Practical tutorials for getting real work done with mock APIs. Everything here works on the free tier, no signup required to start.
We check 52 well-known public mock, fake-data, request-bin and placeholder-image APIs with a plain GET every 30 minutes — exactly what a tutorial curl sees. Live state, 24h/7d OK-rates, and a free alternative for each.
POST a URL + a webhook and you're monitoring: checked every 30 minutes from the edge, one ping on down, one on recovery, debounced so blips never page you. Slack/Discord formats or HMAC-signed JSON your CI or agent can verify. The response even tells you if your site is up right now.
A dead man's switch for any scheduled job: one curl arms it, your job pings a secret URL every run, and if the pings stop your webhook gets one alert and one recovery. Status page + README badge + Atom feed included. healthchecks.io stays the dashboard default — this is for arming the switch from the terminal you're already in.
Their free plan is one snitch behind a signup; Slack integration starts at $19/mo. Here one curl arms the switch: your job pings a secret URL, and when the pings stop your webhook gets one alert (and one on recovery). Public status page + README badge included. Honest about where Field Agent's exit-status capture beats us.
Freshworks retired Freshping on March 6, 2026 — monitoring stopped, data deleted in June, freshping.io now redirects away. Rebuild the core loop in 60 seconds: one curl arms a URL monitor with webhook down/up alerts, a public status page and a README badge. Honest about what Freshping had that nothing free matches.
Uptime Kuma is the best self-hosted monitor there is (~90k stars) — if you have a spare server outside the stack it watches, plus Docker, a volume and update discipline. If you don't: one curl arms a monitor from Cloudflare's edge with webhook down/up alerts, a status page and a README badge. Nothing to install, no account.
StatusCake's free plan is real — 3 monitors, 15-minute checks — but email-only: webhooks, Slack and every other integration start at $24.49/month, and their PUSH heartbeat test type is paid too. If the alert you wanted is a webhook, one free curl arms it here: Slack/Discord/HMAC alerts, status page, README badge, Atom feed, plus free cron heartbeats.
Site24x7's free forever plan is real and genuinely fast — 1-minute checks, quicker than most rivals' paid tiers — but alerts are email: per their own plan table, webhook alerting sits on a paid tier from ~$36/month. If the alert you wanted is a webhook, one free curl arms it here: Slack/Discord/HMAC alerts, status page, README badge, Atom feed, plus free cron heartbeats.
Better Stack's free plan is arguably the most generous in the category — 10 monitors, 10 heartbeats, a status page and Slack + e-mail alerts at $0, with 3-minute checks. If a signup is fine, honestly, use them. If you want the check armed from a terminal, CI step or agent in ten seconds with no account, one free curl does it here: HMAC-signed webhook alerts, status page, README badge, Atom feed.
OnlineOrNot's free Hobby plan is one of the better ones — 3-minute checks and free Slack/Discord/Telegram alerts, which almost nobody else gives away. But raw webhooks are Pro-only from $15/month, and everything starts with a signup. If the alert you wanted is a webhook armed from a terminal, one free curl does it here: HMAC-signed alerts, status page, README badge, Atom feed, plus free cron heartbeats.
Hyperping's free plan is genuinely strong — 20 monitors, 5-minute checks from 18 regions, free Slack + Teams alerts, free cron healthchecks. But per their own FAQ the API is paid-plans-only, so nothing on the free plan can be armed from a terminal, CI step, Terraform or an MCP client. If that's your moment, one free curl does it here: HMAC-signed webhook alerts, status page, README badge, Atom feed.
Checkly's Hobby plan is arguably the best free tier in monitoring — 10 uptime monitors at 2-minute checks, 10k API + 1k Playwright check runs a month, free Slack + signed-webhook alerts, MCP + CLI + Terraform included. If an account and an API key are fine, honestly, use them. If the check must exist before any account does — armed from a terminal, CI step or agent — one free curl does it here: HMAC-signed webhook alerts, status page, README badge, Atom feed.
Pingdom is the category veteran and has no free tier at all: 30-day trial, then from $16.50/month. For "GET my URL, ping my webhook when it breaks," one free curl arms the check here — Slack/Discord/HMAC-signed alerts, public status page, README badge, Atom feed. Honest about where their transaction checks and RUM are worth the money.
UptimeRobot's free 50 monitors are genuinely generous — but webhook alerts sit on their Team plan and heartbeats are paid. Here both are one free curl: one webhook on down, one on recovery (Slack/Discord auto-detected, else HMAC-signed), status page + README badge + Atom feed per monitor, no account anywhere.
Cronitor's two jobs as two curls: a heartbeat for your cron job (silence triggers the alert) and a URL monitor checked from the edge every 30 minutes. Webhook on down, webhook on recovery, public status page + README badge on both. Cronitor stays a fine team dashboard — this is for arming a monitor this minute, no signup.
JSONPlaceholder, DummyJSON, FakeStoreAPI, reqres, randomuser, httpbin — what each does well, where each stops, and a live status badge for every one (we check them every 30 minutes). Plus how to get a fake API where writes actually persist.
Give your function-calling agent a live backend it can safely act on: writes persist (JSONPlaceholder fakes them — evals get false positives), snapshot restore resets every episode, the request inspector is ground truth for what the agent actually sent, and chaos injection trains retry logic. Free, no signup.
Point Claude Code, Cursor, or VS Code at one URL and your agent gets eighteen tools that create and drive live mock REST APIs: seeded projects, OpenAPI import, record CRUD, custom routes, snapshots. No signup, no OAuth — and the mock stays plain HTTP, so the code your agent writes ships with a working URL.
Export a HAR from the DevTools Network tab, POST it in one curl, and the JSON your app actually received becomes a hosted REST API: verbatim records, static-asset noise skipped, polling deduplicated, wrappers unwrapped — with CRUD, filters and failure drills on top. Free, no signup.
Your tests shouldn't hit api.stripe.com. Export a HAR from DevTools and replay the real responses as a hosted mock, or hand-build just the endpoints you use — then point your retry logic at simulated 429s, intermittent 503s, and slow responses. Free, no signup, no keys in CI.
echo.websocket.events is dead and tutorials still link it. Every Mockbird project has a wss:// endpoint: pure echo for the plumbing, and ?subscribe=products streams your own records as timed events — tickers, notification feeds, reconnect logic, JWT-protected sockets. Free, no signup.
Stripe, Slack and GitHub paginate with cursors; every free mock API only does ?page=2. Add ?mock_cursor=1 to any Mockbird list and get {data, next_cursor, has_more} — follow the token, stop on has_more:false, and drill the failure paths: garbage cursor → clean 400, page 3 dies → mock_chaos. Free, no signup.
Your backoff code is probably untested, because testing it means getting yourself actually throttled. ?mock_ratelimit=5 allows 5 requests per 60s from your IP, then genuine 429s with a live Retry-After and GitHub-style x-ratelimit-* headers your countdown UI can read cross-origin. Free, no signup.
Every free mock API accepts any payload, so the 422 path — field errors, red text under inputs — ships untested. Mockbird type-checks writes against your schema: ?mock_validate=1 → 422 {error, fields:{price:"expected number, got string"}}. Strict mode rejects unknown fields; set it project-wide with zero URL changes. Free, no signup.
A hosted OpenAI-compatible mock: chat completions (streaming SSE included), models, 1536-dim embeddings — deterministic replies your tests can assert on, plus injected 429/500s, latency and rate limits via query params. Point OPENAI_BASE_URL at it, zero code changes. Verified with the official openai SDK. Free, no signup.
