API Client

Introduction

Jasper's API Client is a Postman-compatible tool for testing APIs that lives inside your team workspace. It runs in two surfaces — the web app at /api-tester for quick access from anywhere, and the Jasper desktop app, which sends requests from your own computer so localhost and VPN APIs work — and both stay in sync via the same backend.

Coming from Postman? Jump straight to the Import Postman Collections section or sync from Postman, or read the Jasper vs Postman comparison for a side-by-side feature and pricing breakdown. For the high-level pitch, see the product page.

Related guides

The API Client is one piece of Jasper's developer-tools surface. Related guides:

• Jasper desktop app — install it to reach localhost and VPN APIs and to upload large files.
• GitHub Actions — wire collection runs into your CI pipeline.
• API tokens — for programmatic access to Jasper's own API.
• Public gallery — browse and fork shareable collections.

What's new in May 2026

The 16-PR rollout (see changelog) brought the full Postman-clone surface to the web. Highlights:

• Collections + folders with Postman v2.0 / v2.1 import, and OpenAPI / Swagger spec import.
• Request editor with GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS, Headers / Params / Body / Auth tabs, and a one-click Send button (see Request Builder).
• Environments with {{varName}} substitution across URLs, headers, params, body, and auth (see Environment Variables).
• Runs history — every request saved with full payload, response, status, time, and size.
• Monitors with cadence and custom cron, plus email or webhook alerts when a run fails.
• Mock server backed by saved examples, with a public mock URL that answers GET requests.
• AI helpers — describe a request in plain English, analyse a response, or generate Markdown docs from a collection.
• Version history with side-by-side diff and per-revision rollback.
• Roles (Viewer / Editor / Admin) for each person in a workspace.
• Postman export — export to Postman v2.1. OpenAPI is import only.

Key Features

• Collections & Folders — Organize requests in hierarchical collections
• Environment Variables — Switch between dev, staging, and production
• Request Builder — Support for all HTTP methods
• Response Viewer — Syntax highlighting for JSON, XML, and more
• Workspaces and roles — Keep each client's collections and environments with the people who work on them
• Request History — Track all requests with versioning

Getting Started

Opening the API Client

1. Open the Jasper desktop app, or /api-tester in the web app
2. Click API Client in the sidebar
3. You'll see your workspace with collections on the left

Creating Your First Request

1. Click the + button to create a new tab
2. Select the HTTP method (GET, POST, PUT, etc.)
3. Enter the URL you want to test
4. Add any headers, query params, or body as needed
5. Click Send

Collections & Folders

Organize your API requests into collections and folders for easy access and sharing.

Creating a Collection

1. Click New Collection in the sidebar
2. Enter a name and optional description
3. Choose the visibility (personal or team)
4. Click Create

Listing collections over the API

GET /api/v1/api-tester/collections returns a light summary of each collection by default: its details plus the number of folders and requests and the time anything inside last changed. Add ?include=tree to get every collection's full tree of folders and requests; that form returns at most 10 collections per page, so page through with page. To read one collection's tree, fetch that collection directly.

Organizing with Folders

Collections can contain nested folders to organize requests by endpoint, feature, or any structure you prefer.

• Right-click a collection to add a folder
• Drag and drop requests between folders
• Folders can be nested up to 5 levels deep

Saving Requests

1. Configure your request in the main panel
2. Press Cmd+S (Mac) or Ctrl+S (Windows)
3. Select the collection and folder to save to
4. Enter a descriptive name
5. Click Save

Request Builder

HTTP Methods

All standard HTTP methods are supported:

Method	Use Case
GET	Retrieve data
POST	Create new resources
PUT	Update/replace resources
PATCH	Partial updates
DELETE	Remove resources
HEAD	Get headers only
OPTIONS	CORS preflight

Headers

Add custom headers to your requests:

• Click the Headers tab
• Enter key-value pairs
• Toggle headers on/off without deleting them
• Common headers like Content-Type are auto-suggested

Query Parameters

Add query string parameters:

• Click the Params tab
• Enter key-value pairs
• Parameters are automatically URL-encoded
• The URL updates in real-time as you add params

Request Body

For POST, PUT, and PATCH requests, configure the request body:

Type	Description
JSON	Raw JSON with syntax highlighting and validation
XML	Raw XML content
Text	Plain text body
Form Data	multipart/form-data for file uploads
URL Encoded	application/x-www-form-urlencoded

Authentication

Configure authentication for your API requests:

Supported Auth Types

Type	Description
No Auth	No authentication required
API Key	Send key as header or query param
Bearer Token	JWT or OAuth access tokens
Basic Auth	Username and password

Setting Authentication

1. Click the Auth tab in the request builder
2. Select the authentication type
3. Enter the required credentials
4. Auth headers are automatically added to requests

Environment Variables

Use environment variables to switch between different configurations.

