Request Wizard

Request Wizard is a developer tool that lets you intercept and rewrite HTTP traffic made by the page you are viewing — request headers, response headers, request bodies, and response bodies — without touching your server or your codebase. Stop waiting on a backend deploy to test an edge case. Point a rule at the endpoint, reshape the payload, and reload. ━━━━━━━━━━━━━━━━━━━━━━━━ WHAT YOU CAN DO ━━━━━━━━━━━━━━━━━━━━━━━━ • Request headers — Set, append, or remove any header before the request leaves the page. Inject auth tokens, feature flags, tracing IDs, or custom debug headers. • Response headers — Set, append, or remove headers on the way back, so your app sees exactly the response metadata you want to test against. • Request bodies — Replace the outgoing body with static content, or transform it with a JavaScript function that receives the original body and returns a new one. • Response bodies — Mock an API response entirely, or run the real response through a JS transform. Simulate empty lists, error objects, pagination edges, and slow-to-arrive fields. • Method filtering — Scope a rule to specific HTTP methods (GET, POST, PUT, PATCH, DELETE, …) so it fires only where you intend. ━━━━━━━━━━━━━━━━━━━━━━━━ PRECISE MATCHING ━━━━━━━━━━━━━━━━━━━━━━━━ Every rule decides for itself what to match, by domain (hostname) and/or full URL, in two modes: • Regex mode — A standard JavaScript regular expression, tested against the hostname or the full URL. .*\.example\.com → any subdomain of example.com /api/v[12]/ → any URL containing /api/v1/ or /api/v2/ • JS function mode — For anything a regex can't express, write a predicate. It receives `value` (the hostname or URL) and returns true or false. const url = new URL(value); return url.pathname.startsWith('/api/') && url.searchParams.has('debug'); ━━━━━━━━━━━━━━━━━━━━━━━━ ORGANIZED FOR REAL WORK ━━━━━━━━━━━━━━━━━━━━━━━━ • Rule groups — Group rules by project, environment, ticket, or scenario, and give each group a name. Toggle a whole group on or off with one click, so you can switch between "staging auth", "error-state mocks", and "off" in a second. • Global kill switch — One master toggle disables all interception instantly, and the toolbar badge always tells you whether Request Wizard is active. No more forgetting a rule is on. • Instant persistence — Every edit is saved automatically to local extension storage. Close the options page mid-typing or restart Chrome; your rules are still there. • Import / Export — Save a rule set as a JSON file to back it up, commit it next to your project, or hand it to a teammate so they reproduce your setup exactly. • Debug log — See which rules matched and what was changed, so a rule that isn't firing is a five-second diagnosis instead of a guessing game. ━━━━━━━━━━━━━━━━━━━━━━━━ WHO IT'S FOR ━━━━━━━━━━━━━━━━━━━━━━━━ • Frontend developers building against an API that isn't finished yet • QA engineers reproducing error states, empty states, and boundary data on demand • Anyone debugging a live page who needs to change one header and see what happens ━━━━━━━━━━━━━━━━━━━━━━━━ HOW IT WORKS ━━━━━━━━━━━━━━━━━━━━━━━━ Request Wizard runs a content script in the page that wraps `window.fetch` and `XMLHttpRequest`, applies your matching rules, and rewrites the request or response as it passes through. JavaScript rule functions are evaluated inside a sandboxed frame, so they work even on pages with a strict Content Security Policy. Because it hooks the page's own networking APIs, it modifies what the page requests and what the page sees. It does not act as a system proxy and does not alter traffic outside the browser tab. ━━━━━━━━━━━━━━━━━━━━━━━━ PRIVACY ━━━━━━━━━━━━━━━━━━━━━━━━ Request Wizard sends nothing anywhere. There is no account, no telemetry, and no analytics. Your rules live in your browser's local extension storage and never leave your machine unless you export them yourself. ━━━━━━━━━━━━━━━━━━━━━━━━ NOTE ━━━━━━━━━━━━━━━━━━━━━━━━ This is a developer tool that changes network traffic on pages you visit. Use it on sites you own or are authorized to test, and keep the global toggle off during normal browsing.