New OWM keys 401 for up to 2 hours; workshops and CI can't wait. Get an OpenWeatherMap-shaped mock with the same /data/2.5/weather path and params — appid ignored, name echoes ?q=, deterministic temps your tests can assert on, plus on-demand 401/429/slow/chaos drills. Swap the host back when the key wakes up. Free, no signup.
The free stock APIs keep dying: IEX Cloud shut down, Yahoo's unofficial endpoint 429'd our first request of the day, and Alpha Vantage's free tier is 25 requests/day — one dashboard load (all verified Sep 2026). Mock the quotes while you build: your own ticker roster served verbatim via db.json import, top-movers sort, gainers ranges, a portfolio that persists writes, a polling ticker that moves, and deterministic 429/500/slow drills. Free, no signup, CORS open.
Every movie-app tutorial starts with "sign up for a TMDB API key" — and keyless requests to TMDB and OMDb both 401 (verified Sep 2026). Skip the key while you build: 25 seeded movies with genres/ratings/posters that render, search + genre filters + top-rated sort + pagination, a watchlist that actually persists (TMDB gates writes behind user auth), and on-demand 500/slow/retry drills. Free, no signup, CORS open.
Your news app works on localhost, then 426s the moment you deploy — NewsAPI's free tier blocks browser requests from every origin except localhost (plus 100 req/day, 24h article delay; paid starts $449/mo). Get a NewsAPI-shaped mock instead: same /v2/top-headlines and /v2/everything paths and JSON shape, apiKey ignored, CORS open to any origin, live publishedAt, on-demand 401/426/429/slow drills, editable article records. Free, no signup.
api.icndb.com — the fun first API in a decade of beginner tutorials — is gone, and its domain now 301s every request to a slot-machine spam page (verified Sep 2026; grep your old repos for icndb). Same graveyard: boredapi's DNS is gone, numbersapi 404s, jservice and forismatic time out. Who survived (api.chucknorris.io, opentdb, swapi.dev), plus the structural fix: one curl turns your own jokes into your own random-joke endpoint — ?sortBy=random&limit=1, full CRUD, CORS, no signup.
Quotable's TLS certificate expired in September 2024 and was never renewed — every fetch(), curl, and axios call behind the classic random-quote-generator tutorials now fails the handshake. One curl imports a 50-quote public-domain starter set in Quotable's field shape; ?sortBy=random&limit=1 is your /random endpoint. maxLength/tags/author filters translated, full CRUD, CORS, no key. Free, no signup.
Every restcountries.com /v1–/v4 URL now returns an error envelope with HTTP 200 — res.ok passes, data is null, apps break silently. The new v5 needs an API key (free tier 1,000 req/month). One curl imports a real 250-country dataset as your own API: no key, region/code/capital filters, full-text search, sort, CORS, GraphQL, full CRUD, db.json eject. Free, no signup.
worldtimeapi.org has shut down — the domain no longer responds at all, and every tutorial fetch() built on it dies with a network error. One curl hosts all 418 IANA zones as your own API: UTC offsets, DST offsets, abbreviations, countries; filter/search/sort, CORS, GraphQL, full CRUD, plus a {{now}} custom route for current UTC time. Free, no signup, no key.
fixer.io and exchangeratesapi.io reject keyless requests now — and for tests, live rates are a bug anyway: your expected values change daily. One curl hosts a 30-currency ECB reference-rate snapshot as your own API: no key, code/decimals filters, sort, CORS, GraphQL, full CRUD (pin JPY=150 and your fixtures freeze), 401/429/retry drills. Free, no signup.
SendGrid- and Mailgun-shaped endpoints with no signup: assert the exact payload your code sent via the request inspector, keep a queryable outbox (?to=&subject_like=, bounce simulation), drill 429 rate limits, deterministic retry sequences (429,429,202) and slow providers, and get HMAC-signed delivery webhooks. Free.
Point Octokit's baseUrl at GitHub-shaped endpoints: repo/issue routes with x-ratelimit headers, the exact 403 rate-limit refusal on cue, deterministic 403→200 retry sequences, and a live quota that runs out. Verified with a real 5-test Octokit suite — even Octokit's throttle plugin engages with the mock. No PAT, no signup.
Slack-shaped endpoints that speak the real dialect: HTTP-200 ok:false errors (the trap that fools status-code checks), 429 + Retry-After that triggers @slack/web-api's real rate-limit machinery, a challenge echo that passes Events API URL verification, and slash-command receivers. Verified with the official SDK. No tokens, no signup.
Mailtrap Sandbox is great at rendering and spam checks — but the free tier is 50 test emails a month. Most CI "email tests" only assert payloads and failure handling, and that needs an API-level mock, not SMTP capture: provider-shaped routes, 401/429/500 on cue, retry sequences, a queryable outbox. Free, no signup.
Provider-exact mock endpoints verified against the live Postmark and Resend APIs: their real success shapes ({"ErrorCode":0,…} / {"id":…}), the 422 ErrorCode and {statusCode,name,message} error dialects, Resend's 2 req/s rate limit reproduced on cue with real Retry-After headers, retry sequences, and a payload inspector. Free, no signup.
The official twilio-node SDK works against it natively (verified: one baseUrl line, real RestException with code 21211). Magic-input failures you define yourself, OTP payload assertions via inspector and a queryable outbox, the queued→sent→delivered callback drills Twilio test credentials can't do, 429 retry sequences. Free, no signup.
A hosted fake payment gateway, no account needed: persisted payments with real CRUD, card declines on demand (402 that creates nothing), exact retry choreography (503,503,201 — assert attempt counts, no phantom charges), slow-gateway and 3DS-limbo delays, HMAC-signed payment webhooks with a whsec_ secret. Free, no signup.
Add ?mock_sse=1 to any list endpoint and your records stream as Server-Sent Events — correctly framed, paced on a timer, closed with a done event. NDJSON too. Test onerror, reconnects, skeleton screens and fetch-stream readers. Free, hosted, no signup — nobody else has this.
Beeceptor's free plan: 50 requests/day, 3 mock rules, 10 stored CRUD objects, endpoints expire after 7–90 days. Mockbird: 10,000 requests/day, 20 custom routes, 1,000 records per resource, no expiry — free, no signup, one curl.
Written during a real picsum outage (Aug 30–31, 2026: 503s and timeouts on every URL pattern). Deterministic seeded placeholders and avatars from the same base URL as your mock API — plus honest pointers to the surviving photo hosts. Free, no signup.
adorable.io is dead (its domain now hosts a web-design agency) and old DiceBear URLs answer 410 Gone. Get deterministic initials avatars with ui-avatars.com-compatible params from the same base URL as your mock API — free, no signup.
GitHub-style 5×5 mirrored identicons and abstract geometric avatars via ?style=identicon — no signup, no email hashing (Gravatar wants md5), no versioned third-party paths. Deterministic per seed, pure SVG, composes with size/rounded/colors, same base URL as your mock API.
Unsplash deprecated Source in 2021 and shut it down — every URL shape answers HTTP 503 (verified September 2026), breaking React galleries and Tailwind templates everywhere. Where to point those URLs now: official API, Lorem Picsum, LoremFlickr for keywords, plus a deterministic placeholder with Source's exact WxH syntax. Free, no signup.
placekitten.com answers HTTP 521 on every path (verified September 2026) — a decade of tutorial image URLs is broken. Honest pointers to placecats.com and LoremFlickr for real cat photos, plus a deterministic same-path-shape placeholder that lives next to your mock API. Free, no signup.
