OpenAPI 3.1.0 · v1.0.0
Upload JSON, get a URL, then make it slow, flaky or wrong on purpose.
A self-hosted mock API for testing clients against controlled responses. Plain Node.js, zero runtime dependencies.
Every route accepts the query controls delay, status, flaky, sequence, sequence_key, sequence_reset, header_<Name> and cors. They are listed on each operation.
Every JSON response except GET /mock/{id} uses the envelope { success, data | error, meta }, and every response carries X-Request-Id and Cache-Control: no-store unless you opt into caching with ?header_Cache-Control=....
Browsers can call every endpoint: CORS is on by default (Access-Control-Allow-Origin: *, preflights answered, custom headers exposed). Credentials are never allowed.
Store JSON and serve it back at a stable URL.
Stores any JSON value (object, array, string, number) and returns a URL that serves it. The body is stored minified by stripping whitespace only, so large integers, 2.50 and key order are kept exactly. Uploads expire after TTL_MS (24 h by default).
Save the delete_token: only its hash is stored, and it is needed to update or delete the mock.
Counts toward the per-IP write rate limit.
Returns the stored JSON exactly as saved, not wrapped in the envelope. Supports conditional requests: send the ETag back in If-None-Match to get 304 Not Modified.
Add ?header_Cache-Control=no-cache so browsers and HTTP libraries keep the response and revalidate it automatically.
Replaces the stored JSON, resets the expiry to now + TTL_MS, and returns a new ETag. The ID, created_at and delete token never change.
Send If-Match with the ETag you last read to avoid overwriting someone else's change: a stale ETag gets 412 and nothing is saved.
Deletes the mock immediately. If-Match is supported here too.
Endpoints for debugging what your client sends and receives.
Accepts any method and any body up to MAX_BODY_BYTES, stores nothing, and returns exactly what arrived: method, path, query (repeated keys as arrays), headers with their original casing and duplicates, and the body.
JSON bodies come back as raw text plus parsed json; binary as base64; multipart/form-data is split into parts, with a SHA-256 hash for each file. Credentials are shown as sent.
Accepts any body up to MAX_BODY_BYTES, stores nothing, and replies with one of the standard success outcomes for GET, picked at random: 200. Multipart and binary bodies are accepted but never parsed.
Accepts any body up to MAX_BODY_BYTES, stores nothing, and replies with one of the standard success outcomes for POST, picked at random: 201, 202. Multipart and binary bodies are accepted but never parsed.
Accepts any body up to MAX_BODY_BYTES, stores nothing, and replies with one of the standard success outcomes for PUT, picked at random: 200, 201, 204. Multipart and binary bodies are accepted but never parsed.
Accepts any body up to MAX_BODY_BYTES, stores nothing, and replies with one of the standard success outcomes for PATCH, picked at random: 200, 204. Multipart and binary bodies are accepted but never parsed.
Accepts any body up to MAX_BODY_BYTES, stores nothing, and replies with one of the standard success outcomes for DELETE, picked at random: 200, 202, 204. Multipart and binary bodies are accepted but never parsed.
Ready-made datasets for building UIs before the real API exists.
140 generated flights from New York (JFK) to Los Angeles (LAX) over the next 7 days, with airlines, aircraft, terminals, gates, DST-aware local times, layovers and multi-cabin fares. Generated from a daily seed: stable within a day, new the next.
Returns the whole list unless page or limit is sent; then one page with meta.pagination and links.
100 real US tickers with random market data: price, previous close, 1-day change, day and 52-week ranges, volume and market cap. Generated from a daily seed.
Returns the whole list unless page or limit is sent; then one page with meta.pagination and links.
Small nested user fixtures: profile, contact address with coordinates, company, preferences and stats.
Returns the whole list unless page or limit is sent; then one page with meta.pagination and links.
Product fixtures with category path, pricing and discounts, inventory by warehouse, variants and media.
Returns the whole list unless page or limit is sent; then one page with meta.pagination and links.
Order fixtures with customer, line items, totals in cents, payment, shipping address and a status timeline.
Returns the whole list unless page or limit is sent; then one page with meta.pagination and links.
Health and request information.
Returns what the server can see about your request: IP, port, HTTP version, query and headers. Authorization, Proxy-Authorization and Cookie are redacted.