API Testing on Android: A Full REST, GraphQL & WebSocket Client in Your Pocket

An API breaks at the worst possible moment: you're away from your desk, the webhook isn't firing, and your laptop with Postman is at home. On Android, the usual answer is "wait until you're back." PocketCode removes that wait — it ships a full HTTP client built into the IDE, so you can test and debug REST APIs from your phone without a second app or a single line of glue code.

This is not a stripped-down toy. It's a full, professional-grade HTTP client, and it lives right next to your editor, terminal and database manager.

What it can actually do

The API Tester speaks four protocols, selectable from a chip above the editor:

Protocol	What it's for
REST (HTTP)	The classic request/response client — 8 methods
WebSocket	Live bidirectional connections (ws:// / wss://)
GraphQL	Queries, mutations, subscriptions + schema introspection
SSE	Server-Sent Events streams in real time

For REST it covers all eight HTTP methods — GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS and TRACE — each colour-coded so you can scan a collection at a glance.

Building a request

The request editor is organised as a sticky URL bar plus a set of collapsible sections, each with its own accent colour:

• URL bar — method selector, a monospace URL field, and a Send button that shows a spinner while the request is in flight.
• Params — a key/value editor where every row has an enable/disable checkbox and an active-count badge, so you can toggle query params without deleting them.
• Headers — the same key/value editor, with autocomplete for common headers (Content-Type, Accept, Authorization, Cache-Control, User-Agent…).
• Body — ten body types: JSON (with Beautify / Minify), Form URL-Encoded, Multipart (per-field TEXT or FILE with a file picker), Raw, XML, HTML, JavaScript, Binary (send a raw file), and GraphQL.

Anywhere you can type a value — URL, headers, body, auth, cookies — you can drop a {{variable}} and it gets interpolated at send time (more on that below).

Authentication, the complete list

This is where mobile API clients usually fall short. PocketCode supports ten auth schemes, split into common cards and an advanced section:

• Common: None, Bearer (token + custom prefix), Basic, API Key (with a choice of Header or Query Param).
• Advanced: OAuth2 (Authorization Code, Client Credentials, Password or Implicit grants), Digest, AWS Signature v4 (access key, secret, region, service, session token), Hawk, NTLM, and a fully Custom header.

If you sign requests against AWS or hit an enterprise NTLM endpoint, you can do it from the phone — no compromises.

Scripts and tests

Two JavaScript hooks run around every request:

• A pre-request script runs before sending — transform variables, compute a timestamp, generate a signature.
• A test script runs after the response, using the widely-adopted pm.test, pm.expect, pm.response assertion API.

There's a menu of ready-made assertions so you don't have to write them by hand: status is 200, status is 2xx, response time < 500 ms, has JSON body, body not empty, has Content-Type header, JSON schema validation, body contains string, and array length > 0. A console panel below the editor logs everything at LOG / INFO / WARN / ERROR levels.

Reading the response

The response panel gives you the numbers that matter up top — status code (with a colour by range), total time in milliseconds, body size, and the negotiated protocol plus remote IP. Below that, tabs:

Tab	What you get
Body	Pretty (formatted JSON/XML/HTML), Raw, Preview (rendered HTML), and a collapsible Tree view for JSON
Headers	A copy-friendly table
Cookies	Rows with Secure / HttpOnly badges
Timeline	DNS · TCP · TLS · TTFB · content transfer
Tests	Assertion results (name, pass/fail, duration)
Info	Metadata and the full redirect chain

You can copy the body, share it, save it, or search inside it with highlighted matches — handy on a small screen.

Beyond REST

• WebSocket connections show a chat-style history of SENT / RECEIVED messages, support custom handshake headers and subprotocols, handle TEXT / BINARY / PING / PONG / CLOSE frames, and offer auto-reconnect plus saved message templates you can fire again.
• GraphQL has a query editor with JSON variables and an optional operation name, a Fetch Schema button that runs introspection, and a schema explorer for types, fields and arguments.
• SSE streams land in a live event timeline (id, type, data, timestamp, retry) with a filter, auto-reconnect that respects the server's retry, and Last-Event-ID tracking to resume the stream.

Staying organized

• Collections are hierarchical — collection → nested folders → requests — with search, rename/delete, and a tap to load any request back into the editor.
• History keeps every request you've run, searchable by URL or name, filterable by method or "starred only", and grouped into Today / Yesterday / This week / Older. Star, re-send or delete individual entries.
• Environments manage {{variable}} sets. Each variable has an initial and a current value, a description, an enabled toggle, an isSecret flag that hides the value, and a scope (Global / Environment / Collection / Local). Resolution goes Local → Collection → Environment → Global.
• A persistent cookie jar fills itself from every Set-Cookie and shows Secure / HttpOnly badges.

Power tools

• Import from cURL, Postman v2.1, Insomnia, OpenAPI 3.0 / Swagger (JSON or YAML) and HAR. Export adds Markdown to that list.
• The Code Generator turns the current request into ready-to-paste code for ~20 languages and HTTP clients — cURL, HTTPie, Wget, Fetch, Axios, Node, Python requests, Java OkHttp, Swift URLSession, Go net/http, PHP, Ruby, C#, Rust, Dart, PowerShell and more — imports, headers, body and auth included.
• A local Mock Server (part of the Pro plan) stands up an HTTP server on the device (default port 8090) where each route defines a method, path pattern (/users/:id), status, headers, body and a simulated delay — with a live log of incoming calls.

Your data stays on the device

Collections, history, environments and cookies are stored in a local database on your phone — we never keep your requests or connection data on our servers. For development you can toggle SSL verification off for self-signed certs, route through an HTTP/HTTPS/SOCKS proxy, or attach a client certificate. And because it's part of the IDE, the AI assistant can even see your collections when you ask it about your APIs.

---

Testing an API used to mean "get back to your computer." It doesn't anymore. PocketCode puts a professional HTTP client — REST, WebSocket, GraphQL and SSE — in the same app where you write and ship the code.

PocketCode is heading to Google Play. Join the pre-registration to be among the first to try it on your own device.