Every lorempixel.com URL answers HTTP 429 "Site Unavailable" (verified September 2026) and placeimg.com no longer resolves — the Bootstrap-era category-photo placeholders are dead. Translation table for every URL shape: LoremFlickr and Picsum for real photos, deterministic same-path-shape SVG placeholders next to your mock API. Free, no signup.
via.placeholder.com, placehold.it, placekitten and placeimg are all dead (verified July 2026). Get deterministic SVG placeholders and initial-avatars from the same base URL as your mock API — seeded data ships with images that render. Free, no signup.
SVG placeholders don't render in email clients, og:image cards, React Native/Flutter image views, or Pillow/sharp pipelines. Get deterministic placeholder images and avatars as real PNG bytes at a URL — same params as the SVG output, byte-identical per URL, free.
Put ?title= in a URL, get a 1200×630 PNG social card — the format scrapers actually require. Themes, brand colors, identicon logo, deterministic bytes. No image editor, no deploy, no signup: the zero-setup og:image for dev sites and side projects.
Put ?data= in a URL, get a scannable QR code back — no key, no library, no signup. Sizes 64–2000, error-correction levels, custom colors, deterministic bytes. Works in an <img> tag, a curl loop, or a build pipeline.
Put ?data=3,7,4,9 in a URL, get a chart PNG or SVG back — line, bar, area, README sparklines. Labels, themes, transparent backgrounds, deterministic bytes. No chart library, no JSON config, no key, no watermark.
Get everything you love about json-server — filters, sorting, pagination, relations, nested routes — as a zero-install hosted URL you can share with teammates and deploy previews.
Build against a realistic users API before the backend exists: fetch, useEffect, pagination, search, and swapping to the real API later with one env variable.
App Router edition: async Server Components against a realistic users API, loading.tsx and error.tsx you can actually trigger with ?mock_delay / ?mock_status, Server Actions for writes — and an honest comparison with route-handler fixtures and MSW.
localhost isn't your laptop on a device: no 10.0.2.2 forks, LAN IPs or adb reverse — one hosted https URL for every emulator, simulator and phone. FlatList pagination, pull-to-refresh, flaky-network chaos on demand, and an honest comparison with json-server and msw/native.
Native Android (Kotlin + Retrofit): a hosted https mock kills the 10.0.2.2 alias, LAN-IP juggling and network_security_config cleartext exceptions in one move. Real X-Total-Count pagination, injected 5xx chaos vs your actual OkHttp retry interceptor, a real SocketTimeoutException, parallel JUnit tests pinned to frozen snapshots, and a mock JWT login for your auth screens. Honest comparison with MockWebServer, MockRetrofit and debug-flavor fakes. Every snippet was run before publishing.
localhost isn't your laptop on a device — and Flutter web adds CORS on top: one hosted https URL for the Android emulator, iOS simulator, real phones and the browser. ListView infinite scroll against real pagination, RefreshIndicator, chaos on demand, and an honest comparison with json-server and http_mock_adapter.
useAsyncData with real X-Total-Count pagination (including the $fetch.raw gotcha — useFetch won't give you response headers), an error.vue you can trigger with ?mock_status, skeletons you can actually see via ?mock_delay (including the useLazyFetch server:false gotcha that keeps SSR blocking), a one-line Nitro routeRules proxy, and writes that persist. Every snippet run in a real Nuxt 4 app before publishing.
Remix is React Router v7+ framework mode now — loaders and actions against a hosted mock with realistic seeded data, a 404 that actually 404s via thrown Responses, error boundaries you trigger with ?mock_status, the pending-UI-in-root gotcha we hit for real against ?mock_delay, a Form action whose writes persist, and loaders integration-tested with Vitest against snapshot-pinned data. Every snippet ran in a fresh React Router 8 project before publishing.
Build-time fetch in frontmatter with realistic seeded data, a static page per record via getStaticPaths (including the string-params gotcha that fails the build), real pagination with paginate(), a live-search client island, and on-demand rendering whose error state you trigger with ?mock_status — plus the missing-charset mojibake gotcha realistic data caught for us. Every snippet built and browser-checked in a real Astro 7 project before publishing.
createResource against realistic seeded data, reactive search via the source signal, Suspense and ErrorBoundary states you trigger with ?mock_delay and ?mock_status, a Retry button that actually retries (reset alone re-throws — we watched it), the .latest fix for the keystroke flash, and the falsy-source trap that silently never fetches. Every snippet driven in a real browser against a fresh Vite + Solid project before publishing.
One CDN script tag for Alpine, one hosted URL for the data. Fetch and render with x-data/x-init/x-for, a live search box in one x-effect (with x-model.debounce), a POST form whose writes really persist, pagination from a real X-Total-Count header, and loading/error states you trigger with ?mock_delay and ?mock_status. Includes the try/catch-in-x-init expression gotcha and its idiomatic fix. Every snippet run verbatim in a real Chrome before publishing.
htmx swaps HTML fragments, but every mock tool speaks JSON. Hosted custom routes that return templated HTML: hx-post forms rendered server-side ({{body.email}}), spinners against real ?mock_delay latency, error states via ?mock_status, active search, HX-Trigger server events — even hosting the whole htmx page as a shareable URL. Includes the htmx 2.0 selfRequestsOnly gotcha. Every snippet run in a real browser before publishing.
A universal load with real pagination (including the filterSerializedResponseHeaders gotcha that 500s everyone), an +error.svelte you can trigger with ?mock_status, streamed skeletons you can actually see via ?mock_delay, and form actions whose writes persist. Every snippet run in a real Svelte 5 app before publishing.
nock and undici's MockAgent can't exercise real AbortSignal timeouts, axios-retry backoff or 429 handling — a hosted URL can. Injected 5xx chaos vs axios-retry, node:test files pinned to frozen data snapshots, real X-Total-Count pagination, MSW handler-file eject, and an honest comparison with nock, axios-mock-adapter, undici MockAgent and MSW. Every snippet was run before publishing.
Verified on NestJS 12 + Node 22: nock 14 really does intercept both HttpService (axios) and global fetch — but undici@8's MockAgent silently misses both (dispatcher symbol mismatch: your tests hit the real network with disableNetConnect on), overrideProvider only rewires DI, and a running nest server ignores every test-process mock. RxJS retry() vs a deterministic mock_seq=503,503,200, real axios timeouts via mock_delay, stateful writes, honest comparison. Every snippet was run before publishing.
Guzzle's MockHandler and Laravel's Http::fake() are the right tools for unit tests — but an in-process fake can't exercise a real cURL timeout, real Guzzle retry middleware against injected 5xx chaos, or feed the same dataset to your frontend and CI. Laravel's built-in retry() vs mock_chaos, PHPUnit tests pinned to frozen data snapshots, real X-Total-Count pagination, writes that persist. Honest comparison with MockHandler, Http::fake and php-vcr. Every snippet was run before publishing.
Verified on Rails 8.1: WebMock stubs are frozen data with no state, nothing outside the test process (rails server, Sidekiq workers, the browser in a system test) ever sees them, and VCR can't record an API that doesn't exist yet. The hosted half: config.x per-environment wiring, minitest against a real URL with WebMock's tripwire kept via allow:, real 503s and Net::ReadTimeout, VCR cassettes recorded from the mock. Honest comparison with WebMock and VCR. Every snippet was run before publishing.
WebMock and VCR are the right tools for unit tests — but a patched client can't exercise a real Net::ReadTimeout, real faraday-retry backoff against injected 5xx chaos, or feed the same dataset to your frontend and CI. Parallel Minitest and RSpec examples pinned to frozen data snapshots, real X-Total-Count pagination, writes that persist. Honest comparison with WebMock, VCR and Faraday's test adapter. Every snippet was run before publishing.