Creating Environments

1. Click the environment dropdown in the top bar
2. Select Manage Environments
3. Click Add Environment
4. Enter a name (e.g., "Development", "Staging", "Production")
5. Add key-value pairs for your variables

Using Variables

Reference variables in your requests using double curly braces:

{{base_url}}/api/users/{{user_id}}

Variables can be used in:

• URLs
• Headers
• Query parameters
• Request body
• Authentication fields

Variable Scope

• Environment Variables — Tied to the selected environment
• Collection Variables — Shared across the collection
• Global Variables — Available in all requests

Response Viewer

After sending a request, view the response with full details:

Response Body

• Syntax highlighting for JSON and XML
• Collapsible/expandable JSON tree view
• Raw view for plain text
• Search within response
• Copy response to clipboard

Response Details

• Status — HTTP status code and message
• Time — Request duration in milliseconds
• Size — Response body size
• Headers — All response headers
• Cookies — Set-Cookie headers

Request Tabs

Work on multiple requests simultaneously with tabbed interface:

• Open multiple tabs for different requests
• Tabs show unsaved changes indicator
• Reorder tabs by dragging
• Middle-click to close tabs
• Right-click for tab options

Request History

All requests are automatically logged in history:

• View recent requests in the History panel
• Search history by URL or method
• Click any history item to load it
• History is synced across devices

Import Postman Collections

Easily migrate from Postman by importing your existing collections:

1. Export your collection from Postman (v2.0 or v2.1 format)
2. In the API Client, click Import
3. Select the exported JSON file
4. Review the import preview
5. Click Import

Supported imports include:

• Collections with folders
• Requests with all settings
• Environment variables
• Collection variables

Sync from Postman

Instead of exporting files, connect your own Postman API key and Jasper keeps the workspaces you choose in step, one way: from Postman to Jasper. Each Postman workspace lands in your own private Jasper workspace, or in the workspace it's linked to if you're an Editor or Admin there (see Workspaces and roles). Environments and credentials stay private to you: the shared copy holds {{postman_*}} placeholders, and the values go into your own encrypted environment. The key is stored encrypted and never shown again. Jasper checks for changes every 15 to 240 minutes, depending on your Postman API quota.

Everything in a collection comes across, and exports back as Postman wrote it: scripts on the collection, its folders and requests, every auth type, every body mode (file uploads included), path variables, saved examples, and each workspace's globals, which become its Jasper workspace's globals environment. The web editor shows multipart and file bodies, and auth other than bearer, basic and API key, read-only: edit those in the desktop app.

Connect in Personal settings > Integrations, in the desktop app's Import dialog, or through the API below.

Endpoints

Paths start with /api/v1/api-tester and act only on your own connections in your current organisation. GET needs the api-tester:read scope; the others need api-tester:write. Create a token in Personal settings > API Tokens with the API client scopes (see API tokens).

Method and path	What it does
GET /postman	Your connections and their sync status. Add ?workspaces=1 for the workspaces each key can see.
POST /postman	Connect with {"token": "PMAK-..."}. The same Postman account replaces its key; another account adds a connection. Up to 10 key checks a minute.
PUT /postman/{id}	Choose the workspaces to sync with {"workspaces": ["workspace-id"]}, which starts a sync. An empty list turns sync off. Counts toward the sync limit.
POST /postman/{id}/sync	Sync now. Answers 202 at once; last_synced_at changes when the run ends. Up to 6 syncs a minute, counted with the web page.
DELETE /postman/{id}	Disconnect. Synced collections and environments stay in Jasper.

Errors: 422 with error.code postman_error when Postman refuses the key or can't be reached, or when no workspace is chosen yet; 422 VALIDATION_ERROR with the fields in error.details; 404 for a connection that isn't yours; 403 insufficient_scope; 402 when the API client is off for your organisation; 429 past a limit.

Example

curl -X POST https://heyjasper.ai/api/v1/api-tester/postman/12/sync \
  -H "Authorization: Bearer $JASPER_TOKEN" \
  -H "Accept: application/json"

{
  "success": true,
  "data": {
    "id": 12,
    "name": "Amy Lee (Acme)",
    "workspace_ids": ["ws-1"],
    "last_synced_at": "2026-09-30T10:15:00+00:00",
    "poll_minutes": 15,
    "paused_until": null,
    "last_error": null,
    "summary": {"collections": 3, "environments": 1, "secrets_moved": 4, "warnings": []},
    "quota": {"remaining": 9120, "limit": 10000}
  },
  "message": "Postman sync started."
}

When a sync finishes, the desktop app gets the new status over its live connection, so it doesn't need to poll. The key and your credentials never appear in any response.

Workspaces and roles

A workspace holds one client's collections and environments, and only its members see them. A client can have as many workspaces as you need (for example SCOS Staging and SCOS Production), each linked to the client in Client Hub and grouped under it in the switcher. What's in My workspace is yours alone.

