prawel.pl
Menu
My work

Developer tool · Visual Studio Code

Visual REST Client

A graphical editor and secure, cookie-aware HTTP client for .rest and .http files, built directly into VS Code.

  • TypeScript
  • VS Code
  • HTTP
  • OAuth 2.0
Open in VS Code Marketplace
Visual REST Client overview with request sidebar, URL, headers, and editor tabs

The product

Built around the job.

Visual REST Client gives REST Client-compatible .rest and .http files a focused graphical interface without taking them out of version control. Developers can organize requests, edit headers and JSON bodies, resolve file, environment, and runtime variables, configure authentication, maintain cookie-based sessions, send requests, and inspect structured responses inside VS Code. Source-aware editing preserves the portable text format while workspace-isolated secrets, memory-only cookie jars, redacted exports, production confirmations, and bounded transport defaults make daily API work safer.

Role
Product design & engineering
Release
2026
Status
Ongoing

Problem & decisions

The difficult part is the behavior.

Graphical API clients are convenient, but they often pull requests out of source control or hide how authentication, variables, and redirects are resolved.

  1. 01

    Preserve the source format

    The interface edits REST Client-compatible .rest and .http files, keeping the portable text file as the source of truth.

  2. 02

    Isolate credentials and sessions

    Secrets and OAuth tokens use VS Code Secret Storage, while response cookies stay in memory and are separated by REST file and active environment.

  3. 03

    Make transport visible

    Resolved requests, redirects, timing, headers, response limits, and production confirmations expose what the client actually sent.

  • REST Client compatible
  • OAuth 2.0 + PKCE
  • MIT licensed

Privacy by design

Your data stays yours.

No telemetry, tracking, or advertising. Workspace data stays local, secrets use VS Code Secret Storage, and cookie sessions remain in memory.

Read the full privacy details

Visual REST Client does not include analytics, telemetry, tracking, or advertising.

Local-first operation

The extension runs inside your VS Code environment. Request files, editor state, ordinary environment values, and response history remain local to the relevant workspace.

Secrets

Values explicitly marked as secrets and OAuth tokens are stored with VS Code Secret Storage and isolated by workspace, REST file, environment, and profile.

Cookie sessions

Cookies returned by APIs are kept in memory and reused only for matching URLs in the same REST file and active environment. Cookie jars are not persisted and are cleared when the editor closes or the extension reloads.

Network requests

Network activity occurs only when you initiate an HTTP request or OAuth flow. Data is sent to the endpoints you configure; it is never sent to prawel.pl.

Product tour

Open any screenshot to view the original at full size.

Visual REST Client overview with request sidebar, URL, headers, and editor tabs A complete request workspace Visual REST Client JSON request body editor with structured fields Edit JSON visually Visual REST Client variables panel with file, environment, and runtime values Layer portable and local variables Visual REST Client response panel with formatted JSON body and request metrics Inspect formatted responses Visual REST Client response preview displayed as an expandable JSON tree Explore JSON as a tree Visual REST Client response headers table Review response headers Visual REST Client Basic Auth editor using separate username and password variables Keep Basic Auth values separate Visual REST Client reusable OAuth 2.0 profile configuration Configure reusable OAuth profiles

Capabilities

What it handles.

Each capability earns its place by removing effort, reducing ambiguity, or making the product safer to rely on.

  • Visual editing for .rest and .http requests while preserving the source format

  • Searchable request sidebar with collections, filters, reordering, and duplication

  • Built-in sender with automatic cookie reuse, cancellation, redirects, compression, and response limits

  • Formatted body, JSON tree, headers, sent-request preview, and response history

  • File, environment, secret, and runtime variables with response extraction rules

  • Bearer, split-variable Basic Auth, and reusable OAuth 2.0 profiles with PKCE

  • Postman Collection v2.0/v2.1 import and resolved cURL export

  • Workspace-isolated secret storage and confirmations for production environments

Changelog

What changed.

Product updates, fixes, and behavior changes, listed by version.

