ScratchAPI
Features

Everything it does, section by section.

ScratchAPI is built for the moment you just need to hit an endpoint, with enough structure to keep a real API tidy. Here is the whole list.

Requests

A request editor with the pieces you reach for most, and nothing you have to dismiss first.

  • GET, POST, PUT, PATCH, DELETE with query params, headers and a raw or JSON body.
  • Friendlier body editor. Tab and Shift+Tab indent and outdent, Escape then Tab leaves the field, and Enter keeps your indentation.
  • Real error messages. A failed request shows the underlying cause, such as DNS, connection refused or a TLS certificate problem, instead of a generic “fetch failed”.
  • Instant startup. A small Electron app that opens straight to where you left off. No sign-in screen and no workspace picker.
  • Private CA support. Trust an extra certificate for local mkcert setups and internal servers, from Settings.

Responses

Read the answer quickly, then get on with it.

  • Colour-coded JSON with separate Data and Headers tabs.
  • Copy button for the body, in the request panel and in history.
  • Find in response. Press Ctrl+F (Cmd+F on macOS) for highlighted, case-insensitive matches with a counter and previous and next.
  • Resizable panel. Drag the top edge, use the arrow keys on the handle, or double-click to reset. The height is remembered.
{
  "id": 1,
  "email": "admin@example.com",
  "roles": ["admin"],
  "verified": true
}

Collections and folders

Choose a collection from a dropdown and the Requests panel shows only that collection. The icon sidebar is ordered Collections, Requests, Environments, History, and clicking the active icon collapses it.

  • Collection overview. A Markdown description, a request summary you can filter by HTTP method, and a linked environment that is switched to when you select the collection.
  • Folder view. Click a folder's name for a breadcrumb, rename, request and subfolder counts, its subfolders, and every request inside it with method filters and edit and delete buttons.
  • Create in place. New request, New subfolder, Import request and Paste cURL, always into the folder you are looking at.
  • Safe deletes. Deleting a folder or request asks for confirmation. A folder is removed with everything inside it.
  • Collapsible folders in the sidebar, remembered between sessions.

Environments and variables

Use {{name}} in the URL, params, headers and body. Switch environment from the header to point the same collection at local, staging or production.

  • Highlighted as you type. Blue when defined, amber when missing, red when circular. Hover to see the current value.
  • Sensitive variables. A lock toggle masks the value, with an eye button to reveal it temporarily.
  • Safe by default. A circular reference blocks the request and tells you which variables form the loop.
ColourMeaning
BlueDefined in the active environment
AmberMissing; sent as the literal text
RedCircular; the request is blocked

Capture rules

After a successful (2xx) response, a rule saves a value into a variable of the active environment. Read it from a JSON body path such as data.access_token or items[0].id, or from a response header.

The response panel confirms which variables were saved and warns when a rule can't apply.

Authentication

Auth is set per collection, on its Authentication tab. Requests inherit it, any request can opt out with “No auth”, and sign-in refreshes itself when a token runs out.

TypeWhat it does
Bearer tokenSends Authorization: Bearer <token>.
Basic authSends a base64 encoded username and password.
API keySends a static key as a header or as a query parameter.
OAuth 2.0Client credentials, password and authorization code (PKCE, loopback redirect) grants. Tokens live in the active environment, renew before they expire, and refresh after a 401 using the refresh token when there is one.
Login requestPoint the collection at your own login request and an optional refresh request. A missing token runs login first; a 401 runs refresh, then login, and the request is retried once.
Login and refresh requests are always sent without auth. The response panel adds a note whenever something was renewed on your behalf.

Request docs

Describe what an endpoint does next to the request that calls it.

  • Markdown everywhere. Collection and request descriptions render by default; click the pencil to edit.
  • Argument list. Note each argument's location, whether it is required or optional, its default and what it means. “Add from request” fills the list from the request's params and headers.
  • Read-only context. The Docs tab shows the request's method and URL alongside.

cURL and sharing

Move requests between ScratchAPI, your terminal and your teammates without an account in the middle.

  • Copy as cURL with variable values filled in, or with {{placeholders}} kept. Basic auth (-u) and query-parameter API keys are included.
  • Paste cURL into the URL field to fill the current request, or use Paste cURL in a collection or folder to create a new one. Unsupported options are reported.
  • Export and import JSON for a collection or a single request. Imports are validated, get fresh IDs and never overwrite what you already have.
  • Secrets stay home. Environments are never exported, and literal secrets typed into a collection's auth settings are left out. {{variables}} are kept.
# Copy as cURL
curl -X POST \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@example.com"}' \
  'https://api.example.com/auth/login'

History

Every sent request is stored with its response, so yesterday's answer is still there today.

  • Read-only replay. Open an entry to see the request as sent, its outcome and the stored response, including headers and body (bodies are capped at 256 KB per entry).
  • Take it with you. Copy a history entry as cURL, or save it into a collection, which defaults to its original one.
  • Tidy by design. History keeps the most recent 20 entries and drops the oldest. Inherited auth is added at send time, so tokens are not written into history entries.

Storage and privacy

Collections, environments, history and settings are readable JSON in the app's data folder (~/.config/scratchapi/ on Linux), with 2-space indentation and stable key order, so diffs stay clean.

ScratchAPI
Account requiredNo
Works fully offlineYes
TelemetryNone
Data formatLocal JSON files
Share a collectionExport a JSON file
  • Version them. Put the folder in git, or symlink it into a repo.
  • Private by permission. Data files are written owner-only (0600), because they can hold tokens and response data.
  • Locked-down window. Links in rendered Markdown open in your system browser (http, https and mailto only), and the app window can't be navigated away or open new windows.
  • Old data keeps loading. New fields are optional, so existing files continue to work after an update.