WireMock.Net and MockHttpMessageHandler mean writing every stub by hand, and an in-process fake can't exercise a real HttpClient.Timeout or Polly backoff over the network — a hosted URL can. Injected 5xx chaos vs a real Polly v8 pipeline, parallel xUnit test classes pinned to frozen data snapshots, real X-Total-Count pagination, and a compiling NSwag client generated from the mock's own OpenAPI export. Honest comparison with WireMock.Net, MockHttpMessageHandler and Moq. Every snippet was run before publishing.
WireMock and MockWebServer mean writing every stub by hand, and an in-JVM fake can't exercise a real HttpTimeoutException or Resilience4j backoff over the network — a hosted URL can. Injected 5xx chaos vs real retries, concurrent JUnit 5 tests pinned to frozen data snapshots, real X-Total-Count pagination, and a compiling openapi-generator client (native HttpClient library) from the mock's own OpenAPI export. Honest comparison with WireMock, MockWebServer and Mockito. Every snippet was run before publishing.
Your base URL already lives in a property — so one line of application-test.properties points RestClient and @GetExchange interfaces at a hosted mock. Real @Retryable retries against injected 5xx chaos (listener-counted over the wire), typed HttpServerErrorException sad paths, a genuine read timeout, parallel suites pinned to frozen snapshots. Honest comparison with WireMock, MockRestServiceServer and @MockBean. Every snippet was run before publishing.
Bun's in-process mocks genuinely work — bun:test spyOn can stub fetch and MSW runs fine (we verified both) — but none of that helps when you need a URL: a backend that doesn't exist yet, retry/timeout code that deserves a server that actually 503s slowly, one dataset shared by your service, the frontend and CI. Bun runs TypeScript natively, so the mock's generated types.ts type-checks your client against the live schema with bunx tsc. Real p-retry vs injected 5xx chaos, real AbortSignal timeouts, bun test files pinned to frozen data snapshots. Every snippet was run verbatim before publishing.
vi.mock and MSW are great for unit tests — this is for the tests where you need a URL: error-state tests via ?mock_status, real AbortSignal timeouts, parallel test files pinned to frozen data snapshots (Vitest runs files in parallel by default — shared fixtures race), p-retry absorbing injected 5xx chaos, and Zod contract tests generated from the API's live schema. Works under jsdom too (verified). Every snippet was run verbatim (Vitest 4, Node 22) before publishing.
Verified on Storybook 10.5 + React 19: four stories (loaded / loading / error / empty) driven by one hosted endpoint and three query params — no MSW handlers, no mockServiceWorker.js, no addon config. ?mock_delay=3000 makes the skeleton state real and demo-able (3.28s measured), ?mock_status=500 exercises the actual error branch, a no-match filter renders empty, and ?mock_snapshot= pins a whole alternate dataset per story (empty / edge cases / bug repro) without touching live data. Honest comparison with msw-storybook-addon (v3, actively maintained — recommended where transparent interception, offline or zero latency matter) and the ?limit=0 trap that does NOT give you an empty list.
setRequestInterception is a powerful primitive with sharp edges: it disables the browser cache, demands a continue() on every request, and respond() bodies become a stateless second backend in your test files. Verified compositions instead: cross-host URL rewrites via request.continue({url}) with the page none the wiser, per-test mock_delay/mock_status flag injection for loading and error specs, deterministic fail-then-recover retries via mock_seq, and two pages reading different pinned snapshots of the same project in parallel — plus two reproduced gotchas (waitForFunction's raf polling stalls in backgrounded tabs; --no-sandbox in CI). Every snippet run verbatim (Puppeteer 25.9, Chrome 152, Node 22) before publishing.
Selenium's classic API has no request interception at all, and selenium-wire — the old community answer — was archived in January 2024. Verified alternatives: the zero-interception hosted-mock setup that works in every language binding and Selenium version, cross-host URL rewrites with the new BiDi driver.network API (request.set_url, no proxy), per-test mock_delay/mock_status injection, deterministic fail-then-recover retries via mock_seq, and two parallel drivers reading different pinned snapshots of the same project — exactly how pytest-xdist/Grid parallelism wants it. Plus four reproduced gotchas: * doesn't cross / in URL globs (use **), unscoped intercepts pause the navigation itself, execute_async_script deadlocks against BiDi handlers, and --no-sandbox in CI. Every snippet run verbatim (Selenium 4.48, Chrome 152) before publishing.
MSW + a per-test QueryClient with retry:false is the right default — but two measured defaults break naive tests: a fresh QueryClient() retries errors 3 times (4 attempts, 7.6s of backoff — why "isError never becomes true"), and a shared client bleeds cache between tests. Then the hosted half: retry logic you can watch recover against ?mock_seq=503,503,200 (exactly 3 attempts, verified), real loading states via ?mock_delay, useInfiniteQuery against genuine _page/_limit + X-Total-Count pagination, and useMutation + invalidateQueries round-trips against an actual store — plus a subprocess proof of where MSW's interception stops. Every snippet run verbatim (TanStack Query 5, React 19, Vitest 4, MSW 2) before publishing.
jest.mock and MSW are great for unit tests — this is for the tests where you need a URL. Starts with the classic ReferenceError: fetch is not defined (Jest's jsdom environment has no fetch; the node default does — verified, with the one-line polyfill fix), then: error-state tests via ?mock_status, real AbortSignal timeouts, Jest's parallel worker processes pinned to frozen data snapshots, a 12-line retry loop absorbing injected 5xx chaos (p-retry is ESM-only — plain CJS Jest can't require it), and Zod contract tests. Zero-config CommonJS, no Babel, no ts-jest. Every snippet was run verbatim (Jest 30, Node 22) before publishing.
CI needs a backend: service containers mean an image you maintain plus a health-check loop, npx json-server & needs background-process babysitting, staging is shared mutable state. Instead: create an ephemeral hosted mock at the top of the workflow, delete it in an always() step — one isolated seeded API per run, matrix legs included. Deterministic retry tests with mock_seq (429,429,200 — outputs shown are real), a nightly chaos job, the GitLab CI equivalent, and an honest table including where service containers and MSW win. Every shell command run verbatim against production before publishing.
Bruno keeps collections in git as plain files — this is the live backend to point it at. Generate a complete Bruno collection from a live OpenAPI spec with one bru import command (every request pre-documented, env pre-filled), or hand-write a .bru smoke suite that passes verbatim: create → setVar chain → read-back proof, a JWT auth flow via /auth/login + auth:bearer, forced 503s, res.responseTime assertions against real ?mock_delay latency, and CI wiring (bru run exits 1 on failed asserts — verified). All run with Bru CLI 4.0.0 against production.
The Hoppscotch web app's famous wall is CORS: no headers, Network Error, install an extension or route through a proxy. Every Mockbird endpoint sends open CORS headers, so the default Browser interceptor just works — paste a URL, Send, JSON. Then: import the whole API into Collections from one OpenAPI URL (verified: 5 collections / 24 requests / 44 examples), run stateful CRUD that persists, force 503s/latency/retry sequences from the pre-imported params table, and connect the GraphQL tab to a real introspectable schema. Plus an honest look at Hoppscotch's own v2025.10.0 mock servers — example replay vs a stateful backend — and how they compose. Every step performed in hoppscotch.io against production.
A real https URL for your game before the backend exists: fetch and parse with HTTPRequest + await, a working leaderboard (POST scores, GET a sorted top 10 with sortBy=score&order=desc) in ~20 lines of GDScript, a real HTTPRequest.RESULT_TIMEOUT via ?mock_delay, retry loops drilled against a deterministic 500→500→200 sequence, and web exports that work on itch.io because CORS is open — localhost isn't an option in the browser. Honest comparison with hardcoded JSON, local json-server and real game backends (SilentWolf, LootLocker, Nakama, PlayFab). Every snippet run verbatim in headless Godot 4.3.
