What's new in API Tester: Socket.IO, MQTT and real test scripts

Back in July we introduced the API Tester as a REST, WebSocket, GraphQL and SSE client built into the IDE. Since then it grew a full write-up in the docs — and, more importantly, two new protocols, a real scripting engine, and a way to keep your API collections out of the cloud entirely.

Here's everything that's new.

Socket.IO, event by event

There's no fixed catalog of events in Socket.IO the way there is in MQTT, so the panel doesn't try to fake one. Connect to a namespace, toggle auto-reconnect if you want it, then:

• Add a listener for any event name you expect.
• Emit an event of your own with a JSON payload.

Every message in the chat-style log is tagged with the event name it belongs to, so a connection juggling message, typing and presence events stays readable. Under the hood it's the official socket.io-client-java library. There are no custom headers, auth or query parameters, and listeners cannot be removed once added.

MQTT, topic by topic

Built on HiveMQ's client, and it speaks MQTT 5 only: a broker that speaks just 3.1.1 may refuse the connection, and the panel has no MQTT 5 properties yet. Connect with or without TLS, with or without a username and password, then:

• Subscribe to a topic with QoS 0, 1 or 2.
• Publish to a topic with a QoS (there is no retain option).

Incoming messages group by topic so a device publishing to sensors/+/temp doesn't turn into a single unreadable stream. There is no unsubscribe, last will or custom TLS certificate yet.

What about gRPC?

When this post first went out, it also announced an experimental gRPC panel. That panel is still in the code, but the current version of PocketCode hides it: gRPC needs a library the app has to leave out, so the panel can't work on Android yet. It stays hidden until it does. Today the protocol menu has the six protocols that work: REST, WebSocket, GraphQL, SSE, Socket.IO and MQTT.

Test scripts that actually run

This is the one we're proudest of, because it replaces something that didn't really work. The old test runner matched pm.test('...') calls by regular expression and guessed the result from the words in the test's name — a test called "user has admin role" always passed, no matter what the response actually contained.

That's gone. Two things replace it:

1. No-code assertions — pick a field (status code, response time, a header, a JSONPath into the body, body size), an operator (equals, contains, greater/less than, exists), and a value. No script, always evaluated, and fast to build on a phone keyboard.
2. Real JavaScript test scripts, running in an isolated sandbox process (androidx.javascriptengine, which rides on the device's WebView engine). A script that throws can't take the app down with it. On the rare device with no modern WebView, it degrades to a plain console warning instead of silently pretending your tests passed. Scripts get a small pm.* subset (pm.test, pm.expect, pm.environment, pm.response and a few more), not the whole Postman API.

Both write their results to the same Tests tab, and everything a script logs shows up in a dedicated Console tab — LOG / INFO / WARN / ERROR levels included.

Collections that live in your repo, not in someone else's cloud

Save to project mirrors a collection as one readable JSON file per request, under .pocketcode/api/<collection>/, inside the project your code editor already has open. You tap it yourself; nothing is mirrored automatically.

Room — PocketCode's local database — stays the source of truth day to day. Exporting regenerates the whole directory from Room, so it's always a clean snapshot. Importing shows you a preview first — a brand-new collection, or exactly how many requests would be replaced — and nothing touches the database until you confirm. Commit the files with the app's own Git manager and your API collection reviews like any other pull request, because it is one. One thing to watch: the files carry the auth values exactly as stored in the request, so keep tokens out of anything you commit.

A few smaller things that add up

• History gained "Compare with…", a real diff between two responses — line-by-line on the body, plus a separate header diff — and "Use as mock", which turns a past response into a mock route from a menu.
• The Runner (Pro) can now iterate a CSV or JSON data file, one row per iteration, with each row available to variable resolution above Collection scope.
• Dynamic variables landed: {{$guid}}, {{$timestamp}}, {{$isoTimestamp}}, {{$randomInt}}, {{$randomEmail}}, {{$randomFirstName}}, {{$randomLastName}}, resolved fresh on every use.
• The Mock Server (Pro) can now generate routes straight from an imported OpenAPI document, and a History response can become a mock route.

---

Six protocols, real scripts instead of a guess, and API collections that version like the rest of your code — all stored on your phone, with nothing required in the cloud. If you haven't seen the rest of the module, the full breakdown is in the docs.

PocketCode is available on Google Play. Get PocketCode