, rotating refresh tokens, Bearer-protected userinfo, and RFC 8414 discovery./sse and /ndjson endpoints with OpenAI/Ollama-compatible chunk formats./redirect-to see a confirmation page instead of a silent 302, closing an open-redirect abuse vector.--exclude-headers for more./healthz liveness probe, /tags instance identification, and Server-Timing/X-Httpcan-Version on every response.Enhanced 18 endpoints httpbin has, but httpcan fixes or extends New 33 endpoints not available in httpbin.org no badge drop-in compatible with httpbin.org
Each endpoint has a Copy button with a ready-to-run curl example (with parameters filled in) targeting this instance.
Testing different HTTP verbs.
GET /get Echoes the request's query parameters, headers, origin, and URL (GET and HEAD).POST /post Enhanced Echoes the request's parsed body and uploaded files; same-named multipart fields collect into an array.PUT /put Enhanced Same as /post, for PUT requests.PATCH /patch Enhanced Same as /post, for PATCH requests.DELETE /delete Same as /post, for DELETE requests.HEAD /head New HEAD-only: echoes the request headers back as X-Echo-* response headers.OPTIONS /options New OPTIONS-only: echoes the request and returns an Allow header (RFC 9110 §9.3.7).TRACE /trace New TRACE-only: echoes the request like /anything (RFC 9110 §9.8).QUERY /query New Echoes the request's URL args and parsed body, like /post (RFC 9430).Returns anything that is passed to the request.
GET/POST/PUT/PATCH/DELETE/OPTIONS/TRACE/QUERY /anything Enhanced Accepts any method and echoes the full request; multipart handling matches /post.GET/POST/PUT/PATCH/DELETE/OPTIONS/TRACE/QUERY /anything/{path} Enhanced Same as /anything, with extra path segment(s) that are ignored.Auth methods.
GET/POST /basic-auth/{user}/{passwd} Challenges HTTP Basic Auth with the given credentials.GET/POST /basic-auth/{user} New Challenges HTTP Basic Auth with an empty password (username-only check).GET/POST /hidden-basic-auth/{user}/{passwd} Like /basic-auth, but returns 404 instead of 401 on failure.GET/POST /hidden-basic-auth/{user} New Like /basic-auth/{user}, but returns 404 instead of 401 on failure.GET /bearer Checks for a Bearer token in the Authorization header.GET /jwt-bearer New Decodes and inspects a JWT Bearer token, without verifying its signature.GET/POST /digest-auth/{qop}/{user}/{passwd}[/{algorithm}[/{stale_after}]] Enhanced Challenges HTTP Digest Auth; adds SHA-512-256 and a qop=none legacy (RFC 2069) mode.Generates responses with a given status code.
GET/POST/PUT/PATCH/DELETE/TRACE/OPTIONS /status/{codes} Enhanced Returns the given status, or a random one from a comma-separated list; supports ?header= injection, a custom body, and trailing path segments.Inspect the request data.
GET /headers Returns the request's HTTP headers.GET /ip Returns the requester's IP address.GET /user-agent Returns the request's User-Agent header.ANY /method New Returns the request's HTTP method name.GET/POST/PUT/PATCH/DELETE/QUERY /body New Returns the request's body verbatim with mirrored headers, for any method including QUERY (RFC 9430); /echo is a compatibility alias.Inspect the response data, like caching and headers.
GET /cache Returns 304 if If-Modified-Since or If-None-Match is present, 200 otherwise.GET /cache/{value} Sets a Cache-Control header for the given number of seconds.GET /etag/{etag} Enhanced Validates If-Match/If-None-Match against the given ETag; supports weak W/"..." validators.GET/POST /response-headers Enhanced Echoes query parameters as response headers; ?body= and ?status= override the response body and status code.Returns responses in different data formats.
GET /json Returns a sample JSON document.GET /xml Returns a sample XML document.GET /html Returns a sample HTML document.GET /deny Returns the page that robots.txt disallows.GET /encoding/utf8 Returns a UTF-8 encoded page.GET /encoding/iso-8859-1 New Returns an ISO-8859-1 encoded page.GET/POST /gzip Enhanced GET returns gzip-encoded JSON; POST gzip-encodes the request body.GET/POST /deflate Enhanced GET returns deflate-encoded JSON; POST deflate-encodes the request body.GET/POST /brotli Enhanced GET returns brotli-encoded JSON; POST brotli-encodes the request body.GET/POST /zstd New GET returns Zstandard-encoded JSON; POST zstd-encodes the request body.Generates random and dynamic data.
