API Tester for Flutter

A local REST client for VS Code with Flutter/Dart model, Dio service, repository, and optional Cubit generation. Built by Windo Flash (windoflash). Test any HTTP backend: Dart, Node/Express, Laravel, Django, FastAPI, Spring Boot, .NET, or another REST service.

Features

• GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS requests.
• Enabled/disabled query parameters and headers; JSON, raw text, URL-encoded, and multipart text bodies.
• Bearer, Basic, and API key authentication (header or query).
• Status, duration, bounded response size, response headers, raw text, and highlighted collapsible JSON.
• Request cancellation, configurable timeout, useful HTTP/network errors, and bounded response reading.
• Named saved requests with update/delete, recent request history with restore/clear, and local environments.
• {{VARIABLE}} substitution in URL, enabled fields, request text, and active authentication fields.
• Null-safe Dart models, nested classes, arrays, fromJson/toJson, Dio services, repositories, and optional Cubit integration.
• Flutter workspace discovery, manual folder selection, and explicit conflict handling for generated files.
• Native VS Code theme colors, keyboard controls, command palette, editor action, and status bar entry.

Installation

Build locally (Node.js 22+ and npm):

npm install
npm run compile
npm test
npm run package:vsix
code --install-extension api-tester-for-flutter-0.1.0.vsix

On Windows PowerShell with script execution disabled, use npm.cmd and code.cmd. You can also use Extensions: Install from VSIX.... VS Code 1.100 or newer is required. This repository does not assume that the extension has been published to the Marketplace.

Usage

1. Run API Tester for Flutter: Open API Tester, or click API Tester in the status bar.
2. Choose a method and enter an absolute HTTP(S) URL.
3. Configure Params, Headers, Body, and Auth. Use the Secret checkbox to mask sensitive key/value fields.
4. Click Send request. Inspect Pretty, Raw, or Headers; copy the response if needed.
5. Name and Save the request. Loading a saved request and saving again updates it. New request creates a separate request.
6. Use Manage beside Environment to create or edit environments. Select an environment to activate it.

Example environment:

BASE_URL = https://api.example.com
TOKEN = your-token (mark Secret)

Request URL: {{BASE_URL}}/users/1; Bearer token: {{TOKEN}}. Variables are replaced once, not recursively. Missing enabled variables produce a clear error. In JSON strings, variable values must already be JSON-safe; use unquoted placeholders for numbers/objects as appropriate.

Flutter code generation

After a complete 2xx JSON response, click Generate Flutter Code:

1. Select a detected Flutter project or choose a folder containing a Flutter pubspec.yaml.
2. Enter a model name, such as User.
3. Choose Model, Dio Service, Repository, or the complete data layer. Service and repository options include the supporting files they need.
4. Optionally select Cubit integration. This includes the complete data layer.
5. Review the target files. Existing files always require Replace, Create New File, or Cancel. Create New File places the complete related bundle in a new folder, preserving relative imports.

Files are placed under lib/api_tester/user/ in models/, services/, repositories/, and optionally cubits/. Folder and class names are sanitized. Generation refuses symbolic links within the output path. VS Code workspace trust is required to generate files.

For {"id":1,"name":"John","email":"john@example.com"}, the generated model has int id, String name, String email, a constructor, User.fromJson, and toJson. Nested objects become additional classes. Object arrays merge all sampled fields; absent and null fields become nullable. Mixed numeric arrays infer num; heterogeneous values use dynamic.

Generated service usage:

final service = UserApiService(Dio());
final repository = UserRepository(service);
final user = await repository.execute(
  'https://api.example.com/users/1',
  headers: {'Authorization': 'Bearer $token'},
);

The service uses the HTTP method of the tested request. Methods that allow bodies accept data; pass a map for JSON, or Dio FormData for multipart. Pass runtime queryParameters, headers, and URL explicitly. The generator deliberately omits actual request values to keep tokens and private request data out of source files.

Run flutter pub add dio when using a service/repository. For Cubit, also run flutter pub add flutter_bloc. The extension warns when these dependencies are absent and never changes pubspec.yaml. Review inferred types against your real schema, then run dart format lib/api_tester and flutter analyze in your project.

Commands

All commands have the API Tester for Flutter prefix:

Settings

Security and privacy

No accounts, analytics, AI APIs, cloud backend, or external database. API traffic goes only to the URL you send, from the VS Code extension host. In Remote SSH, WSL, or a dev container, that host is the remote environment; localhost refers to that environment.

Complete saved requests, history snapshots, and environment variable values use VS Code SecretStorage. Request names, environment names, and history method/time/URL path metadata use workspaceState (globalState when no folder is open). Query values are omitted from history metadata; do not put secrets in names or URL paths. The secret checkbox controls masking, not encryption. Responses remain in memory and are not persisted; secrets returned by your server may appear in the response viewer. Copying a response explicitly places it on the system clipboard.

The webview uses a restrictive Content Security Policy and DOM text APIs for API content. Messages are validated and bounded. Credentials are not logged. TLS certificate validation stays enabled. Redirects are shown as 3xx responses and are not followed automatically, avoiding accidental credential forwarding. Request bodies on GET and HEAD are ignored.

Saved data is scoped to a workspace and is not exported or synced by this extension. Closing the panel discards unsaved drafts and in-memory responses. History currently records completed HTTP exchanges, including HTTP errors; failed network requests are not saved. Clearing history deletes its stored snapshots.

V1 limits and roadmap

• Multipart currently supports text fields; binary uploads/downloads are planned.
• One active request editor; multi-request tabs, collections, and import/export are planned.
• Large responses are truncated and cannot generate code. Size is bytes actually read after decompression, not wire bytes; truncated totals are a lower bound. JSON tree rendering is capped; Raw contains the entire retained body.
• No automatic redirects, cookie jar, OAuth flows, custom proxy UI, or custom CA UI. Networking uses the extension host's Node fetch/TLS behavior rather than VS Code's HTTP proxy settings.
• Samples are not a schema: empty arrays, null-only fields, mixed types, and deeply nested values may use dynamic. Very complex samples are rejected for safe generation.
• Generation uses execute(...) with runtime arguments, without inventing endpoint-specific business logic or path parameter types.

Development and verification

npm run compile           # strict TypeScript, ESLint, esbuild
npm test                  # core unit tests and loopback HTTP integration tests
npm run test:webview       # browser interaction/render tests (uses installed Microsoft Edge)
npm run test:dart          # optional Flutter SDK analysis; requires cached Dio/flutter_bloc dependencies
npm run test:integration  # actual VS Code extension-host smoke tests (downloads test VS Code)
npm run package:vsix      # production build and VSIX packaging
code --extensionDevelopmentPath=.

Or open this folder in VS Code and press F5 using Run Extension. In the development host run API Tester for Flutter: Open API Tester. Do not run the Node core tests through the VS Code Mocha runner; the scripts separate them.

Issues / contact

Publisher: Windo Flash (windoflash). No public support URL has been configured yet. Report issues to the repository maintainer through your repository's issue tracker, including VS Code/OS versions and redacted reproduction steps. Never include tokens, passwords, private API responses, or credential-bearing URLs.