Role	What it allows
Viewer	See everything in the workspace, send requests, run them in the desktop runner, and export. Keep your own personal environments there.
Editor	Also create, change and delete requests, folders, examples, workflows, monitors and shared environments, and move your own collections in.
Admin	Also delete collections, restore versions, publish docs, link a repository, move things out, and manage the workspace: its name, client and members.

• Creating a workspace makes you its Admin and only member until you add people. When it's linked to a client, the people who logged time on that client lately are suggested first; nobody is ever added for you.
• Removing someone takes away the workspace, including what they made in it. Their desktop app drops its tabs, history and saved values the next time it connects.
• Organisation owners and admins see every workspace and its members, and can manage them, but see none of the content until they add themselves. Adding yourself is recorded in the audit log and shown in the members list.
• Secret values in a shared environment stay with the person who set them: everyone else sees the variable and fills in their own value.

Manage workspaces from the switcher at the top of the desktop app's API client. On the web, the collections page filters by workspace, and a new collection can go straight into one.

Desktop & Web Sync

The desktop app and the web app are two views into the same data. Anything you create or change on one surface shows up on the other. There's no “export and re-import” step.

How sync works

• Same backend — both surfaces talk to the Laravel api-tester/* endpoints, so collections, environments, history, and team membership are identical regardless of where you opened them.
• Real-time updates — the desktop app is told over your own WebSocket channel when something you can see changes, so an edit propagates within a second to everyone in the workspace.

When to use which surface

Use case	Recommended surface
Hitting a localhost API on your machine	Desktop (no browser CORS, full network access)
File uploads > 10MB	Desktop (browser upload limits don't apply)
Quick check from a teammate's laptop or a kiosk	Web (no install required)
Mobile or tablet on the go	Web (responsive on smaller screens)

Keyboard Shortcuts

Action	Mac	Windows
Send Request	Cmd+Enter	Ctrl+Enter
Save Request	Cmd+S	Ctrl+S
New Tab	Cmd+T	Ctrl+T
Close Tab	Cmd+W	Ctrl+W
Search Requests	Cmd+P	Ctrl+P
Toggle Sidebar	Cmd+B	Ctrl+B

Troubleshooting

The variable I referenced is showing up as literal {{name}} in the URL or response

Three things to check:

• Environment selected? — the environment dropdown in the top bar should show the environment that defines this variable. If it shows No environment, pick one.
• Variable name typo? — variables are case-sensitive. {{baseUrl}} won't pick up a variable defined as baseurl.
• Scope conflict? — environment variables override collection variables, which override globals. Open Manage environments and check which scope is winning.

Request fails with a CORS error

CORS is a browser-only restriction. The desktop app uses Electron's net module, which bypasses CORS entirely — if the same request fails in the web app but works on desktop, that's the cause. For day-to-day testing of your own backend, switch to the desktop app, or configure your server to send the appropriate Access-Control-Allow-Origin header.

Collection isn't syncing across devices

1. Check the sync status indicator (bottom-right of the desktop app, or the connection dot in the web sidebar). If it shows Offline, you've lost your WebSocket connection — refresh the page or restart the app.
2. Confirm both surfaces are signed in to the same organisation. The dropdown is at the top-left of the workspace.
3. Check that the collection is shared with the team, not marked personal. Right-click the collection → Visibility.
4. If you're behind a corporate firewall or VPN, WebSocket traffic on port 443 to ws.heyjasper.ai needs to be allowed.

The Authorization header isn't being sent

Open the Auth tab. If it's set to Inherit from parent but no parent (collection or folder) defines an auth strategy, no header is added. Either set an explicit auth type on the request, or configure auth on the collection.

File upload fails with “Request entity too large”

The hard limit on a single uploaded file is 100MB. Above that you'll need to chunk the upload, use a presigned URL flow, or temporarily target your server's raw upload endpoint outside the API client.

“Server unreachable” or 5xx on every request

First check the status page. If everything's green, copy the Request ID from the response viewer's Detailed tab and send it to support — we can trace the request server-side from that ID.

Postman import skipped some requests

We support Postman Collection v2.0 and v2.1. v1 collections must be converted in Postman first (right-click the collection → Edit → toggle to v2). Scripts and every auth type are imported with the collection and export back unchanged; the web editor and server runs support part of Postman's pm.* scripting, and bearer, basic and API key auth (see the roadmap).

Future Features

Planned features for upcoming releases:

• OAuth 2.0 — Full OAuth authentication flows
• Scripts on the web and in monitors — the desktop app runs scripts in Postman's own engine; the web client runs none, and monitors run a subset of pm.*
• GraphQL explorer — GraphQL bodies send today; there is no schema explorer
• WebSocket Testing — Test WebSocket connections