Dummy REST API

Ready-made endpoints for real client testing.

Spin up fake but behaviorally real REST data — auth tokens, CRUD mutations, and proper status codes — without standing up a backend.

Open API docs Run with Docker

What this is

A practice backend that mutates like the real thing.

Dummy REST API is an in-memory fake service for frontend and mobile developers. Requests create, update, and delete records for the life of the process — not a frozen fixture file — so your loading states, error handling, and auth flows get exercised end to end.

Realistic JSON

Seeded users, products, posts, todos, and carts return shaped payloads with pagination (total, skip, limit) and searchable list filters.

Full HTTP verbs

GET, POST, PUT, PATCH, and DELETE each return the status codes and bodies you would expect from a production-style API.

Auth you can wire up

/api/register and /api/login issue JWTs on success and 400 responses when fields are missing — enough to build login screens and error states against a live contract.

OpenAPI included

Browse interactive docs at /api/docs, or pull the machine-readable spec from /api/openapi.yaml.

Endpoints

Resources ready on day one.

Every collection supports list, read, create, replace, patch, and delete. Lists accept limit, skip, and where useful q, userId, category, or completed.

Resource Path Notes

Users /api/users Passwords hashed; never returned in responses

Products /api/products Filter with ?category= or ?q=

Posts /api/posts Includes tags, reactions, and view counts

Todos /api/todos Filter with ?completed=true|false

Carts /api/carts Line items with totals and quantities

Authentication

POST /api/register
{ "email", "password", "username" } → 201 + token

POST /api/login
{ "email"|"username", "password" } → 200 + token
missing fields / bad credentials → 400

GET /api/me
Authorization: Bearer <token> → current user

Sample login: emily.johnson@example.com / emilyspass

Security

Hardened enough to put on the public internet.

The service is meant for testing, but writes and resets are gated so strangers cannot silently trash or flood your instance.

X-API-Key required for resource POST/PUT/PATCH/DELETE
X-Reset-Token required for POST /api/reset
Prototype-pollution keys rejected; request bodies allowlisted and length-capped
Helmet headers, rate limits, bcrypt password hashing, strict JWT
Production refuses to boot without strong JWT_SECRET, RESET_TOKEN, and WRITE_API_KEY

curl -X POST https://your-host/api/products \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: YOUR_WRITE_API_KEY' \
  -d '{"title":"Test Gadget","price":42.5}'

Quick start

One compose file. Live API in seconds.

Copy .env.example to .env, set secrets, then bring the container up. The process listens on port 3000 by default.

cp .env.example .env
# set JWT_SECRET, RESET_TOKEN, WRITE_API_KEY

docker compose up --build -d

# health
curl http://localhost:3000/api/health

# interactive OpenAPI
open http://localhost:3000/api/docs

Try the docs JSON overview