HttpDash documentation
How every part of HttpDash works, in detail. For what HttpDash is and a quick start, see the README; for what changed in each version, the changelog.
Getting started
- Install and updateDownload the latest version from the releases page.
- Import and export everythingExport (top bar) offers two formats.
- Keyboard shortcutsCtrl on Windows and Linux, Cmd on macOS. They also appear in the menus.
- Features at a glanceEverything HttpDash does, in one list: requests, responses, scripts, organisation, the runner, import and export, and the tools.
Sending and testing
- Auth dependencies (auto-refresh tokens)A collection, folder or request can name another request, such as Login, to run first when the token it needs is missing or expired. Set it…
- Data files (data-driven runs)A data file runs the same requests once per row: one row per iteration, in the Collection Runner, the command line (-d) and for AI agents…
- Request versions and spec warningsEvery distinct version of a request you send by hand (method, URL, params, headers, body, auth) is kept with the response it got. Open…
- Tags and searchTag requests (smoke, orders, admin, up to 20 of 40 characters each) in the field under the request's name, which suggests the tags already…
- GraphQLPick GraphQL as a request's body type, then write the query and its variables (JSON). It's sent as a POST with query, variables and, when…
- gRPC requestsCreate one with New → gRPC Request, or Add gRPC request on a collection or folder. It's saved like any request (shown as GRPC), so it lives…
- Streaming responses (Server-Sent Events)When a response is text/event-stream, as with AI APIs that stream their answers, HttpDash shows each event the moment it arrives instead of…
- WebSocket requestsCreate one with New → WebSocket Request, or Add WebSocket request on a collection or folder. It's saved like any request (shown as WS), so…
- Spoofing Referer, Origin, User-Agent and other headersRequests are sent from Node's HTTP stack, not a browser, so none of the browser's "forbidden header" rules apply. Whatever you put in the…
- Script sandboxScripts run in a sandbox: QuickJS, a separate JavaScript engine compiled to WebAssembly. Each request (with its collection and folder…
Automation
- Flows (request orchestration)A flow runs requests as a diagram: each request is a node, connections set the order, values pass from one request to the next, and…
- Command-line runner (CI and schedulers)Run collections without opening the app, like Postman's Newman. The runner needs Node.js 22+.
- MonitorsMonitors (sidebar) run a collection or folder on a schedule, from every minute to every 24 hours, against a chosen environment.
- Mock serverEach collection has a Mock server tab that serves the examples saved on its requests. To save one, send a request, then use the response's…
- AI agents (OpenAPI and MCP)AI agents such as Claude can use HttpDash the way you do: read your collections and environments, send requests and read the responses, set…
Services and networks
- Service discovery (auto-create environments)Point HttpDash at a service registry and it builds an environment with one variable per service. For example, {{orders_url}} =…
- Environment diagramsAn environment's Diagram page (next to Variables) draws where its requests go, from what HttpDash already knows. No agent runs in your…
- Health while it runs (profiling)Give a request, a folder or a collection a health URL, and HttpDash reads it before the request is sent, while it is in flight, and after…
- Where a request went on the networkThe Timeline tab has a Network section for every request.
- Tunnels into internal networksReach services on a private network (a plant, a data center, a Kubernetes cluster) without a VPN. Add tunnels in Settings → Tunnels.
- Client certificates and custom CAsFor APIs that use mutual TLS, add a client certificate in Settings → Certificates.
Teams and security
- Team sharing through gitShare collections and environments with your team through any git repository: GitHub, GitLab, Bitbucket, Azure DevOps, Gitea or your own…
- App lock with LDAP sign-inHttpDash can require a directory (LDAP) sign-in before it opens. Set it up in Settings → Security.
- Secret scan and audit logTools → Scan for Secrets (also in Settings → Security and the Export dialog) looks for credentials typed directly into requests.