Testing tool

Every endpoint can be tried in the control panel on its Try it page. Open it with the Try it button (the paper plane) of an endpoint on the Endpoints overview, or with the link at the cURL example on the edit page of an endpoint. Available from v10.0.0, before it was the Testing tools page in the sidebar

A disabled endpoint can be opened, but a request returns a 404 until it is enabled.

Try it

The page has:

Part	Description
Request	The HTTP method (a choice when the endpoint has more, e.g. PUT and PATCH) and the url of the endpoint
Credentials	As yourself: your control panel session, with your permissions. You must be added as a webservice member, or be a Super Admin, otherwise the request gets a 401. Shortkey, Key and secret or Username and password: the credentials of a webservice member, to see what that member can do. Without credentials: what a public endpoint returns to everybody
Url parameters	A field per parameter of the route, e.g. {entry_id}
Fields	The fields of the endpoint, e.g. entry_id and include of read_entry
Data (JSON)	More data as JSON, merged with the fields, e.g. custom fields or site_id

Send request shows:

• the HTTP status, the duration and whether the request was sent from your browser or via the server;
• the headers about the cache (X-Cache) and the rate limiting (X-RateLimit-*, Retry-After);
• the response, formatted, with a copy button;
• the cURL command of the request, with a copy button. With As yourself the session is <session_id>.

The last 5 requests of an endpoint are shown next to the button, click one to fill in the request again. They are kept in your browser, without the credentials and without password fields, also not the keys in the JSON that contain password, secret, shortkey, token, resetcode, authcode or session_id.

From the browser or via the server

The request is sent from your browser to the API, so you see exactly what a front-end gets. When the browser cannot reach the API, e.g. when the control panel is on another domain, the request is sent via the server to the Testing tool URL of the settings. The server only sends requests to the webservice and does not follow redirects: a redirect (e.g. from http to https) is shown as the response, then use the final URL as the Testing tool URL.

Fields of an API

The fields come from test in the webservice_settings.json of an API (settings.json for the APIs of the module), see Your own API:

"test": {
    "enabled": true,
    "read_news": [
        {"name": "limit", "type": "form_input", "value": "10"},
        {"name": "status", "type": "form_dropdown", "value": "explode::open-Open|closed-Closed"},
        {"name": "channel", "type": "form_dropdown", "value": "call::webservice_testing_tool_model::get_channel_names"},
        {"name": "password", "type": "form_password"},
        {"name": "extra", "type": "form_textarea", "desc": "JSON"}
    ],
    "authenticate_username": {"disabled": "Logging in is done by your app, it is not tested from the control panel"}
}

• form_input, form_textarea and form_password are fields, form_dropdown a choice: explode::key-label|key-label, or call::model::method for a model method that returns the choices.
• A field named extra is free JSON, like Data (JSON).
• {"disabled": "reason"} shows the reason instead of the form, e.g. logging in with the Auth API.
• An endpoint without test fields can be tried as well, with Data (JSON).