Pinned data is n8n's editor-only answer — it skips the HTTP layer entirely, so Retry On Fail, timeouts, 429s, and error workflows ship unexercised. Point HTTP Request nodes at a stateful mock instead: verify retries with a deterministic 500→500→200 sequence (mock_seq), fire your Error Trigger workflow from one URL param, rehearse 429 handling against a simulated rate limit with real Retry-After headers, catch a workflow's exact outbound payload in a request bin, and test Webhook triggers with HMAC-signed deliveries aimed at the 120-second test URL. All curls verified against production.
Make's HTTP module doesn't even treat a 503 as an error unless you enable "Evaluate all states as errors" — so scenarios ship happily piping error bodies downstream, and error routes go untested. Point the module at a stateful mock instead: prove the errors-toggle difference with ?mock_status=503, verify the Break directive's parked-and-retried incomplete executions against a deterministic 500→500→200 sequence, fire timeout paths with a 2s module timeout vs ?mock_delay=3000, rehearse 429s with real Retry-After headers, catch a scenario's exact outbound payload in a request bin, and teach a Custom webhook a realistic HMAC-signed payload via Redetermine data structure. All curls verified against production.
Zapier's own webhook docs say to inspect payloads with RequestBin — which now 301s to a signup-walled Pipedream product. Point Webhooks by Zapier steps at a stateful mock instead: see the exact outbound payload in a request bin with a public inspector, fail a step on purpose with ?mock_status=500 to route your Error path, drill Autoreplay's up-to-5 retries against a deterministic 500→500→200 sequence, rehearse 429 bursts with real Retry-After headers, aim HMAC-signed deliveries at a Catch Hook trigger, and give the Retrieve Poll trigger a target where you control exactly when a new item appears. All curls verified against production.
test.k6.io, test-api.k6.io and the crocodiles API from a hundred k6 tutorials now 302-redirect to quickpizza.grafana.com — old scripts that only check status codes still "pass" while testing a pizza website. A stable target for the functional side of k6: a smoke test with thresholds that passes in 60 seconds, write-then-verify CRUD that tutorial APIs fake, an ephemeral seeded backend per run via setup()/teardown(), and resilience drills (forced 503s, ?mock_chaos retry loops, timeout budgets vs ?mock_delay) — plus an honest "do NOT load test us" section with a table of where to aim what, including self-hosted QuickPizza. Every script run with k6 v2.2.0 against production.
Every network call in an extension is a permissions decision — unless the server opts in with CORS. Because Access-Control-Allow-Origin: * is on every endpoint, MV3 service workers, popups AND content scripts fetch the mock with a completely empty permissions list — verified with a real unpacked extension in Chromium 131. Covers the Chrome 85 content-script CORS rules (with the official background-relay pattern), an inspector that shows your chrome-extension:// Origin arriving, error/latency/flakiness drills by URL, and a mock JWT login for extensions with accounts. Honest section on when you'll still need host_permissions for the real API.
Newman is still the least-ceremony way to run a Postman collection in a pipeline — the hard part is the URL it points at. Mockbird generates the collection FROM your mock, so `npx newman run <url>` passes with zero flags: 21-request CRUD cycle verified, writes that persist, pm.test smoke suite with a deterministic outage drill (?mock_seq=503,200 asserted via the x-mockbird-seq header), an ephemeral backend per CI run with JUnit output, and protected-mode JWT flows Newman handles by itself (generated Login test-script stores {{token}}). Every command run with Newman 6.2.2 against production.
Tavern's YAML tests are lovely — once there's a server to point them at. A complete suite that passes verbatim with zero setup (pip install tavern + one file), an ephemeral seeded project created and torn down by Tavern stages themselves, the strict-matching KeyMismatchError you will hit (two fixes: strict json:off, or ?select= so strict stays on), deterministic retry tests with max_retries + mock_seq including the mock_seq_reset trap that eats 500s forever, timeout budgets vs ?mock_delay, and 422 testing with ?mock_validate. Every YAML on the page was run with pytest against production — including the failure cases.
Karate's Gherkin-flavored feature files (one standalone jar, no Maven project) still need a server to hit. A complete feature that passes verbatim with zero setup, an ephemeral seeded project created and destroyed by the suite itself in one scenario, deterministic retry tests with retry-until + mock_seq (each attempt advances the sequence), timeout budgets with configure readTimeout vs ?mock_delay, and an honest hands-on look at karate mock: the pets.push-not-add TypeError, query params ignored until you code them, memory-only state, and the things it does well. Every feature file run with Karate 2.1.2 against production before publishing.
cy.intercept is genuinely excellent for stubbing the page under test — and it never sees cy.request() traffic, the very tool Cypress recommends for API tests, seeding, and login shortcuts (proved with a runnable test: real data back, handler fired 0 times). Verified patterns: cy.request CRUD specs against real persistent state, loading states from real ?mock_delay latency, the full error matrix by URL, per-spec data scenarios pinned with one header, and how to compose both tools — stub the exception, host the rule. Every snippet was run verbatim (Cypress 15, Node 22) before publishing.
page.route is genuinely excellent — and it has blind spots: SSR/loader fetches it can never see (proved with a runnable test), parallel workers that need different data states, and backends that don't exist yet. Verified patterns: request-fixture API specs, cross-host route rewrites, the route.fallback composition gotcha that makes error-state tests pass for the wrong reason, and workers pinned to isolated data snapshots via one header. Every snippet was run verbatim (Playwright 1.49) before publishing.
Deno's fetch-mocking story is thin: stub() means writing every response by hand, and mock_fetch on deno.land/x no longer even loads. A hosted URL fixes that — and Deno can import your API's TypeScript types straight off the mock's URL, so deno check enforces the live schema with zero codegen. Real @std/async retry() vs injected 5xx chaos, real AbortSignal timeouts, Deno.test files pinned to frozen data snapshots, scoped --allow-net permissions. Every snippet was run verbatim before publishing.
Ktor's MockEngine is the best in-process mock in the Kotlin ecosystem — but it only exists inside your Kotlin process, so curl, the iOS half of your KMP app, teammates and CI get nothing, and every handler is code you maintain. A hosted https URL feeds every target the same dataset: HttpClient + kotlinx-serialization snippets, the real HttpRequestRetry plugin exercised against injected 5xx chaos, a real HttpRequestTimeoutException vs ?mock_delay, parallel JUnit tests pinned to frozen snapshots, and the Auth plugin wired to a mock JWT login. Every snippet was compiled and run before publishing.
URLProtocol stubbing (Mocker, OHHTTPStubs) is elegant, but the stub only exists inside one process — it can't feed the simulator, a device, SwiftUI previews, teammates and CI the same dataset. A hosted URL can, with zero dependencies: plain URLSession + Codable snippets, a real URLError.timedOut against ?mock_delay, retry/backoff exercised vs injected 5xx chaos, parallel Swift Testing @Tests pinned to frozen data snapshots, and a typed client from Apple's swift-openapi-generator fed by the mock's own OpenAPI export. Every snippet was compiled and run before publishing.
wiremock, httpmock and mockito mean writing every stub by hand, and a loopback mock can't feed the same dataset to your frontend, teammates and CI — a hosted URL can. Injected 5xx chaos vs a real reqwest-retry backoff, a real reqwest timeout with err.is_timeout() true, parallel tokio tests pinned to frozen data snapshots, real X-Total-Count pagination, and a compiling openapi-generator client crate from the mock's own OpenAPI export. Honest comparison with wiremock-rs, httpmock and mockito. Every snippet was compiled and run before publishing.
