.http test files. This is useful for frontend development, integration testing, and working offline without a live backend.
Basic Usage
How It Works
hitspec inspects the requests defined in your.http files and creates one route
per request, matched by method and path (path variables like
/users/{{id}} become wildcards that match any value). When an incoming request
matches a route, the server builds the response from, in order of precedence:
- A
>>>mockblock — if present, its content is returned verbatim as the response body. - Assertions — otherwise the body is inferred from the request’s assertions.
expect status <code> (default
200) and the Content-Type is application/json.
Custom Mock Responses
Add a>>>mock block to define the exact response body the server should return.
This is the most direct way to mock a response — including shapes that assertions
can’t express, like arrays:
/users/1 returns the >>>mock body verbatim with status 200.
The mock body is returned verbatim —
{{variable}} placeholders are not
interpolated. The block ends at the first line that begins with <<<, so the
body can contain >>>/<<< mid-line (for example inside a JSON string).Inferring the Response from Assertions
If a request has no>>>mock block, the server builds the body from its assertions:
expect body.<field> == <value>assertions are assembled into a JSON object of those fields.expect body == <value>returns that value verbatim as the body.- With no body assertions, the server returns
{"status": "ok"}.
/products/1 matches this route and returns:
Flags
Network Access
The mock server listens on127.0.0.1, so it is reachable only from your own machine. To reach it from another machine, a phone on your network, or a container, bind all interfaces:
hitspec mock prints the error and exits non-zero instead of reporting a server that is not running.
Methods, HEAD and CORS
- A path that exists but not for the request’s method gets
405 Method Not Allowedwith anAllowheader listing the methods it does have. Unknown paths still get404. HEADis answered from theGETroute of the same path (status and headers, no body).- With
--cors, every response carriesAccess-Control-Allow-Origin: *and friends, andOPTIONSpreflights are answered with204. CORS is off by default.
Adding Artificial Delay
Simulate network latency with the--delay flag: