Request execution

Cloud Runner sends the target request from the REST Test backend. Browser CORS rules do not apply to this server-to-server hop, although the target may still reject authentication, networking or request details.

Network & Access is available for active URL sources. In API source settings, configure None, API Key in Header, Bearer Token or Basic Authentication for the OpenAPI document. Stored credentials are encrypted server-side, never returned to your browser and never applied to API requests. Save, replace and clear are explicit operations.

Fetch from my browser performs a manual update through your network or VPN with temporary credentials you enter for that operation. Saved cloud secrets and browser cookies are never used. CORS, TLS, mixed-content and local-network restrictions still apply; redirects are rejected. The backend validates the response and stages the existing diff/conflict review before you apply changes. Upload a file or connect GitHub if browser access is blocked.

Scheduled URL refresh runs in Rest Test Cloud with saved source authentication. Browser-only access cannot run unattended checks. Switching to Browser-only asks you to confirm disabling an existing schedule; a newly configured cloud path must pass Test Connection before a schedule can be enabled.

Open Workspace Settings → Network & Access to see API Source connectivity, choose the workspace default request runner and test a saved OpenAPI URL. Individual requests can override the runner in Request Builder. Changing the runner does not change source synchronization.

Rest Test Cloud does not currently provide a guaranteed static or dedicated outbound IP. Public URL import, manual refresh and scheduled refresh work through the existing cloud infrastructure without a static IP requirement. IP-restricted or private VPN endpoints may be unreachable. HTTP 403 can indicate credentials or network policy; it does not prove an IP allowlist failure.

Test Connection makes a bounded GET to the saved URL through the same safe cloud transport as import and refresh. It reports network connectivity separately from API definition validity, with a timestamp. This result is a point-in-time test, not monitoring.

URL automatic synchronization runs in the cloud without an active browser. Browser Runner uses your computer's network or VPN, subject to CORS, TLS and browser security restrictions, and cannot run scheduled synchronization. For a private OpenAPI URL, import a file, connect GitHub or use a manual definition. GitHub sync does not need access to the running API. Private Agent is not available in this MVP.

Browser Runner sends directly from the current browser. The target API controls whether the origin, method and headers are allowed through CORS.

Access-Control-Allow-Origin: https://your-app.example
Access-Control-Allow-Methods: GET, POST

Treat authorization headers and request bodies as sensitive. Use only endpoints and credentials you are authorized to test, and avoid placing secrets in documentation examples.