The builder assembles one HTTP request — method, URL, query parameters, headers, optional Basic or Bearer authentication and a body — and writes it out as a cURL command and a Fetch snippet. The same request can be sent from this tab when the target API lets the browser call it.
The second panel reads a local OpenAPI 3.x or Swagger 2.0 document, pasted or chosen from disk, and fills the builder with one of its operations. Nothing is uploaded, and no URL is fetched while the document is analysed.
The cURL pane is a single command: curl -X with the method, the URL including its query string, one -H per header and --data-raw for the body, with single quotes escaped for the shell. The Fetch pane is the matching fetch() call with the method, the headers object, credentials: "omit" and the body as a string.
Download request JSON saves the method, URL, headers, body and body type as kivtools-http-request.json, with Authorization, Cookie and X-API-Key values replaced by [redacted]. Download OpenAPI fragment writes an OpenAPI 3.0.3 document whose server is the URL origin and whose single operation carries the query string as query parameters, your headers as header parameters, a requestBody inferred from the body, and a bearer or basic security scheme when you selected one.
Header lines must read Header-Name: value, and header names must be valid HTTP token characters. The names the browser controls — Host, Origin, Referer, Cookie, Content-Length, Connection, Accept-Encoding, DNT, Date, Expect, Keep-Alive, TE, Trailer, Transfer-Encoding, Upgrade, Via and the Access-Control-Request-* pair — are refused before the request is built, and the message names the one that was rejected.
Content-Type is filled in only when you have not set it yourself: application/json for JSON, text/plain;charset=utf-8 for plain text and application/x-www-form-urlencoded;charset=UTF-8 for form bodies. Query values are percent-encoded, and a key left without a value is sent as an empty parameter.
Analysing a document lists every operation as METHOD /path — summary, shows the first 24 in the panel and reports the total. Choosing one fills in its server — with default values substituted for server variables — its path, query parameters, header parameters, path parameters and a sample body taken from example, examples or the schema.
A document without a paths object, or without an openapi or swagger version, is rejected as not an OpenAPI 3.x or Swagger 2.0 document with paths. YAML is parsed in the browser. A path parameter with no example keeps its {name} placeholder, and the builder says so instead of generating a broken address.
Send request calls the URL you typed from this browser with CORS mode and credentials omitted, so the API has to allow voritools.com. The response card reports the status code and text, the elapsed time in milliseconds, the preview size and the response headers; the body preview stops at 1 MB and the request is aborted after 30 seconds.
An API that answers without CORS headers, a closed port or a rejected certificate ends in “Failed to fetch”, with a reminder to check the URL, the CORS policy, the certificate, the network and the API authentication. The request stays in the tab: nothing is uploaded, nothing is stored, and the only network call is the one you start.