To find the APIs a website calls, open your browser’s developer tools, select the Network panel, and reload the page while recording. Then repeat the interaction you want to understand—such as searching or submitting a form—and inspect the resulting requests. Replay a captured request in an API client to test it, but treat browser traffic as evidence of what that particular journey did, not as a complete API specification.
1. Capture the website’s network requests
- Open the page you are authorized to inspect.
- Open the browser’s developer tools and select Network before reloading or interacting with the page. Chrome says DevTools records network requests while it is open: Network features reference.
- Reload the page, then perform the specific action you want to trace: for example, submit a search, move to the next results page, or save a form.
- Use the Network panel’s filters to narrow the list. Look for likely data requests, but remember that the panel also shows scripts, images, stylesheets, analytics, and other resources; not every request is an API call. See Chrome’s guide to inspecting network activity.
If recording began after the request occurred, reproduce the action with the panel open. A page may also make requests only after a specific interaction, so a reload alone may not show the endpoint you are looking for.
As an Amazon Associate I earn from qualifying purchases.
2. Read the request as an exchange, not just a URL
Select a likely request and examine the method, full URL, query parameters, headers, request payload, status, response, initiator, and timing. These details help you connect a browser action to its request and understand what the server returned. Chrome documents separate Headers, Preview, Response, Initiator, and Timing views, as well as filtering and searching request data in its Network reference.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Method and URL: Identify the HTTP method and route. Query parameters may carry filters, search terms, or pagination values.
- Headers and body: Check content type and other relevant headers, and whether the request sends JSON, form data, or no body. Headers may also contain credentials or personal information—do not share them without redaction.
- Status and response: Record the status and inspect the response body or preview. A successful status does not by itself establish that the returned data was appropriate for the user.
- Initiator and timing: Use these views to see what triggered the request and how it fits into the page’s activity.
For a clean observation, note the action, account or role used, and relevant input alongside the request. The same endpoint can behave differently with different parameters, credentials, or application state.
#1 Best Overall
3. Turn a captured request into a repeatable test
Replay it in an API client
Postman’s Browser Tool can capture traffic generated while you interact with a site and open selected requests as HTTP requests containing their URL, parameters, headers, and body. You can modify and resend them, add tests, and save requests in collections. Its browser tool has its own cookies and browser session, so do not assume it shares the signed-in session from your main browser. Follow Postman’s Browser Tool traffic inspection guide.
Before replaying, identify which values are essential, which are session-specific, and which are safe to change. Keep credentials private. A captured request is a starting point for a test, not proof that the endpoint or its observed behavior is publicly supported.
Write functional checks
For inputs and actions in your approved test scope, check the expected status and response shape for valid requests. Also test missing and malformed inputs and confirm the response is sensible. Save repeatable cases so a future change can be compared against the same expected behavior.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Compare traffic with the API contract
If the site publishes API documentation or an OpenAPI description, compare it with what you observed. The two sources answer different questions: documentation describes intended or documented behavior, while browser traffic shows requests reached by the particular actions and account you used. OWASP recommends using documentation and observed behavior as complementary reconnaissance sources, and cautions that API descriptions can be inaccurate or incomplete: API Reconnaissance. For testing considerations, see OWASP’s REST Assessment Cheat Sheet.
Do not treat a route that appears in browser traffic as a complete inventory of the service, or an undocumented request as automatically defective. Compare actual behavior against the intended contract and access policy before reporting a discrepancy.
5. Check authorization only within your approved scope
For an authorized assessment, test whether access is enforced—not merely whether the request returns a response. Use accounts and test data within the agreed scope. Where permitted, compare behavior with no credentials, valid credentials, and credentials that lack the required role or scope. For object-level checks, use only objects you own or were explicitly authorized to test; for function-level checks, verify that actions are limited to appropriate roles.
Rank #3
OWASP identifies broken object-level authorization and broken function-level authorization as distinct API risks: API1:2023 and API5:2023. A 200 response alone does not prove that access control is correct. Do not probe other users’ identifiers, perform destructive actions, or test production data unless your written authorization and scope expressly allow it.
6. Protect captured requests and troubleshoot common problems
The request is missing
Likely cause: DevTools was opened after the request, or the action that triggers it has not been performed. Fix: Open Network first, reload, and reproduce the exact interaction.
The Network panel shows too many requests
Likely cause: The panel includes page assets and third-party traffic as well as likely API calls. Fix: Apply available filters, search request details, and repeat one action at a time. Confirm a candidate by checking its method, payload, response, and initiator rather than relying on its name alone.
The replayed request behaves differently
Likely cause: A cookie, token, header, parameter, or piece of browser state was not carried over, or the request depends on a current session. Fix: Compare the captured and replayed request fields, then use a valid test session and data within your authorization. Postman’s Browser Tool uses its own session rather than automatically sharing your main browser’s cookies.
The response looks successful, but the test is inconclusive
Likely cause: The status was treated as the only assertion. Fix: Check the response content and expected behavior, and—if security testing is authorized—test the relevant role and object access using approved accounts and data.
The captured traffic contains secrets
Likely cause: Requests may include session cookies, bearer tokens, personal data, or other sensitive values. Fix: Do not post raw HAR files or request exports publicly. Review and redact sensitive fields before sharing, and handle credentials according to your organization’s security process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server. It captures a page as an image or PDF; it does not discover or test a website’s API requests. If you need a visual capture alongside your API work, one GET request returns a screenshot:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for API options. Before a capture, it accepts cookie or consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each cleanup step can be turned off. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and response headers say which page verdict applied and whether the request was billed. Its MCP server provides screenshot, page-info, and PDF-capture tools for AI agents. The Free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000 shots. Sign up free for 1,000 screenshots a month, with no card.
Frequently Asked Questions
Does a website’s Network panel show every API endpoint it has?
No. It shows requests made during the actions and account state you observed, not a complete service inventory.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Is a captured browser request an official API contract?
No. It is evidence of an observed exchange; compare it with published documentation and the intended access policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
