JoltAPI

A REST API client for VS Code
Build, send, and inspect HTTP requests without leaving the editor.

What is JoltAPI?

JoltAPI gives you a Postman-like experience inside VS Code. Write requests with autocomplete, interpolate variables, organize into collections, and inspect responses — all powered by Node.js native fetch with zero runtime dependencies.

• Full HTTP method support (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS)
• Request builder with variable highlighting, autocomplete headers, and tabbed body editor
• Bearer, Basic Auth, and API Key presets — masked by default, with a show/hide toggle so you can proofread a long token
• Per-request timeout, SSL verification, and redirect limits
• Syntax-highlighted response viewer with status, timing, and size
• Variable interpolation with {{double-brace}} syntax
• Collections organized as workspace JSON files (VCS-friendly)
• Multi-tab request windows (up to 10) with rename/delete sync
• Import from Postman v2.1 and Insomnia
• Reusable proxies — save named proxy configurations once, then pick one per request from a dropdown
• Copy as cURL (proxy flags included) and request history
• Editor-like body editor: Tab-to-indent, auto-closing brackets/quotes, HTML/XML tag closing, and a one-click JSON Format button
• Works in virtual workspaces (github.dev and other file-system providers)

Quick Start

git clone https://github.com/anomalyco/joltapi.git
cd joltapi
npm install && cd webview-ui && npm install && cd ..
npm run build

Open the folder in VS Code and press F5 to launch the Extension Dev Host.

Important: F5 only bundles the extension host. Run npm run build first so the webview assets are up to date.

Keyboard Shortcuts

Body Editor

The body editor behaves like a lightweight code editor:

• Tab-to-indent — Tab inserts 4 spaces (or indents every line of a selection); Shift+Tab outdents.
• Auto-close brackets/quotes — typing (, [, {, ", or ' inserts the matching closer with the cursor between them; typing the closer again types over it instead of duplicating it. Backspace between an empty pair ((|)) removes both at once.
• Auto-indent on Enter — new lines match the current line's indentation, add a level after an opening bracket, and splits an empty pair ({|}) onto three lines with the cursor indented in between.
• Format button — appears above the editor whenever the Body tab is set to JSON; pretty-prints the current JSON with 4-space indentation. Disabled while the JSON is invalid (fix the syntax error shown below the editor first).
• HTML/XML tag closing — in a raw body set to application/xml, text/xml, or text/html, typing > at the end of an opening tag inserts the matching closer: <user + > → <user>|</user>. Closing tags, self-closing tags (<br />), comments, declarations, and HTML void elements (<br>, <img>, …) are left alone.

Sidebar

The JoltAPI sidebar has four tabs:

Proxies

Proxies are defined once and reused. Instead of retyping a host, port, and credentials on every request, you save a named proxy in the sidebar and pick it from a dropdown wherever you need it.

Create one — open the sidebar's Proxies tab → + Add Proxy, then fill in:

Click a saved proxy to edit it, or the ✕ to delete it.

Use one — open any request's Proxy tab and pick it from the dropdown. No proxy — send directly is the default. The selected proxy's address and auth are shown underneath so you can confirm what the request will actually go through.

Because a request stores only a reference to the proxy, editing a proxy's host or port instantly applies to every request using it. Delete a proxy that requests still point to and those requests show a Missing proxy — deleted warning; sending one fails with a clear error rather than silently going out direct. The same holds if a proxy can't be applied for any other reason — JoltAPI aborts the request instead of quietly sending it unproxied.

Proxies are stored in .joltapi/proxies.json alongside your collections and variables, so they travel with the workspace. When you export a collection, the proxies its requests use are bundled into the .joltapi.json file without their credentials, and importing recreates any your workspace doesn't already have — so a shared collection works out of the box, and you only re-enter the password.

Upgrading from 0.4.0 or earlier? Requests saved with the old inline per-request proxy keep working — their Proxy tab shows the old settings read-only, and picking a saved proxy migrates them.

Per-Request Settings

Each request's Settings tab overrides the workspace defaults for that request alone:

Redirects are followed by JoltAPI itself, which means: your hop limit is respected, POST becomes GET on 301/302/303 (matching browsers and curl), and Authorization/Cookie headers are dropped when a redirect crosses to a different origin — the redirect target is chosen by the remote server, so forwarding credentials there would hand your token to a host you never named.

How It Works

Requests are built in a React webview panel and sent to the extension host via postMessage. The host resolves {{variables}}, looks up the request's saved proxy, executes the HTTP call with Node.js fetch, and posts the response back. Collections, variables, and proxies live as plain JSON in .joltapi/ inside your workspace.

Sidebar (collections, history, variables, proxies) ──► Extension Host ──► HTTP
                                                            │
Main Panel (request builder, response) ◄─────────────────────┘

Any change made in one webview (saving a proxy, renaming a request) is broadcast to both, so the sidebar and the request panel never drift apart.

Storage

Everything lives in your workspace — human-readable, VCS-friendly:

<workspace>/.joltapi/
├── variables.json
├── proxies.json
└── collections/
    └── <name>.json

Variables, auth values, and proxy credentials are stored in plain text. Do not store production credentials.

All reads and writes go through VS Code's file-system API, so JoltAPI also works in virtual workspaces (github.dev and other file-system providers).

Extension Settings

In untrusted workspaces, a repository's own .vscode/settings.json cannot override joltapi.proxy.* or joltapi.defaultHeaders — only your User/machine-level values apply. This prevents an untrusted repo from injecting extra headers or seeding a proxy profile that would reroute your requests.

Dev Workflow

npm run watch                     # Rebuild the host bundle on change (esbuild)
cd webview-ui && npm run dev      # Watch webview build (in another terminal)

npm run build                     # One-shot: bundle host + build webview
npm run lint                      # Type-check both projects
npm test                          # Unit tests (host + webview)
npm run test:integration          # Real VS Code integration tests (downloads VS Code once)

The extension host is bundled with esbuild into a single out/extension.js. undici stays external and ships in node_modules — bundling it would break the .wasm lookup its HTTP parser does relative to its own directory, silently disabling proxy and SSL-bypass support.

Promo Video

The demo above was built with HyperFrames (HTML-to-MP4, Apache 2.0). The composition lives in joltapi-video/index.html.

cd joltapi-video
npm install
npm run render    # outputs MP4 to renders/

Requires Node.js 22+ and FFmpeg.

License

MIT © JoltAPI — by S0nder