Bypass, Mox and ExVCR mean writing every stub by hand, and an in-node fake can't exercise Req's built-in retry: :transient or a real receive_timeout over the network — a hosted URL can. Injected 5xx chaos vs Req's own retry machinery, async ExUnit modules pinned to frozen data snapshots, a Stream.resource pagination helper driven by real X-Total-Count headers, and a compiling openapi-generator Elixir client from the mock's own OpenAPI export. Honest comparison with Bypass, Mox and ExVCR. Every snippet was run before publishing.
httptest means writing every handler by hand, and interceptors can't exercise real http.Client timeouts or retry backoff — a hosted URL can. Injected 5xx chaos vs go-retryablehttp, parallel go test files pinned to frozen data snapshots, real X-Total-Count pagination, and a compiling oapi-codegen client generated from the mock's own OpenAPI export. Honest comparison with httptest, gock, go-vcr and httpmock. Every snippet was run before publishing.
In-process stubs can't exercise real timeouts, retry adapters or 429 backoff — a hosted URL can. Injected 5xx chaos vs urllib3.Retry, pytest fixtures pinned to frozen data snapshots, real X-Total-Count pagination, and an honest comparison with responses, VCR.py and pytest-httpserver. Every snippet was run before publishing.
An HttpClient service against a realistic users API: generated TypeScript interfaces, pagination via X-Total-Count, signals, error states — and an honest comparison with angular-in-memory-web-api.
A reusable Vue 3 composable against a realistic users API: watchEffect with abort-on-cleanup, pagination, search, and swapping to the real API later with one env variable.
Skeleton screens, race conditions, error boundaries, 401 redirects, retry logic — exercised for real with ?mock_delay and ?mock_status, right from the address bar or your E2E suite.
Every project is a hosted GraphQL endpoint too: typed schema from your resources, relations, filters, mutations, full introspection, and a built-in GraphiQL IDE. Same data as REST.
Any email + password returns a real signed JWT that verifies and expires. Test login forms, 401 interceptors, token expiry, and protected-mode 401s — wired to your mock users data.
One click gives you products, customers, orders and reviews — linked with real foreign keys, joinable with ?_expand and ?_embed. Perfect for portfolio projects and UI demos.
Fire real HMAC-SHA256-signed created/updated/deleted events at your endpoint on demand, verify signatures in Node or Python, and debug deliveries with the built-in log.
Post your OpenAPI/Swagger spec (JSON or YAML), get a hosted, stateful mock with schema-aware fake data — enums kept, $refs resolved. Prism without the Node CLI.
Reset your mock API to a known state between tests with named data snapshots — one HTTP call restores every record, exactly. Baseline, empty-state, and bug-repro fixtures without truncate scripts or containers.
Define your own endpoints (any method, any path) with responses that echo query, params, headers and body. 10,000 requests/day free — a Beeceptor alternative without the 50/day cap. Try it with one curl.
Catch any HTTP request with a catch-all /* route, inspect headers (signatures included) and bodies live, and reply with any status or a templated body. 10,000 requests/day free, no 7-day URL expiry.
requestb.in now redirects to Pipedream, where creating a bin requires an account. Get the original workflow back: one curl → a URL that logs every method, header, signature and body. 10,000 requests/day free, bins don't expire.
QuickMocker's website is gone — the domain no longer resolves, last archived Dec 2024. Rebuild its custom endpoints here: your path, URL params, templated JSON body, any status/headers, ANY method, live request inspector, OpenAPI import — no signup, 10,000 requests/day free.
GoRest (gorest.co.in) requires sign-in + a Bearer token for every write (anonymous POST → 401 Authentication failed), wipes all created records every 24 hours, locks you to its four fixed resources, and sunsets v1 in June 2027. Same users/posts/nested-routes job here, free: tokenless writes that persist, your own schema, 10,000 requests/day — with optional mock JWT auth when you want to test the 401 path on purpose.
restful-api.dev deserves credit: its writes genuinely persist, which almost no free fake API does. But anonymous access is now capped at 50 requests/24h per IP (Sep 2026), created objects never appear in GET /objects (the list is frozen at 13 seed phones — the create-then-render-the-list loop can't be built), seed ids reject updates/deletes as reserved, and ?limit/?page are silently ignored keyless. Same {id,name,data} job here: your creates show up in your list, every record editable, real filters/pagination/sort, your own schema, no signup.
CrudCrud endpoints get 100 requests total (reads count) and expire after 24 hours — then every request answers HTTP 400. Same instant-CRUD job here, free: persistent writes, real filtering/pagination/sorting, PATCH, seeded fake data, 10,000 requests/day, no expiry. One jq pipe migrates your data.
Kong's mockbin.org no longer resolves — the code became Insomnia's mock backend. Zuplo's mockbin.io successor is good but sharp-edged: bins are immutable and undeletable, and anyone with the bin URL can read your full request log, caller IPs included. Rebuild the same bins here: editable routes, any status/headers/body, delays, templating — with a private, IP-free request inspector.
my-json-server.typicode.com serves a db.json from a public GitHub repo — but every write is faked (POST 201, then the new id 404s), edits need a commit+push and cache for a minute, everything is public, and it's been "beta, may be down" since 2017. Pipe the same db.json here once: same json-server params, writes that actually save, no repo needed.
httpstat.us is unreachable again (empty reply on HTTP and HTTPS as of Aug 2026, with "is it down?" issues back to 2020). Same status-by-URL job at /m/httpbin/status/503, plus what it never had: deterministic fail-then-recover sequences (?mock_seq=503,503,200), rate-limit simulation, and error statuses on your own data endpoints.
httpbin.org is chronically overloaded. Echo any request, force any status with ?mock_status=, add delays, mint UUIDs with template routes, and inspect request headers — 10,000 requests/day free, try it on the demo with one curl.
SOAP still runs banks, insurers and carriers, but every mocking tool for it is desktop or self-host. Get a hosted SOAP endpoint in two curls: your exact envelope with templated timestamps, real <soap:Fault> on HTTP 500, delays for timeout testing, and an inspector that captures SOAPAction + the XML body. No signup.
fakerapi.it is down (502 on root, v1 and v2, verified Aug 29 2026) and its source repo has been dormant since Feb 2023. Rebuild the same fake-data job with persistence: typed generator fields, ?limit for _quantity, an envelope template that reproduces FakerAPI's exact response shape — plus single-record GETs, filters and real writes it never had. Free, no signup.
randomuser.me generates strangers; it can't add, edit, delete, filter or serve "user 5". Get a persistent user roster with realistic names, self-hosted avatars, full CRUD, search, a working login endpoint (real JWTs) and GraphQL — free, no signup.
myjson.com is dead and jsonbin/npoint want accounts and keys. POST a JSON array and your records become a live queryable REST collection: filters, pagination, search, per-record CRUD, GraphQL — not just a hosted blob. Eject to db.json anytime.
json-generator.com's JS templates write beautiful fake JSON (keep using them) — but the output is a document: no filters, no record 5, writes go nowhere, and the API needs an account + token. Paste the array here and it becomes a live REST API: CRUD that persists, search, GraphQL, CSV out. Free, no signup.
Mockaroo generates brilliant files (keep using it for that) — but nothing persists, and its API is 200 requests/day with a key. One curl turns your Mockaroo CSV into a live API: CRUD that sticks, filters, pagination, GraphQL, CSV back out. Free, no signup, 10,000 requests/day.
