Free tools for API debugging
Format it, validate it, decode the token, check the status — all in the browser.
A failing API call rarely tells you why on the first read. This workflow walks the response from raw text to root cause: pretty-print it so you can see the shape, validate the structure, drill into the nested field that’s wrong, decode the bearer token when it’s a 401, confirm the HTTP status actually means what you think, and diff the payload against a known-good one. Every tool runs in your browser, so the response body and token never leave your machine.
- 1
Format the response
Paste the raw body and pretty-print it so nested objects and arrays are readable. A formatter also surfaces the trailing comma or unquoted key that made it “malformed”.
- 2
Validate the structure
Confirm the JSON is actually valid and see the exact line and column of the first syntax error, rather than guessing from a generic parse failure.
- 3
Inspect the nested data
Use a JSONPath query to pull just the field or array you care about out of a large response, instead of scrolling through the whole tree.
- 4
Decode the auth token
If it’s a 401 or 403, decode the JWT to read its claims and expiry, or generate a fresh test token with the exact scopes your endpoint expects.
- 5
Check the HTTP status
Look up what the status code actually implies — a 200 with an error body and a 204 mean very different things, and 4xx vs 5xx tells you which side to fix.
- 6
Replay the request
Convert a Postman request to curl, turn curl into code in your language, or fire a test request at a webhook endpoint to reproduce the failure.
- 7
Diff against a known-good payload
Compare the broken response against a working one to spot the field that changed — often the fastest way to find a subtle regression.
Frequently asked questions
Start by formatting the raw body so its structure is visible, then validate it to get the exact position of any syntax error. From there, query the specific nested field with JSONPath, and if authentication is involved, decode the token to check its claims and expiry. Finally, diff the response against a known-good payload to isolate what changed.
Decode the JWT and check three things: the exp claim (an expired token is the most common cause), the aud/iss claims (a token minted for a different audience or issuer is rejected), and the Authorization header format itself — it must be “Bearer <token>” with a single space and no stray quotes.