An API client next to the data it changes.
Mongrel treats API work as a first-class connection. Send HTTP, GraphQL, WebSocket, gRPC, SOAP, XML-RPC, and JSON-RPC with environments, OAuth PKCE, mTLS, and imports from cURL, Postman, Insomnia, OpenAPI, and WSDL.
Windows x64 and ARM64 · macOS Apple silicon · Linux x86-64
// One API workspace
Create an API Client the same way you create a database.
Connections → New Connection → API Client opens a workspace with projects, features, environments, and a request tree. Secrets stay in the OS keychain. Production environments require a reason before unsafe methods or authenticated sends.
// What ships
Protocols, auth, and imports that stay local.
HTTP, GraphQL, WebSocket, and gRPC
Send REST and custom HTTP methods, GraphQL operations with introspection, interactive WebSocket frames, and descriptor-backed gRPC unary plus streaming calls.
SOAP, XML-RPC, and JSON-RPC
First-class SOAP 1.1/1.2, XML-RPC, and JSON-RPC 2.0 requests compile to HTTP POST on the shared send path. The compiled HTTP is not stored on the request.
OAuth, SigV4, Digest, and mTLS
OAuth 2.0 client credentials, password, and Authorization Code + PKCE; AWS SigV4; HTTP Digest. Environments attach CA and client certificate secrets in the OS keychain.
OpenAPI and WSDL import
Import cURL, Postman collections and environments, Insomnia v4, OpenAPI 3, and WSDL 1.1 into editable requests. Secrets become placeholders and stay out of the profile.
GraphQL subscriptions
GraphQL subscriptions open over graphql-transport-ws or graphql-ws on the existing WebSocket path. Production environments still require a reason before send.
Keychain secrets
Tokens, client secrets, refresh tokens, and TLS PEMs live in the OS keychain. Exports, Connection Sync, and Copy as cURL strip credentials.
// FAQ
Frequently asked questions.
Which API protocols does Mongrel support?
Mongrel's API Client sends HTTP/REST (including custom RFC 9110 methods), GraphQL, WebSocket text and binary frames, gRPC unary plus server, client, and bidirectional streaming, SOAP 1.1/1.2, XML-RPC, and JSON-RPC 2.0.
Can I import Postman, OpenAPI, or WSDL?
Yes. The import modal parses cURL, Postman collections and environments, Insomnia v4, OpenAPI 3 JSON, and WSDL 1.1. Conflict resolution is per kind. Secrets are converted to placeholders and never stored in the profile.
Does Mongrel support OAuth Authorization Code with PKCE?
Yes. Authorize opens the system browser and listens on http://127.0.0.1:8765/callback, falling back through 8766–8774 if needed. PKCE S256 is required. Refresh tokens stay in the OS keychain; access tokens are never shown in the UI.
Are SOAP and XML-RPC just raw XML bodies?
No. SOAP, XML-RPC, and JSON-RPC are first-class request types that compile to HTTP POST when you send. The compiled HTTP is not written back onto the saved request.
Does the API Client support mutual TLS?
Yes, on HTTP-family requests. Each environment can verify certificates, attach a CA PEM, and attach a client certificate, key, and passphrase stored as keychain TLS secrets. gRPC mTLS is not available.
Related guides and comparisons
APIs, files, terminals, and databases together.
7-day trial. Windows, macOS, Linux. No credit card.