OpenAPI to Client Snippets
Pick any operation in your OpenAPI spec and get a ready request snippet — fetch, axios, curl or Python requests — parameters and auth placeholders included.
Paste a spec, pick an operation, copy the request.
This page turns one OpenAPI operation at a time into a request snippet for fetch, axios, curl or Python requests — request snippets per operation, not a full SDK. Auth rides as placeholders you replace in your own environment.Angle-bracket tokens are placeholders — swap them for real values where the code runs. This page has no field for a real token, so a secret can never enter it.
This page writes code; it never sends the request. Snippets per operation, not a full SDK — for typed clients, use a generator like openapi-generator.
The engine reported nothing about this snippet.
A link carries the language and options only — the spec itself never rides a link.
Do it offline:$ curl -X GET 'https://api.example.com/v1/pets?limit=10' -H 'Authorization: Bearer <YOUR_TOKEN>'
How to use it
- Paste your spec — JSON or YAML — or load the example. Documents up to 5 MB parse on this device; anything larger is refused with the exact limit named.
- Pick an operation in the list. Filter by method, path or operationId; a spec beyond 2,000 operations paginates, and emission for any one operation is unaffected.
- Switch the language tabs and toggle optional query parameters if you want them. Your spec text never changes when you switch.
- Copy or download the snippet, then swap the angle-bracket placeholders for real values where the code runs. No field here accepts a real token, by design.
Paste an OpenAPI 3.x or Swagger 2.0 spec, pick one operation, and copy a request snippet for fetch, axios, curl or Python requests — request snippets per operation, not a full SDK. Required parameters fill in from the spec's own examples, auth arrives as angle-bracket placeholders, and the base URL comes from the spec's first server or your override. Everything parses on this device, and the page calls no server.
Examples
GET /pets · required query + bearer → fetchconst response = await fetch("https://api.petshelter.example/v1/pets?limit=10", {
method: "GET",
headers: {
"Accept": "application/json",
"Authorization": "Bearer <YOUR_TOKEN>",
},
});
console.log(response.status);
console.log(await response.text());The required limit parameter rides the URL with its declared example; optional species stays out until you toggle it on. Accept comes from the 200 response and the bearer scheme becomes a placeholder header.
POST /pets · JSON body → curlcurl -X POST \
https://api.petshelter.example/v1/pets \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <YOUR_TOKEN>' \
--data-raw '{"name":"","species":"dog"}'The body is a minimal skeleton from NewPet's required list — name as an empty string, species as its first enum value — and every argument is quoted for sh, bash and zsh before it is printed.
GET /pets/{petId}/photos · apiKey in query → Python requestsimport requests
params = {
"api_key": "<YOUR_API_KEY>",
}
headers = {
"Accept": "application/json",
}
response = requests.get(
"https://api.petshelter.example/v1/pets/p-102/photos",
params=params,
headers=headers,
)
print(response.status_code)
print(response.text)The api_key scheme lands in the params dict as a placeholder, so requests URL-encodes whatever you put there; the path parameter takes the example the spec declares.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
Why there is no token field
Every credential in a snippet is a named placeholder — <YOUR_TOKEN> for bearer and OAuth results, <YOUR_API_KEY> for API keys, <USER> and <PASS> for basic auth. A box that accepted a real secret would put it in page state and one keystroke from a share link; a placeholder cannot leak what it never contained.
The base URL is servers[0], until you say otherwise
Hosts come from the spec's first servers entry, with variables filled from their declared defaults — one without a default becomes a placeholder like <REGION>. A missing or relative servers list falls back to the placeholder host with a typed note, and the override box replaces the base outright. Whatever lands there is written into text; this page never connects to it.
Snippets, not an SDK
One snippet covers one operation: URL, method, parameters, headers, a minimal JSON body skeleton from required properties, and auth placeholders. Nothing here generates typed models, retries or a client package — openapi-generator is the right tool for that intent, and this page says so instead of imitating it.
curl quoting rides the house quoter
The curl tab quotes every argument through the same POSIX quoter the curl command builder ships. Values that could expand or split in sh, bash or zsh are single-quoted, and the test suite re-tokenizes each printed command with all three shells to prove the argv survives byte-for-byte.
What stays out of a v1 snippet
Non-JSON bodies emit a TODO comment plus a typed note instead of a guessed encoding; cookie parameters are named in a note and never written; 3.1 webhooks are not listed, because they describe calls made to you. Every omission is a visible note, never a silent drop.
Common errors
The spec lists no servers — the snippet uses the placeholder host https://api.example.com until you set a server override.- Specs exported from gateways often omit servers; the placeholder keeps the snippet's shape and the override box replaces it.
This operation takes a multipart/form-data body — v1 writes JSON bodies only, so the snippet carries a TODO comment where the body goes.- A guessed multipart encoding would be worse than an honest gap: boundaries and file parts belong to the client that sends them.
Security scheme "portalOAuth" (oauth2) tokens are granted by a flow this page never runs — the snippet carries a bearer placeholder for the token that flow returns.- The token endpoint, grant and scopes live in your OAuth flow; the snippet reserves the Authorization header for its result.
No DELETE /a operation exists in this spec — pick one from the operation list.- Usually a stale selection after the spec was edited — the picker reselects the first operation when the old one disappears.
FAQ
Is this a full SDK generator?
No. It writes one request snippet per operation — parameters, headers, body skeleton and auth placeholders — in fetch, axios, curl or Python requests. If you want typed models and every operation wrapped in a client package, use a generator built for that, such as openapi-generator. This page optimizes for the minute between reading a spec and sending a first request.
Does my spec upload, and can this page call my API?
Neither. Parsing happens in your browser — a worker thread takes the big documents — and the page has no request path: server URLs from the spec are written into snippet text and never contacted, and remote $ref targets are reported as unresolved rather than fetched. Watch the network tab while you use it; after load, nothing leaves.
Why do snippets say <YOUR_TOKEN> instead of taking my real one?
Because a token pasted into a page is a token in page state, and this tool refuses to hold one — no input for it exists. Replace the placeholder in your shell, an environment variable or a secret manager, where the credential already lives. In the curl form the quoting keeps the swapped-in value a single argument.
Keyboard shortcuts
- ⌘/Ctrl + C
- Copy the snippet when nothing is selected and focus is in the tool.
- ⌘/Ctrl + Shift + C
- Copy the snippet even while text is selected.
- /
- Focus the operation filter.
- t
- Cycle theme.
- ? or ⌘/Ctrl + /
- Open the shortcut help overlay.
- Esc
- Close the overlay.