POST a CSV/TSV and every row becomes a typed record behind a live API: filters, pagination, search, CRUD, GraphQL, TypeScript types. A developer-friendly SheetDB / Sheety / sheet2api alternative — 10,000 requests/day free vs their few hundred per month.
pact-stub-server replays your Pact files faithfully: exact-match 404s with empty bodies, verbatim query matching, writes that persist nothing, zero failure-simulation flags. One jq line turns a pact's response bodies into a hosted, stateful mock API. Every claim verified on v0.7.1.
Apiary was retired on Sep 9, 2025: mock URLs 404, docs subdomains 502 — while the homepage still says "Sign up free". Convert your API Blueprint with apib2swagger and import it here for a hosted, stateful mock in two commands. Every claim verified by hand.
SwaggerHub (now Swagger Studio) is the place to design a spec — but virtserver 429s at 10 requests/minute, returns the first example forever, and forgets every POST. One curl pipes the same spec into a hosted mock with real persistence, failure injection and no per-minute cap. Free, no signup.
Mockable's domain registration lapsed in August 2026 — *.mockable.io hostnames no longer resolve at all. Recreate the same REST and SOAP/XML mocks (custom status, headers, content-type, delay) in one curl, no login — plus a request logger and full CRUD Mockable never had.
The toilets are gone: ptsv2.com stopped responding in 2023 and today TLS fails outright, so every /t/…/post URL in old scripts 404s. One curl gets the same workflow back — a catch-all URL that logs method, headers and body, and replies with the status, body and delay you configure. Old ptsv2 paths work verbatim.
jsonbin.io is a solid JSON store with genuinely fair one-time pricing — credit where due. But the free plan's 10,000 requests are credited once, ever (a widget polling every minute burns them in ~7 days), everything needs a signup + API key, and a bin is one opaque blob: no filters, no pagination, no per-record CRUD. Pipe your bin here in one curl: a real queryable REST API, 10,000 requests per day, no account.
npoint.io is a lovely free, open-source JSON store, and its schema locking is a genuinely unique idea — credit where due. But it's a one-way street: API writes are private-beta (owned bins answer 401), unclaimed bins can be overwritten by anyone with the URL, and a bin is one blob with no filters or per-record CRUD. Pipe your bin here in one curl: full CRUD, filters, pagination, search — 10,000 requests per day, no account.
jsonbox.io shut down in 2021, the promised open-source repo has since vanished from GitHub, and the domain now serves an unrelated blog — old tutorial curls get HTML 404s. Store, read and modify arbitrary JSON over HTTP here: no signup, filter operators, sorting, pagination, and a db.json export so your data can always leave.
Mocky is gone: every run.mocky.io URL now 404s behind a broken certificate. Design any static response (body, status, headers, content-type, delay) and get a permanent URL in one curl — plus templating and full CRUD mocky never had.
Reqres keeps changing: an API-key wall in mid-2026, then reversed — now with injected _meta upsell objects in every response and 429s for CI IPs. Get the same paginated users + login/register endpoints stable and free — real signed tokens, configurable expiry, registered users that actually persist.
Love JSONPlaceholder but need your own resources, realistic data, or a POST that actually sticks? Same conventions (_page, nested routes, _expand), your schema, plus GraphQL and mock auth. Free, no signup.
DummyJSON's data is rich but fixed, and writes are simulated. Same sortBy/order params, search, delay/error simulation, and JWT auth — on your resources, with POST/PUT/DELETE that actually stick. Free, no signup.
DummyAPI's dataset is rich and its writes are real — but every request needs a signed-up app-id header (keyless curls answer APP_ID_MISSING) and the free tier is 500 requests/day. Rebuild the users/posts/comments shape in three keyless curls, 10,000 requests/day.
Platzi's fake store (api.escuelajs.co) is real CRUD — into one database shared by the whole internet: strangers rename or delete your tutorial's products, the dataset resets without warning, and PUT 500s unless you resend images. Same shape in two curls, isolated and persistent.
FakeStoreAPI's POST returns an id that fetches back as an empty 200, and filters are silently ignored. Get a store (or any schema) where creates, updates, deletes, filters, and register all really work. Free, no signup.
The .http file is the lightest API client there is — plain text, lives in your repo, diffs in PRs. Mockbird generates one from your live mock schema: full CRUD with example bodies, filter cheatsheet, failure simulation, auth chain pre-wired. VS Code, JetBrains IDEs, Thunder Client, httpYac. Free, no signup.
Postman's free mock servers cap at 1,000 calls/month and replay static examples. Get a stateful mock API free — then import it back into Postman as a ready-made collection with one link (/postman.json).
MSW only exists inside your JavaScript process: curl, Postman, mobile apps, backends, and teammates can't hit it. Get a hosted, stateful mock API on a real URL — no handler code, no signup. Honest notes on where MSW still wins (spoiler: JS unit tests — keep it there).
Half of nock's weekly installs are still v13 — where native fetch sails straight past the mock (upgrading to v14+ fixes that, and we say so). But when the mock needs to be a URL that curl, the browser, teammates, mobile and CI can hit: hosted stateful CRUD, seeded data, error/delay injection. Honest notes on where nock still wins (nock.back record/replay is unique).
Polly's record→replay loop still works — we ran it, tampered with the HAR, and got the tampered bytes back offline. But no core release since July 2023, ~60 open issues, and Node's built-in fetch silently escapes adapter-node-http: in one process, https.get got our recording while fetch hit the live network (proved). Recordings aren't portable between adapters either — the cross-adapter replay crashed. The eject hatch: Polly recordings are standard HAR — one curl imports one as a hosted, stateful mock. Plus Mockbird's own URL-level record & replay (proxyBase + proxyRecord) with failure drills on recorded routes.
VCR (Ruby) and vcrpy (Python) are healthy, maintained libraries — this is not a "project is dead" page. The pain is structural, and we reproduced it: cassettes record your Authorization headers verbatim by default (both libraries — we show the YAML), the replay only exists inside one process (a subprocess curl inside the active cassette context hit the live network), stale cassettes replay yesterday's API forever, and a merely different query string throws CannotOverwriteExistingCassetteException. The hosted answer: proxy record & replay at the URL level, HAR import for browser-session recordings, snapshots for cassette-per-scenario fixtures — plus failure drills (?mock_status/?mock_chaos) on recorded routes, which verbatim replay can't do.
The v10 rewrite removed fetchMock.mock() — the API a decade of tutorials use — and the ecosystem split: 37% of its 1.2M weekly installs still pin v9 from 2020 (npm, Aug 2026). And in any version the stub only exists inside your JS process — a child process fetching the identical URL hit the real network (we proved it). When the mock needs to be a URL: hosted stateful CRUD, seeded data, error/delay injection. Honest notes on where fetch-mock still wins (its {delay} makes real time pass — credit given).
The adapter only mocks the axios instance you wrap — fetch, SDK-internal instances, curl and teammates go to the real network, and unmatched requests get a mystery 404 by default (all verified, snippets run). Last release: Oct 2024. When the mock needs to be a URL: hosted stateful CRUD, seeded data, error/delay injection. Honest notes on where the adapter still wins.
Verified on Laravel 13: Http::fake() silently lets unmatched requests hit the real network by default, direct Guzzle and curl bypass it entirely, and it never crosses process boundaries — so Dusk browser tests, queue workers and frontend fetches get nothing. Wire a hosted mock via config/services.php: Http::retry() vs real injected chaos, real timeouts, persistent writes. Every snippet was run.
