Requestly
Requestly is a Git-native desktop API client for designing, building and testing APIs. Collections live as plain JSON in your own repository, with request mocking, HTTP interception, AI-generated tests and enterprise controls like SSO and role-based access.
What is Requestly?
Requestly is a desktop API client published by BrowserStack, Inc., which acquired the product in May 2025. Its defining claim is being Git-native: collections and environments are stored as plain JSON files in a repository you own, so they can be versioned, diffed and reviewed in pull requests instead of living inside a vendor's cloud. Teams pick one of three storage models, fully local, optional real-time cloud sync for shared projects, or a self-hosted deployment on their own infrastructure.
As a client it covers REST, GraphQL with schema introspection, SOAP through WSDL import, and gRPC with server reflection and streaming. Requests carry parameters, headers, bodies and authorisation, from API keys and Bearer or Basic auth through to OAuth 1.0 and OAuth 2.0. Variables can be scoped globally, per collection, per environment or generated on the fly from more than a hundred built-in data generators. Pre-request and post-response scripts run in a full JavaScript sandbox with a documented rq object, npm package imports and Chai-style assertions.
The AI part is deliberately narrow. The Test Authoring Agent reads a request you have actually sent and the response you actually received, then writes runnable post-response tests from an instruction as plain as 'test status and pagination fields'. What lands in the editor is ordinary JavaScript you can read and extend, and when a script already exists the agent revises it rather than overwriting your own assertions. It requires a Pro plan, AI features enabled for the organisation, and a one-time consent prompt.
Around that sit the automation and governance pieces: a collection runner with data-driven iterations and scheduled cloud runs, a command-line binary for continuous integration, a mock server with routes, response selection modes and private mocks, and a separate HTTP Interceptor shipped as a browser extension or a desktop app. Security is pitched squarely at review committees, with SOC 2 Type II, SAML SSO for Okta and Microsoft Entra ID, Admin, User and Viewer roles, encryption in transit and at rest, audit logs, and a Vault that leaves only a {{vault:key}} reference inside a shared collection. The vendor claims 300,000 developers across 50,000 companies.
What it does
- Send REST, GraphQL, SOAP and gRPC requests from one desktop client
- Generate runnable post-response test scripts from a plain-English instruction
- Run a whole collection in order, driven by a CSV or JSON data file, locally or in CI
- Spin up a mock server from a collection or an OpenAPI file, with routing and matching rules
- Intercept, modify and replay HTTP and HTTPS traffic in the browser or across the whole machine
- Keep collections as plain JSON in a Git repository and review changes in pull requests
- Hold credentials in an encrypted vault backed by the OS keychain, AWS Secrets Manager or Azure Key Vault
When to use Requestly / When not to
A quick filter to help you decide if Requestly is the right fit.
When to use Requestly
- Backend engineers who send, mock and debug REST, GraphQL, SOAP and gRPC endpoints every day
- QA and test automation engineers who need assertions, collection runs and execution inside CI pipelines
- Frontend engineers who have to build before the backend is ready, using mock servers and traffic interception
- Engineering teams that want API collections versioned in their own Git repository and reviewed in pull requests
- Organisations with a formal security review, needing SOC 2 Type II, SAML SSO, role-based access and audit logs on an API client
When not to use Requestly
- Mobile-first users: there is no iOS or Android app, only desktop builds and browser extensions
- Non-technical users: the tool assumes fluency with HTTP, environment variables and a little JavaScript
- Teams that need an interface in a language other than English, since no other interface language is advertised
- Anyone looking for a general-purpose AI assistant: the AI here only drafts API test scripts, nothing else
- Buyers who must know where their data is hosted, as no hosting country or region is published anywhere on the site
How to use Requestly
A typical end-to-end flow, from setup to results.
