cURL for API Testing: Commands Every Tester Should Know

cURL is the universal language of API debugging. Developers paste cURL commands into bug tickets, browsers export failing requests as cURL, Postman imports and exports it, and every Linux server and Windows 10+ machine already has it installed. If you can read and write cURL, you can reproduce any API problem in seconds, on any machine, without opening a tool. This lesson gives you every cURL command a tester needs, each runnable against the live practice API.

Why Testers Should Learn cURL

• Exact, shareable reproduction steps in one line.
• Available on servers and CI machines where there’s no GUI.
• Shows the raw truth: no tool silently adding headers.
• Imports straight into Postman (Import → Raw text) and other tools.

Check your install: curl --version. On Windows, use curl.exe in PowerShell (plain curl may be an alias for Invoke-WebRequest in older PowerShell), or use Git Bash.

Your First cURL Commands (GET)

BASE=https://sqatools.in/wp-json/sqa-api/v1

# Body only
curl $BASE/users/1

# Status line + headers + body  (use this by default when testing)
curl -i $BASE/users/1

# Headers only (HEAD request)
curl -I $BASE/users/1

# Query parameters - quote the URL so the shell doesn't treat & as "run in background"
curl -i "$BASE/users?role=admin&sort=age&order=desc"

# Let curl encode tricky values
curl -i -G "$BASE/users" --data-urlencode "q=gupta" --data-urlencode "per_page=5"

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/users?role=admin&sort=age&order=desc"

POST, PUT, PATCH, DELETE

# POST JSON (create)
curl -i -X POST "$BASE/objects" \
  -H "Content-Type: application/json" \
  -d '{"name":"cURL object","data":{"qty":1},"ttl":300}'

# POST JSON from a file (great for big payloads)
curl -i -X POST "$BASE/objects" -H "Content-Type: application/json" -d @order.json

# Newer curl (7.82+): --json sets Content-Type and Accept for you
curl -i --json '{"name":"short form","ttl":60}' "$BASE/objects"

# PUT (create/replace with your own id)
curl -i -X PUT "$BASE/objects/curl-demo-1" \
  -H "Content-Type: application/json" \
  -d '{"name":"Replaced","data":{"qty":5},"ttl":300}'

# PATCH (partial update)
curl -i -X PATCH "$BASE/objects/curl-demo-1" \
  -H "Content-Type: application/json" -d '{"data":{"qty":6}}'

# DELETE
curl -i -X DELETE "$BASE/objects/curl-demo-1"

# Form-encoded body (HTML forms, OAuth token endpoints)
curl -i -X POST "$BASE/echo" -d "name=Asha&city=Pune"

# Multipart file upload
curl -i -X POST https://your-app.test/api/upload -F "file=@invoice.pdf" -F "type=invoice"

Headers and Authentication

# Any header
curl -i "$BASE/users/1" -H "Accept: application/xml"

# Basic auth - curl builds the Base64 header for you
curl -i -u sqa_user:sqa@123 "$BASE/basic/profile"

# API key
curl -i -H "X-API-Key: sqa-key-12345" "$BASE/apikey/profile"

# Bearer token: log in, extract the token with jq, then call
TOKEN=$(curl -s -X POST "$BASE/auth/login" -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin@123"}' | jq -r .access_token)
curl -i -H "Authorization: Bearer $TOKEN" "$BASE/auth/me"

# Conditional request with an ETag
curl -i "$BASE/products/101" -H 'If-None-Match: "c2aee9e25c4daa9445361e1bb4a749f7"'

# Cookies: save them, then send them back
curl -c cookies.txt -i -X POST https://your-app.test/login -d "user=qa&pass=..."
curl -b cookies.txt -i https://your-app.test/account

jq is a small JSON command-line tool (jq .data.name, jq '.data | length') that pairs perfectly with cURL.

curl -i \
  -H "X-API-Key: sqa-key-12345" \
  "https://sqatools.in/wp-json/sqa-api/v1/apikey/profile"

Debugging with -v and -w

# Verbose: DNS, TLS handshake, every request and response header
curl -v "$BASE/health"
#  > GET /wp-json/sqa-api/v1/health HTTP/2       (lines with > are what you SENT)
#  < HTTP/2 200                                  (lines with < are what you RECEIVED)

# Print only the status code (perfect for scripts)
curl -s -o /dev/null -w "%{http_code}\n" "$BASE/users/999"      # 404

# Timing breakdown: where is the time spent?
curl -s -o /dev/null -w "dns=%{time_namelookup} connect=%{time_connect} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n" "$BASE/delay/2"

# Timeouts
curl -i --max-time 2 "$BASE/delay/5"          # curl gives up after 2 s (exit code 28)
curl -i --connect-timeout 5 "$BASE/health"

Redirects, Retries and Other Useful Flags

A 10-Line Smoke Test Script

#!/usr/bin/env bash
BASE=https://sqatools.in/wp-json/sqa-api/v1
fail=0
check() {   # usage: check EXPECTED METHOD PATH [extra curl args...]
  local expected=$1 method=$2 path=$3; shift 3
  local code=$(curl -s -o /dev/null -w "%{http_code}" -X "$method" "$BASE$path" "$@")
  if [ "$code" = "$expected" ]; then echo "PASS $method $path $code"; else echo "FAIL $method $path got $code expected $expected"; fail=1; fi
}
check 200 GET  /health
check 200 GET  /users/1
check 404 GET  /users/999
check 400 GET  "/users?per_page=51"
check 401 GET  /basic/profile
check 200 GET  /basic/profile -u sqa_user:sqa@123
check 405 POST /users
exit $fail

Run it after every deployment; a non-zero exit code fails the pipeline.

Converting cURL to Postman, Playwright and Back

• Browser → cURL: DevTools → Network → right-click request → Copy → Copy as cURL (bash). Remove cookies and tokens before sharing.
• cURL → Postman: Import → Raw text → paste.
• Postman → cURL: the </> Code button → cURL.
• cURL → Playwright: map flags to options:

// curl -i -X POST "$BASE/objects" -H "Content-Type: application/json" -d '{"name":"A","ttl":60}'
const res = await request.post(`${BASE}/objects`, { data: { name: 'A', ttl: 60 } });

// curl -u sqa_user:sqa@123 "$BASE/basic/profile"
await request.get(`${BASE}/basic/profile`, {
  headers: { Authorization: 'Basic ' + Buffer.from('sqa_user:sqa@123').toString('base64') },
});

// curl --max-time 2 "$BASE/delay/5"
await expect(request.get(`${BASE}/delay/5`, { timeout: 2000 })).rejects.toThrow();

// curl "$BASE/redirect"   (no -L)
await request.get(`${BASE}/redirect`, { maxRedirects: 0 });

Common cURL Mistakes

• Forgetting -i and missing the status code and headers.
• Unquoted URLs with &: the shell cuts the URL at the first &.
• Sending JSON without Content-Type: application/json (cURL’s -d defaults to form-encoded); the practice API answers 415.
• Using -X GET together with -d and expecting query parameters (use -G).
• Pasting real tokens and cookies into tickets or chat.
• Using -k in scripts that later run against production.

cURL Cheat Sheet

Interview Questions: cURL