QA Bash Studio/API Testing Workbench
// Execute a request to generate automation code| JSON Path | Type | Observed Value | Verification |
|---|---|---|---|
| Execute a request to populate the verification matrix | |||
QA Bash's API Testing Workbench is a free, browser-based REST and GraphQL client — no installation required. Send requests, inspect response trees, verify every response field against a manual checklist you can export to CSV, and auto-generate ready-to-run automation scripts in Pytest, Java, Playwright, or cURL directly from any request you've made. Six built-in sample requests let you try it without a real API.
Everything an SDET needs in one tab.
REST & GraphQL Support
Send GET, POST, PUT, PATCH, DELETE, and HEAD requests. Switch Body Type to GraphQL for a dedicated Query + Variables editor — introspection queries, fragments, and mutations all work since it's just query text sent to your endpoint.
Automation Script Generation
Click Generate Script and get working code in Pytest, Java (RestAssured), Playwright (TypeScript), or cURL — complete with headers, body, and assertions. Copy and run immediately.
Field Verification Matrix
Every response field gets flattened into a checklist — JSON path, type, observed value — with a manual Assert/Pass/Fail/Skip mark per field. Export the checklist to CSV for your test evidence.
Auth & Header Management
Configure Bearer tokens, API keys, Basic auth, and custom headers. Headers persist across requests in a session so you're not re-entering credentials every time.
JSON Response Inspector
Collapsible JSON tree or raw pretty-printed view, response time, status code, headers, and size — all visible at a glance. Hover or click any node to copy its JSONPath.
Request History
Every request is saved to history — method, URL, headers, body, and auth type — and persists across page reloads. Click any entry to fully restore and re-send it. Auth tokens are never saved to disk; re-enter them after a reload.
How QA teams use the Workbench.
Rapid API Exploration
When a new backend endpoint ships, open the Workbench and start exploring — no Postman collection setup, no team workspace. Test headers, auth, and response shapes in under 2 minutes.
Manual Verification, Documented
After a deploy, hit the endpoint and walk the flattened field checklist — mark each one Pass or Fail, export to CSV, attach it to the release ticket as evidence the contract still holds.
Script-First Automation Bootstrap
Use the Workbench to discover the right request shape manually, then generate the Pytest or Playwright script in one click. Eliminates the blank-file problem that slows automation engineers.
Frequently asked questions.
Is this a free alternative to Postman?
Yes — the QA Bash API Workbench covers the core use cases of Postman entirely in your browser. It adds SDET-specific features like automation script generation and a field verification matrix with CSV export that Postman requires paid plans for.
Does it support GraphQL?
Yes. Switch Body Type to GraphQL for a dedicated Query + Variables editor — queries, mutations, fragments, and introspection all work, since it's just query text posted as {query, variables} to whatever endpoint you point it at.
What automation scripts can it generate?
The Workbench generates working scripts in Pytest (Python), RestAssured (Java), Playwright (TypeScript), and cURL. Each script includes the full request — method, URL, headers, body — plus a basic assertion on the status code.
Is there a CORS limitation since it runs in the browser?
No — every request is sent through a server-side proxy, not directly from your browser, so standard CORS restrictions never apply, even against external APIs with no CORS headers of their own. Requests to internal/private addresses are blocked for safety.
Can I test APIs that require authentication?
Yes. The Workbench supports Bearer token, API key (query param or header), Basic auth (Base64 encoded), and fully custom headers. Auth type and token are restored when you click a history entry in the current tab; tokens are never written to disk, so a page reload asks you to re-enter them.
How does the field verification matrix work?
After sending a request, every field in the JSON response is flattened into a table — path, type, observed value — with a manual Assert/Pass/Fail/Skip mark you set per field. Export the whole checklist to CSV as evidence for a test run or bug report.
Do I need a real API to try the tool?
No — click "Load Sample" above the request bar for six ready-to-send presets against a built-in demo API: list/get/create/update requests, one that requires a bearer token (a real 401 without it), and a working GraphQL query.
More than a tool — a QA career platform.
Get access to 28+ senior SDET ambassadors, an AI intelligence feed, learning paths, and all five QA Bash Studio tools with session history.