- Download the desktop app from the Downloads page: a .dmg for macOS, an .exe for Windows, an .AppImage for Linux. No account is needed to start
- Import what you already have: Postman v2.1 collections, Insomnia, Bruno, cURL commands, an OpenAPI specification, a WSDL file or a HAR capture
- Create a project, either local, where the files sit on your machine and go into Git, or a team project synchronised in the cloud
- Compose a request: method, URL, parameters, headers, body and authorisation, from an API key through to OAuth 2.0
- Define environments and variables so the same request runs unchanged against local, staging and production
- Move credentials into the Vault and reference them as {{vault:key}} rather than writing them in clear text
- Send the request and read the response in pretty, raw or preview view, narrowing it with a JSONPath filter if needed
- Open the Post-response tab and either write assertions in JavaScript yourself or click Generate tests and let the AI agent draft them
- Group requests into a collection and run it with the Collection Runner, optionally iterating over a CSV or JSON data file
- Wire the Requestly CLI into your CI pipeline, then invite teammates to a team project and assign Admin, User or Viewer roles
Pros & Cons
Pros
- Collections are plain JSON in your own Git repository: portable, reviewable in pull requests, and genuinely yours
- Three storage models rather than one cloud path: fully local, optional cloud sync, or self-hosted
- A free tier that is actually usable: unlimited collections, environments and tests, 10 collaborators and 3 team projects
- Flat Pro pricing with no AI credits, no usage meters and no per-feature add-ons
- Light footprint, around 180 MB idle against roughly 900 MB for Postman, with immediate startup
- Compliance material ready for a security review: SOC 2 Type II, SAML SSO, RBAC, audit logs, DPA and Standard Contractual Clauses
- Secrets stay in an OS-keychain vault and never leave in an export or a cloud sync
Cons
- No mobile app at all: neither the App Store nor Google Play appears anywhere on the site
- The AI test generator is locked behind the Pro plan and an organisation-level activation of AI features
- The advertised 9 USD per user is the annual rate; month-to-month billing costs 12 USD per user
- No hosting country or region is published for synced data, and no opt-out from model training is documented
- The contact page redirects to BrowserStack's own form, and no dedicated legal email address is published
- Local projects are never backed up by the vendor, so an accidental deletion is unrecoverable
- Legal documents lag the product: the EULA still describes Free, Lite, Basic and Professional plans, and the comparison table calls the tool closed source while the acquisition release praised its open-source roots
Pricing & Plans
Requestly offers a permanent free plan at 0 USD per month, described as free forever, covering unlimited collections, environments and API tests for up to 10 collaborators. The lowest paid entry point is the Pro plan at 12 USD per user per month billed monthly, falling to 9 USD per user per month when billed annually. Payments are processed through Stripe; invoicing and volume pricing above 50 licences are available on request. No time-limited free trial is advertised.
- API Client
- unlimited collections
- unlimited environments
- unlimited API tests
- Git-based collaboration
- unlimited local projects
- 3 team projects
- 10 team collaborators
- everything in Free plus unlimited projects
- unlimited collaborators
- unlimited collection runs
- unlimited script packages
- AI-powered API testing
- test reports
- AWS Secrets Manager integration
- the SOC 2 report
- Volume pricing above 50 licences
- quoted by the sales team
- Self-hosted deployments
- pilots and procurement handled through sales
- with no published price
- HTTP Rules priced separately
- on the app.requestly.io pricing page
Data, GDPR & hosting
A consolidated view of how Requestly handles your data.
GDPR overview
GDPR is addressed explicitly, and in concrete terms. BrowserStack names Ireland as its main establishment in the European Union and the Irish Data Protection Commissioner as its lead supervisory authority. An Article 27 representative is designated by name: BrowserStack Limited, 8th Floor, Block E, Iveagh Court, Harcourt Road, Dublin 2, Ireland, contactable at compliance@browserstack.com. Standard Contractual Clauses are published as a downloadable PDF, and a Data Processing Agreement is deemed incorporated into the terms wherever one is legally required. A list of subprocessors is public. Users in the EEA are offered access, rectification, portability, erasure, restriction and objection rights, exercised through a dedicated data request form or in writing to contact@requestly.io. No Data Protection Officer is named anywhere on the site.
Who owns the data?
BrowserStack, Inc. owns the software itself: the interfaces, algorithms, know-how and every intellectual property right attached to the service. You keep ownership of Your Content, the material you submit, but you grant the vendor a non-exclusive, worldwide, royalty-free right to use, copy, store, transmit, modify and display it, strictly to the extent needed to provide the service. Feedback is treated far more broadly: any suggestion you send is licensed perpetually, irrevocably and sub-licensably. The privacy policy states that Requestly does not sell personal data and shares it only with the subprocessors it publishes. In a local project, collections stay as JSON files on your own machine and are never synced.
