For teams · £96 per seat per year

The API client that runs on your machine.

ReqForge is a native desktop API client and test runner. Collections, environments, scripting and assertions, plus load testing, security scanning and a headless command-line runner. No cloud workspace, no sync service, no request of yours leaving your network: your work stays as plain JSON files in a folder you choose.

Start a 14-day trial See pricing Read the docs

Five seats, fourteen days, no card. Buy at £96 per seat per year when it has earned it.

The ReqForge window: collections on the left, a GET request with query parameters, and a JSON response with status, timing and size.

Your data never leaves your machines Works offline for up to three weeks One JSON file per collection Rust HTTP engine macOS · Windows · Linux No analytics, no crash reporting

Everything the job needs, in one window

Sending a request is the start of the work, not the end of it. The things an API client usually sends you elsewhere for are here.

Native speed

The request path is Rust: TLS, redirects, decompression, cookies and streaming all happen outside the web view, so the interface stays responsive while a 30 MB response downloads.

Your data is just files

A collection is one JSON file in a directory you pick. Diff it in a pull request, copy the folder to another machine, carry on working. No proprietary database, no export step.

Variables that explain themselves

Four scopes with a clear precedence, autocomplete on {{ showing what each name resolves to, and a hover preview of the fully resolved value and where it came from.

Scripting and assertions

Pre-request and test scripts in JavaScript with a Postman-compatible pm API, run in an embedded engine with time limits so a runaway loop cannot hang the app.

Run the whole collection

In the app with live results, or headlessly with reqforge-cli: JSON and JUnit reporters, CI-shaped exit codes, and the same engine behind both.

Load testing

Integrates with k6, the open-source load testing tool. Turn the open request into a script, pick virtual users and a duration, and get p90, p95, p99 and max latency, throughput and failure rate as it runs.

Security scanning

Integrates with ZAP, the open-source web security scanner. Scan one request, a collection, or everything: spidering plus an opt-in active scan, with findings grouped by risk.

Git for your collections

Open ReqForge on a repository and commit, branch, pull and push from inside the app. libgit2 is bundled, so it works whether or not git is installed.

Brings your work with you

Import Postman v2.1 collections and environments, cURL commands and OpenAPI 3.x documents. Export back to Postman, optionally with every credential blanked.

WebSockets and SSE

ws://, wss:// and Server-Sent Events render as a timestamped conversation. Binary frames are decoded when they are text and hex-dumped when they are not.

Documented from the inside

Press F1 for a searchable user guide covering every feature, written for someone who has never opened the app. No undocumented features ship.

Keyboard first

Send, save, close, filter, new request, new window and the guide are all a chord away, and the tree and tab strip are fully navigable without a mouse.

A look around

Every screenshot on this page is the real application, captured from the current build.

Write the assertions where the request lives

Test scripts use the same pm API you already know: pm.test, Chai-style pm.expect, pm.environment.set to pass a value to the next request, and pm.sendRequest when a call needs a token first.

Results land in the response panel, pass or fail, with the reason.
Pre-request scripts run before the send, with the same API.
Console output from either script is kept beside the response.

The Tests tab of a request, showing a JavaScript test script with pm.test assertions and syntax highlighting.

Run the suite and see what broke

Press on a collection or a folder to run every request in order. Each row shows the status, the time and every assertion; failures expand to the URL that was reached and what the assertion expected.

Stop at the first failure, or let it run to the end.
Put a delay between requests when the API rate-limits.
The same run, headless, is one reqforge-cli command.

The collection runner: nine requests run, one failed, with the failing assertion expanded to show the expected and actual status.

Load test the request you already have

No second definition of the request. ReqForge integrates with k6, the open-source load testing tool: choose virtual users and a duration or an iteration count, and the open request becomes a script that runs on your own machine, with the tool's output streamed as it goes.

Average, p90, p95, p99 and max latency.
Throughput, failure rate, peak VUs and iterations.
Needs k6 installed on your PATH; the panel tells you how.

The Load Test tab after a run: a results table with latency percentiles and throughput, above the load tool's streamed console output.

Scan your own endpoints for vulnerabilities

ReqForge integrates with ZAP, the open-source web application security scanner: it finds the ZAP installed on your machine and starts and stops it for you, or talks to a daemon you already run. Point it at the active request, a whole collection, or everything, and it spiders first, with an active scan as an opt-in second pass.

Findings grouped by risk, with evidence and remediation.
Export the report as JSON.
Needs ZAP installed; the dialog tells you how.
Only scan systems you are authorised to test.

The security scan dialog: connection settings, target selection, and a findings list with a high-risk SQL injection alert expanded.

Open it on the folder the tests belong to

A workspace is just a directory: a repository, or the folder beside the service under test. ReqForge lists the API files it finds there (its own, Postman exports, OpenAPI documents), imports them on a press, and reads the folder's git branch and remote.

Start on one from a terminal: reqforge .
Several windows on the same folder; drag a tab out into its own.
Commit, branch, pull and push without leaving the app.

The workspace dialog: the current folder with its git branch and remote, the API files found in it, and a list of recent folders.

The same run, from a terminal

reqforge-cli runs your collections without the UI, through the same engine: same variables, same scripts, same settings, same cascade. Its options mirror Newman's and it reads the same files, so an existing pipeline usually only needs the command name changed.

reqforge-cli

$ reqforge-cli run ./billing.postman_collection.json

ReqForge · Billing API · 3 request(s)

Billing API / Invoices / List invoices GET http://127.0.0.1:8099/v1/invoices
  200 OK · 3 ms · 123 B
  ✓ status is 200
  ✓ returns a page of invoices

Billing API / Invoices / Create invoice POST http://127.0.0.1:8099/v1/invoices
  201 Created · 1 ms · 30 B
  ✓ status is 201

Billing API / Health check GET http://127.0.0.1:8099/healthz
  200 OK · 0 ms · 55 B
  ✓ status is 200
  ✓ every dependency is up

3 request(s) · 0 failed · 5 assertion(s) · 0 failed · 46 ms

Exit code 0 when everything passed, 1 when a request or an assertion failed, 2 for bad usage, so a CI job fails for the right reasons. Add -r junit --reporter-junit-export results.xml and your runner shows the failures as tests. The CLI reference is in the docs.

Unattended build agents are not licensed yet. run and diagnose read a licence token from REQFORGE_LICENCE_TOKEN, and that token is bound to the machine it was issued for. There is no way to issue one for a build agent today, so a pipeline cannot hold a seat yet. That part is being built. list, logs and doctor need no licence at all. What that means for a pipeline.

More of the app

Click any of these to see it full size.

The response panel's Tests tab, listing three passing assertions. — Assertions land beside the response, pass or fail.

The environments dialog with Local, Staging and Production, and the Local variables listed. — One set of values per place you run against.

The in-app user guide open at Getting started, with a searchable list of sections. — The whole user guide is inside the app, on `F1`.

The main ReqForge window in the light theme. — Light theme, for those who prefer it.

A fresh ReqForge window with no request open, listing the top-level keyboard shortcuts. — A new window tells you the shortcuts worth knowing.

A GET request with query parameters and its JSON response. — Request on top, response below, or side by side.

Try it against your own APIs

Fourteen days, five seats, no card: the whole product, not a cut-down version of it. Builds for macOS, Windows and Linux are on the releases page; the seat is what makes them run.

After that it is £96 per seat per year, billed annually, with every feature in every seat. Your collections are files on your own disk throughout: whether you buy or not, they stay open, editable and exportable. What a lapsed licence stops is sending requests, not reading your own work.

Start a 14-day trial What it costs