curl Cheat Sheet 2026: HTTP Requests for API Testing

A quick reference for curl — the command-line HTTP client. Bookmark this page.

Basic Requests

# GET request
curl https://api.example.com/users
curl -s https://api.example.com/users  # Silent (no progress)
curl -sS https://api.example.com/users # Silent but show errors

# POST request
curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d '{"name": "Alice", "email": "alice@example.com"}'

# PUT request
curl -X PUT https://api.example.com/users/1 \
  -H "Content-Type: application/json" \
  -d '{"name": "Alice Updated"}'

# DELETE request
curl -X DELETE https://api.example.com/users/1

# PATCH request
curl -X PATCH https://api.example.com/users/1 \
  -H "Content-Type: application/json" \
  -d '{"email": "newemail@example.com"}'

Headers and Authentication

# Custom headers
curl -H "Authorization: Bearer TOKEN" \
  -H "Accept: application/json" \
  https://api.example.com/data

# Basic auth
curl -u username:password https://api.example.com/secure

# Bearer token
curl -H "Authorization: Bearer eyJhbG..." https://api.example.com/data

# Show response headers
curl -i https://example.com          # Include response headers
curl -I https://example.com          # HEAD request (headers only)
curl -v https://example.com          # Verbose (request + response)

File Upload and Download

# Download file
curl -O https://example.com/file.zip          # Keep original name
curl -o custom-name.zip https://example.com/file.zip
curl -L -O https://example.com/redirect       # Follow redirects

# Upload file
curl -X POST https://api.example.com/upload \
  -F "file=@/path/to/document.pdf"

# Upload with additional fields
curl -X POST https://api.example.com/upload \
  -F "file=@photo.jpg" \
  -F "description=Profile photo"

Output and Formatting

# Pretty print JSON (pipe to jq)
curl -s https://api.example.com/users | jq .

# Write output to file
curl -s https://api.example.com/data -o output.json

# Show timing info
curl -w "DNS: %{time_namelookup}s\nConnect: %{time_connect}s\nTTFB: %{time_starttransfer}s\nTotal: %{time_total}s\n" \
  -o /dev/null -s https://example.com

# Show only HTTP status code
curl -s -o /dev/null -w "%{http_code}" https://example.com

# Show redirect chain
curl -sIL https://example.com

Advanced Options

# Follow redirects
curl -L https://example.com/redirect

# Set timeout
curl --connect-timeout 5 --max-time 30 https://slow-api.example.com

# Send data from file
curl -X POST https://api.example.com/data \
  -H "Content-Type: application/json" \
  -d @payload.json

# Use a proxy
curl -x http://proxy:8080 https://example.com
curl -x socks5://proxy:1080 https://example.com

# Skip SSL verification (testing only!)
curl -k https://self-signed.example.com

# Send cookies
curl -b "session=abc123" https://example.com
curl -b cookies.txt https://example.com
curl -c cookies.txt https://example.com  # Save cookies

API Testing Patterns

# Check if API is healthy
curl -sf https://api.example.com/health && echo "OK" || echo "FAIL"

# Measure response time
curl -s -o /dev/null -w "%{time_total}" https://api.example.com/users

# Loop with different payloads
for i in {1..10}; do
  curl -s -X POST https://api.example.com/items \
    -H "Content-Type: application/json" \
    -d "{"name": "item-$i"}"
done

Tips and Tricks

• Use curl -sS in scripts (silent but shows errors)
• Use jq for JSON processing: curl -s url | jq '.users[0].name'
• Use --retry 3 for flaky endpoints
• Use --compressed to accept gzip responses
• Save common options in ~/.curlrc

Related Resources

• jq Cheat Sheet
• Bash Cheat Sheet
• OpenSSL Cheat Sheet