Reuse rights
Your own material comes back out freely: collections, environments and requests all export in one step, and a local project is simply a folder of plain JSON files you can version, copy, diff and share like any other source file. Vault secrets stay encrypted in the operating-system keychain and never appear in an export. The restrictions in the terms target the product rather than your data. You may not resell, rent, lend, lease or sub-license the service, embed it in a product delivered to a third party, decompile it or copy its interface, and you must install it only from official channels. One clause is easy to overlook: using Requestly in automated testing, CI pipelines or any other form of automation requires the vendor's prior approval, requested by email.
Data retention & training
Hosting summary
Requestly publishes no hosting country and no hosting region for customer data, which is a notable gap for a product marketed at security reviews. What it does document is where data can sit. In a local project, collections and environments are files on your own machine and nothing is synchronised; Vault secrets are encrypted through the operating-system keychain and never leave in a cloud sync. Team projects add optional real-time cloud sync, and a self-hosted deployment on your own infrastructure is offered through sales. At group level, BrowserStack names Ireland as its main European establishment, with the Irish Data Protection Commissioner as lead supervisory authority, and lists affiliates in the United States, Ireland and India. Cross-border transfers are covered by Standard Contractual Clauses published as a PDF, and the list of subprocessors is public. The marketing site itself is served through Fastly on an anycast address, which tells you nothing about where customer data is stored.
Things to keep in mind
Risks and trade-offs to weigh before adopting Requestly.
- An API client sees your staging tokens, production headers and customer payloads: every saved request should be treated as a credential store
- The SharedList feature publishes shared rules at a public URL, so anyone holding the link can read them
- Chrome extension storage keeps content unencrypted inside the browser, and the terms place that risk squarely on you
- Total vendor liability is capped at 100 USD by the terms, whatever the incident
- Local projects are never backed up, and deletions in a cloud project are recoverable for only seven days
- AI-generated tests are written from one observed response rather than a specification: they can pass for the wrong reason while looking reassuring
- Leaning on generated assertions over time can quietly erode a team's own grasp of its API contracts
Setup & Integrations
Technical difficulty
Low for a first request, moderate for a team rollout. The desktop app installs from a downloaded binary, a .dmg, .exe or .AppImage, and needs no account to start; the vendor claims a working setup in under two minutes, helped by one-click imports from Postman. Beyond that, the tool assumes you know HTTP, environment variables and enough JavaScript to write assertions. The demanding parts come later: Git synchronisation, the CLI inside a CI pipeline, SAML SSO with Okta or Microsoft Entra ID, connecting a secret manager, and certificate setup for system-wide HTTPS interception.
Deployment
Integrations
Behind Requestly
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Requestly.
Frequently asked questions
Who is behind Requestly?
Is there a free plan, and what does it include?
How much does the paid plan cost?
Which platforms does it run on?
What exactly does the AI do?
Is my data used to train AI models?
Can I bring my Postman collections across?
Do my collections end up in someone else's cloud?
What happens to something I delete by mistake?
Is there a minimum age?
Should you pick Requestly?
Requestly is a focused tool with a clear argument. Where most API clients ask you to keep your work in their cloud, it keeps collections as plain JSON in your own Git repository, versioned and reviewed like code, with cloud sync as an option rather than a condition. That single decision explains most of the product: the local projects, the vault that leaves only a reference behind, the self-hosted deployment, the flat price with no usage meters. For an engineering team that has grown uneasy about where its staging tokens and production headers actually live, this is a serious answer.
The AI is real but modest, and honestly framed. The Test Authoring Agent writes post-response tests from an instruction in plain English, grounded in a response the tool has actually seen, and hands back editable JavaScript. It is a time-saver on assertion boilerplate, not an autonomous tester, and it sits behind the Pro plan.
The gaps are worth naming. Nowhere does the site say in which country or region synced data is hosted, which is an odd omission for a product that markets itself to security reviewers. No opt-out from model training is documented, and the reassuring 'no AI training on your data' line lives on a comparison page rather than in the privacy policy. Legal documents have not kept pace either: the EULA still lists a plan structure that no longer exists, and the site's own table calls the tool closed source while the 2025 acquisition release celebrated its open-source roots.
Since May 2025 the product has been backed by BrowserStack, which brings resources and durability. For backend, frontend, QA and support engineers who want a light client and control over their data, it is a credible Postman alternative. Buyers with strict data-residency needs should ask the vendor.
- Choosing a selection results in a full page refresh.
- Opens in a new window.