GET /uuid Returns a UUIDv4.GET /base64/{value} Enhanced Decodes a standard base64 string; returns raw bytes for non-UTF-8 content instead of erroring.POST /base64 New Decodes the request body as base64.GET /bytes/{n} Enhanced Returns n random bytes; over the configured --max-bytes limit returns 404 instead of silently truncating.GET /stream-bytes/{n} Enhanced Streams n random bytes chunk by chunk; same limit behavior as /bytes.GET /stream/{n} Streams n JSON lines describing the request.GET /range/{numbytes} Streams numbytes bytes; supports Range requests.GET /links/{n}/{offset} Returns a page of n links, starting at offset.GET /links/{n} New Same as /links/{n}/{offset}, with offset defaulted to 0.GET /drip Enhanced Drips data over a duration; ?chunked=true streams with real chunked transfer-encoding.GET/POST/PUT/PATCH/DELETE/TRACE /delay/{delay} Delays the response by up to 10 seconds.Returns different image formats.
GET /image Returns a random image; format negotiated via the Accept header.GET /image/png Returns a PNG image.GET /image/jpeg Returns a JPEG image.GET /image/webp Returns a WEBP image.GET /image/svg Returns an SVG image.Returns different redirect responses.
GET /redirect/{n} Redirects n times before returning 200.GET /relative-redirect/{n} Same as /redirect/{n}, using relative Location URLs.GET /absolute-redirect/{n} Same as /redirect/{n}, using absolute Location URLs.GET/POST/PUT/PATCH/DELETE/TRACE /redirect-to Enhanced Redirects to ?url=; POST/PUT/PATCH/DELETE also accept form/JSON bodies, and browser clients see an anti-phishing interstitial instead of a silent redirect.Server-Sent Events and NDJSON streaming endpoints.
GET /sse New Streams server-sent events; supports OpenAI-compatible chunk formats.GET /sse/{count} New Same as /sse, with a fixed event count.GET /sse/{count}/{delay} New Same as /sse, with a fixed count and delay between events.GET /ndjson New Streams newline-delimited JSON; supports OpenAI/Ollama-compatible chunk formats.GET /ndjson/{count} New Same as /ndjson, with a fixed line count.GET /ndjson/{count}/{delay} New Same as /ndjson, with a fixed count and delay between lines.Mock OpenAI- and Anthropic-compatible LLM APIs: point an SDK base_url at /llm and test without a paid provider.
GET /llm New Self-describing index: endpoints, base_url guidance for both SDK families, and the httpcan response-override contract.POST /llm/v1/chat/completions New Mock OpenAI Chat Completions API: canonical chat.completion shape, SSE streaming with [DONE], and an httpcan.content override. /llm/chat/completions works as a silent alias.POST /llm/v1/messages New Mock Anthropic Messages API: content blocks, stop_reason, and the full streaming event protocol (message_start through message_stop).POST /llm/v1/responses New Mock OpenAI Responses API: canonical Response object with output_text convenience field; streaming uses named SSE events (response.created through response.completed) with sequence numbers. /llm/responses works as a silent alias.POST /llm/v1/completions New Mock OpenAI legacy Completions API (text-in/text-out): echo support, n choices, and SSE streaming with [DONE]. /llm/completions works as a silent alias.GET /llm/v1/models New Model list in the OpenAI shape, or the Anthropic shape when an anthropic-version header is present (both SDKs hit this same path).GET /llm/v1/models/{model} New Single-model lookup that always returns 200 and echoes the requested id — any model name is valid.Mock authorization server: RFC 6749 four grants with PKCE, one-time codes, rotating refresh tokens, and RFC 8414 discovery.
GET /oauth2 New Self-describing index: endpoints, supported grants, PKCE methods, and the mock's state semantics.GET/POST /oauth2/authorize New Authorization endpoint with a consent page. response_type=code issues a one-time authorization code (PKCE supported); response_type=token (implicit, legacy) returns the access token in the redirect fragment.POST /oauth2/token New Token endpoint: authorization_code (+PKCE), password, refresh_token (rotating), and client_credentials grants; Basic and form-body client authentication.GET/POST /oauth2/userinfo New Bearer-protected resource: verifies the access token and returns the mock identity (sub/email/client_id/scope).Health checks and instance identification.
GET /healthz New Liveness probe: returns 200 whenever the server is up.GET /tags New Returns all HTTPCAN_* environment variables, for instance identification.GET /tags/{name} New Returns a single HTTPCAN_* environment variable by name.