  1. 0.2.2

    • Added a GraphQL body editor with separate query and JSON variables, query formatting, syntax diagnostics, operation selection, and drafts retained across request switches.
    • Enabled GraphQL queries and mutations over POST using existing authentication, environments, cookies, request history, and redacted cURL export, with JSON-safe variable interpolation.
    • Added REST Client GraphQL-format compatibility: opening preserves the source, while visual edits save portable JSON request bodies.
    • Added expandable GraphQL error details with messages, paths, and locations alongside the HTTP status and partial response data.
    • Preserved GraphQL queries and variables when importing Postman collections.

  2. 0.2.1

    • Added an extensible opaque-postamble parser for httpyac scripts and assertions, IntelliJ-style response handlers, and other external .rest tooling.
    • Added standards-based, memory-only cookie jars that reuse response cookies during redirects and later requests while isolating sessions by REST file and active environment.
    • Excluded external post-response syntax from displayed and transmitted request bodies while preserving it byte-for-byte during edits.
    • Kept inline variables, malformed script blocks, and unrecognized body text in the modeled request body.

  3. 0.2.0

    • Added case-insensitive response search across Body, Preview, Headers, and Request, with highlighting, counts, wraparound navigation, and Ctrl/Cmd+F focus.
    • Expanded collapsed JSON parents and revealed matches inside long strings while retaining path context.
    • Added automatic root-level .env environment loading with workspace-storage fallback and import/export migration controls.
    • Masked environment values by default with accessible reveal controls independent of Secret Storage locking.
    • Made dotenv environments read-only, workspace-root aware, and protected multi-root workspaces and plaintext migrations with explicit safeguards.
    • Aligned the primary request controls to a consistent height.

  4. 0.1.9

    • Added reusable OAuth 2.0 profiles for Authorization Code with PKCE and Client Credentials.
    • Added VS Code callback handling, secure token persistence, automatic refresh, environment-isolated sessions, and connection controls.
    • Added Bearer Token and split-variable HTTP Basic authentication with request-time encoding.
    • Added a default User-Agent for providers such as GitHub.
    • Made the Auth and Comments editors fill the available request pane.

  5. 0.1.8

    • Reissued the 0.1.7 release content so Marketplace clients refreshed the restored semantic colors and updated documentation.

  6. 0.1.7

    • Added cancellation, redirect handling, gzip/deflate/Brotli decoding, total timeouts, request and response limits, and per-file concurrency controls.
    • Added per-editor environment selection, encrypted secrets, runtime-variable clearing, production confirmations, and document-wide memory limits.
    • Added keyboard reordering, adjustable panes, responsive and reduced-motion behavior, stronger focus states, semantic labels, screenshots, CI, and reproducible packaging.
    • Moved request, response, pending, and history state to stable IDs; flushed visual edits before actions; and preserved source formatting and opaque blocks.
    • Blocked unresolved variables before network activity, redacted sensitive previews and cURL exports, and hardened cross-origin redirect handling.
    • Fixed environment races, stale request state, lost delayed edits, unsafe JSON element identifiers, and body framing for non-standard methods such as GET.
    • Fixed stuck sending states, made large JSON previews lazy, restored semantic colors across themes, and aligned collection names.

  7. 0.1.6

    • Added REST Client-style file variables, request interpolation, named environments, and response-derived runtime extraction rules.
    • Added a Variables panel with precedence guidance, plus sidebar search, method filtering, response history, response export, resolved cURL copy, and a sent-request view.
    • Added keyboard shortcuts, VS Code Codicons, Postman collection-variable import, and source-preserving request-time variable resolution.
    • Moved environment creation and deletion to native VS Code controls and aligned the webview with configured editor and UI fonts.
    • Added automated compilation, linting, tests, packaging checks, and standardized local build scripts.
    • Fixed the compile/build path, environment creation, history timestamps, generated-script escaping, and manifest version alignment.

Product support

Something not behaving?

Include the product version, operating system version, shortest steps to reproduce, and any exact error text. Redact tokens, private URLs, calendar content, and other personal data.

Email support