Verified on Django 6: the responses library only patches requests — httpx and urllib hit the real network mid-test; mock.patch("requests.get") misses `from requests import get`; and no in-process mock reaches runserver, celery or Playwright. Wire a hosted mock via settings: real timeouts, urllib3 Retry vs injected chaos, persistent writes. Every snippet was run (14-test suite).
Verified on FastAPI 0.141: respx only patches httpx — requests and urllib hit the real network mid-test; TestClient alone mocks nothing external; dependency_overrides is in-process only; and a uvicorn server ignores every test-process mock. Wire a hosted mock via settings — or import your app's own /openapi.json. Real timeouts, retries vs injected chaos, persistent writes. Every snippet was run (12-test suite).
Verified on Flask 3.1: responses and requests-mock only patch the requests library — urllib hits the real network mid-test; test_client alone mocks nothing external; and a running flask server ignores every test-process mock. Wire a hosted mock via config: real timeouts, urllib3 Retry vs a deterministic ?mock_seq failure sequence, persistent writes. Every snippet was run (10-test suite).
Verified on Express 5 + Node 22: supertest mocks nothing outbound — the route under test fetched real network data mid-test; nock 14 does intercept native fetch, but disableNetConnect() blocks supertest's own socket until you allow 127.0.0.1; and a spawned server ignores every test-process interceptor. Wire a hosted mock via env var: real timeouts vs AbortSignal, retry recovery vs ?mock_seq, persistent writes. Every snippet was run (10-test suite).
Mirage pioneered "build the frontend before the backend" — but the last miragejs npm release was October 2023, ember-cli-mirage breaks under Vite, and the mock only exists inside your JS bundle. Get a stateful mock API on a real URL: seeded data, relations, error injection — no server file to maintain, no signup.
Stoplight is being folded into SmartBear API Hub, and every "alternatives" listicle only covers the docs side. If what you'll miss is the stoplight.io/mocks URL: import the same OpenAPI document here → hosted, stateful CRUD mock, free, no signup — plus honest pointers (Scalar, Redocly, API Hub) for the docs slice we don't do.
Stoplight Prism replays your spec's examples on localhost — POSTs don't persist (data persistence is still on their roadmap), and a hosted URL means the Stoplight platform. Import the same OpenAPI document here → hosted, stateful, seeded CRUD mock. Free, no signup. Keep Prism for contract testing — they compose.
The Local Emulator Suite is the right tool for testing real Firebase apps — but as a quick prototype backend it's a 385MB toolchain that now requires JDK 21+, speaks typed-value JSON instead of plain JSON, ignores query params (filtering means a structuredQuery POST), and wipes all data on restart. If the job was never really Firebase, a hosted plain-JSON CRUD mock is one curl. Every claim verified on firebase-tools v15.28.1.
Insomnia (Kong) is a superb API client, and its two-click capture-a-response-into-a-mock flow is genuinely nice — but the cloud mocks are canned example responses, the free plan caps mock traffic at 1,000 requests per month (then $10/25k), and even trying them requires an account. Hosted, stateful CRUD mock in one curl instead — then import its live openapi.json back into Insomnia. Facts from Kong's official docs & pricing, Aug 2026.
Hoverfly's capture/replay proxy is superb for virtualizing real services — but as a dev sandbox every response is an authored recording: writes are theater, query params are ignored, and a missed match is a 502 Bad Gateway. Hoverfly Cloud has no free tier ($10/mo+; latency & random failures gated to $30/mo). Hosted, stateful CRUD mock in one curl instead. Every claim verified on v1.12.12.
MockServer 7 may be the most capable OSS mock toolkit going — and its new CRUD data store is real. But the store is in-memory (a restart loses the registration and every record), list endpoints ignore every query param, and there's no hosted option: sharing the mock means operating a server. Hosted, persistent CRUD mock in one curl instead. Every claim verified on v7.6.0.
Postman Echo is a solid free echo service — but it sends no CORS headers, so fetch() from any web page fails outright; paths are method-locked with no catch-all, every response sets three session cookies, and your own shapes are a separate product capped at 1,000 free calls/month. CORS-open httpbin-compatible surface + hosted stateful mocks instead. Every claim verified with curl and a real browser.
Karate's feature-file mocks are a great companion to Karate tests — state and delays genuinely work — but every data behavior is JS you author scenario by scenario: query params are silently ignored unless you code them, a missing id inside a matched scenario returns 200-empty, a restart wipes everything, and the mock is a local JVM process. Hosted, persistent CRUD mock in one curl instead. Every claim verified on v2.1.2.
Microcks is the CNCF-grade mocking platform: multi-protocol, contract testing, Testcontainers — genuinely excellent, and self-hosted infrastructure you deploy and operate. When the job is "mock URL in 60 seconds," Mockbird imports the same OpenAPI spec (zero examples needed), seeds realistic data, and gives you stateful CRUD on a hosted URL. Honest comparison inside.
stubby4j's GitHub repo was archived June 28, 2025 (read-only; last release Feb 2024) — and even at its best, every response was a YAML stub you hand-maintain: writes are theater, query params match only exact stubbed values, and the mock is a local JVM process. Hosted, stateful CRUD mock in one curl instead. Every claim verified on 7.6.1.
mountebank is the multi-protocol service-virtualization king, but for plain HTTP/JSON mocking every response is a stub you hand-maintain: writes are theater, unstubbed paths return 200-empty, query params are ignored — and 89% of npm installs still land on the package frozen since 2023. Hosted, stateful CRUD mock in one curl instead. Every claim verified on v2.9.4.
graphql-faker's latest npm release (2.0.0, Aug 2023) ships zero JavaScript — the install produces no executable — and even working versions randomize every response, ignore arguments, and fake mutations. Hosted GraphQL + REST over the same persistent data: deterministic reads, mutations that write, missing ids → null. Every claim verified Aug 2026.
addMocksToSchema (1.36M downloads/week) is the right tool for schema-first JS unit tests — but the mock only exists inside your JS process: curl, mobile apps, teammates, and CI against deployed previews get nothing. Defaults are "Hello World" strings, negative prices, lists of 2; mutations ignore your arguments; state is DIY resolver wiring. Hosted GraphQL + REST with realistic data and mutations that persist. Verified on v9.1.13.
json-graphql-server is genuinely good and actively maintained — but the store is process memory (restart wipes your mutations), it binds to localhost, and every non-GraphQL path returns GraphiQL HTML with HTTP 200. Import the same db.json here: hosted GraphQL + REST over one persistent store, snake_case FK joins intact, plus delay/chaos/error-sequence simulation. Verified on v3.3.1.
Mockoon's desktop app is excellent — on localhost. Sharing the mock means Mockoon Cloud (from $100/month, no free tier) or self-hosting the CLI. Get a hosted, stateful, seeded mock REST API in one curl — free, no signup, 10k requests/day. Import your Mockoon environment via OpenAPI export.
WireMock Cloud's free tier: 1,000 calls/month, 3 mock APIs, 10 req/s — with stateful mocking, chaos testing, mock auth, and even stub export locked behind Enterprise. Get all of that free with 10,000 requests/day. (WireMock OSS in Java tests? Keep it — honest notes inside.)
mockapi.io's free plan stops at 1 project, 4 resources, 100 records, behind a GitHub/Google OAuth wall. Same query params (page, limit, sortBy, order, search) with 5× the room — plus error simulation, request inspector, GraphQL, and exports it doesn't have at any price.
mockapi.io vs Beeceptor vs JSONPlaceholder vs json-server vs Mockbird — an honest look at free-tier limits, persistence, CRUD, request inspection, and when each is the right pick.
⚡ Create a live mock API in one click — seeded data, real URL, no signup, no terminal.