Insomnia

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the API client I actually need instead of paying for Insomnia: REST, GraphQL and gRPC in one place, with collections that live in my repository.

Read this first: the fee buys cloud sync and team sharing. The better answer for a developer's collections is usually git — the requests live next to the code they exercise, they branch with it, and they are reviewed like anything else. That is the design here.

STACK
- Node 20+ with Fastify for a local server, and a small web interface — or a desktop shell if you want it in the dock
- SQLite through better-sqlite3 for history and responses only. The collections themselves are files
- Requests executed by the local process, which removes CORS entirely
- Caddy in front only if it is shared

COLLECTIONS AS FILES
- One YAML or JSON file per request, in a directory tree that mirrors the API, committed to the repository
- A human-readable format that diffs sensibly: a changed header is a one-line diff, not a re-serialised blob
- Environments as files too, with secrets referenced by name and resolved from the OS key store or from a secrets manager — never written into the file
- This is the whole design decision. Collections in a proprietary cloud are collections that go stale; collections beside the code are updated in the same pull request that changes the endpoint

REST
- Every method, headers, query parameters, path parameters, cookies
- Bodies: JSON with formatting and validation, form-encoded, multipart with files, raw, binary
- Authentication: basic, bearer, API key, digest, OAuth 1 and 2 with the common flows, AWS signature, mutual TLS
- Inheritance from a folder, with the effective request shown before sending so nothing is mysterious
- Response: pretty JSON with folding and a filter expression, headers, cookies, timings split into DNS, connect, TLS and transfer, and size
- Save a response, compare two responses, and copy any request as curl

GRAPHQL
- Schema fetched by introspection and cached, with autocompletion and validation against it
- A separate variables pane, and query and mutation both first-class
- Subscriptions over WebSocket, with the stream displayed as it arrives
- The schema diffed against the last fetch, so a breaking change is visible

GRPC
- Load a .proto file or use server reflection
- Unary, server streaming, client streaming and bidirectional, all four, with the stream visible in both directions
- Message composed as JSON and encoded from the descriptor, with the response decoded back
- Metadata in and out, and deadlines set explicitly
- This is the part few alternatives cover, and it is the reason to build rather than to switch

WEBSOCKETS AND SERVER-SENT EVENTS
- Connect, send frames, watch the log with timestamps
- Reconnect, ping and pong, and a close code shown plainly

DESIGN AND LINTING
- An OpenAPI document opened in a design view: paths, operations, schemas, with validation as you type
- Linting against a rule set kept in the repository — naming, required descriptions, response codes, security schemes
- Requests generated from the specification, so the client and the contract agree
- The lint runs in CI from the command line, which is where it actually enforces anything

SCRIPTS AND TESTS
- Pre-request and post-response scripts in a sandbox with a time limit, no filesystem and no ambient network
- Assertions on status, headers, body and duration
- A folder run: every request in order with variables carried between them, and a summary
- The same run from the command line with an environment named, so it becomes a CI smoke test

HISTORY
- Every send recorded locally with the request as it was actually sent, secrets redacted, and the response body on disk with a retention policy
- Searchable, and a response re-openable weeks later
- Never synced anywhere by default

SECURITY
- Secrets resolved at send time from the key store or a secrets manager, and never written to a collection file, a history row or a log
- Redaction by value match everywhere
- If a shared instance is run, guard outbound requests: refuse private address ranges unless explicitly allowed, or the tool becomes a request forgery machine inside your network

OPERATIONS
- .env: DATABASE_PATH, COLLECTIONS_PATH, SESSION_SECRET
- Migrations on boot, each once
- Import from the common formats — OpenAPI, HAR, curl, and the exports of the popular clients — and export back
- Health endpoint if it is served

WHAT MATTERS MOST
Files in the repository and the command-line runner. Build the file format and the runner first, put a folder of requests next to a real API, and run them in CI. That combination is what turns a request collection from a personal scratchpad into something the whole team can rely on — and it is what a cloud sync fee never gives you.

Give me the repository, the CLI runner, the file format documented, importers, and a README with the design decision explained.