API-Client v2.0 — Security Toolkit & Intercepting Proxy

API-Client v2.0 — Security Toolkit & Intercepting Proxy

Release Date: October 2, 2026

Major release introducing security testing tools, a Burp-style HTTP/HTTPS intercepting proxy, and an in-app documentation viewer.

🚀 Added

• Security Testing: Response security audits, encoding/decoding and hashing, JWT analysis, Repeater, Intruder fuzzing, IDOR/BOLA testing, and security assertion snippets.
• Intercepting Proxy: HTTP/HTTPS interception with MITM, configurable host and port, live HTTP history, filtering, request/response editing, and interception controls.
• Tool Integration: Send captured requests directly to Repeater, Intruder, or Collections.
• Documentation: Illustrated user guide and in-app Markdown viewer accessible via Help → Documentation or F1.

🔧 Changed

• Introduced a blue accent theme for dark and light modes.
• Disabled SSL certificate verification by default, configurable in Settings → General.
• Improved UI consistency, dropdowns, buttons, and documentation window controls.

⚠️ Security Note

SSL certificate verification is disabled by default. Enable it in Settings → General when certificate validation is required.

API Client v1.0 - Initial Release

API Client v1.0 Release Notes

Release date: 30 September 2026

API Client is a Windows desktop app for sending HTTP requests to APIs and inspecting the responses. This first release covers the everyday API testing workflow: build requests, organise them into collections, switch between environments, check responses automatically and run whole collections at once.

Highlights

• Collections and environments: save requests in folders and switch between Dev, QA and Prod servers with one click.
• Variables everywhere: use {{baseUrl}}, {{token}} and others in URLs, headers, bodies and auth. Undefined variables show in red, and hovering a variable shows its value.
• Automated checks: add tests without writing code, or write Python scripts for more control.
• Chained requests: save a value from one response (for example a login token) and use it in the next request.
• Collection Runner: run every request in a collection or folder and see a pass/fail summary.
• Import what you already have: Postman collections and environments, OpenAPI/Swagger files and cURL commands.

Features

Requests

• Methods: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, TRACE
• Several requests open at once in tabs; unsaved changes are marked with a dot
• Query parameters stay in sync with the URL
• Path variables such as /users/:id
• Headers and parameters can be switched on or off individually, or edited in bulk as text
• Body types: none, form-data (text and file uploads), x-www-form-urlencoded, raw (JSON, text, XML, HTML, JavaScript), binary file, GraphQL
• Paste a cURL command into the URL bar to turn it into a request
• Markdown documentation for each request

Authorization

• API Key, Bearer Token, Basic, Digest, JWT (HS256/HS384/HS512) and OAuth 2.0 (client credentials and password grant, with "Get New Access Token")
• Set auth once on a collection or folder, and requests inside it inherit it

Responses

• Status, time and size at a glance, with a breakdown on hover
• Body views: Pretty (colour-coded), Raw, Preview (HTML pages and images) and Tree (browse JSON)
• Search, word wrap, copy and save the response to a file
• Cookies, response headers, test results and a timeline of what was sent and received

Testing and automation

• No-code assertions on status code, response time, JSON values, headers, body text and size
• Rules that save values from a response into variables
• Python pre-request and post-response scripts, with ready-made snippets
• Collection Runner with multiple iterations and a delay between requests

Organisation

• Collections with nested folders and drag & drop reordering
• Environments and global variables; secret values are hidden on screen
• Quick view of all current variable values from the top bar
• History of every request sent, grouped by day
• Export collections and environments in Postman format
• Code snippets for cURL, Python, JavaScript, Node.js, C#, PowerShell and Go

General

• Dark and light themes
• Side-by-side or stacked layout for the request and the response
• Open tabs and window layout are restored on restart
• Console listing every request sent, with full details
• Settings for timeout, maximum response size, redirects, SSL verification and proxy
• Keyboard shortcuts for common actions (Help → Keyboard Shortcuts)

Getting started

1. Run api-client.exe. Python is not needed for the EXE.
2. Click New → HTTP Request, enter a URL and press Send (or Ctrl+Enter).
3. To use an existing API definition, click Import, or drag a Postman or OpenAPI file onto the window.
4. To set the server address, right-click the collection → Edit → Variables and set baseUrl. For several servers, use environments instead.

Your data is stored in %LOCALAPPDATA%\APIClient. Open it from Help → Open Data Folder.

Upgrading from the earlier internal version

• Your theme and request settings are kept.
• The separate Base URL box has been replaced by the baseUrl variable, set on the collection or in an environment.
• Fixed: JWT authorization no longer crashes.
• Fixed: JSON responses now stay formatted.
• Fixed: the window no longer freezes while a request is in progress.
• Fixed: the app starts faster; it no longer waits to download its icon from the internet.

Known limitations

• Scripts are Python, not JavaScript. JavaScript scripts in imported Postman collections are brought in as comments and do not run.
• Cookies are not carried between requests. Each request starts with no cookies; set a Cookie header if you need one.
• OpenAPI files must be JSON. YAML files are only supported if the PyYAML package is available when running from source.
• The Collection Runner uses the saved versions of requests, so save your changes before running.
• Secrets are stored as plain text in the data folder, and code snippets show real values. Remove sensitive values before sharing exports or snippets.
• Scripts run with your Windows user's permissions. Only run scripts you trust.
• Windows only. The first start of the EXE takes a few seconds while it unpacks.
• WebSocket, gRPC and mock servers are not supported.