curl API testing: repeat 100×, load & timing · Knowledge & Memory Center

Linux/Networking/curl API testing: repeat 100×, load & timing

ReferenceUpdated 3 weeks ago · used 1× this month

curl API testing: repeat 100×, load & timing

Test REST APIs from the terminal: CRUD with JSON, auth (Bearer, Basic, API key, cookies, mTLS), timing breakdown with -w, calling an endpoint 100× sequentially or in parallel with status tallies and p50/p95/p99, rate-limit checks and CI assertions.

#curl #http #api-testing #load-testing

Core flags

Flag	Meaning
`-X METHOD`	HTTP method (GET default; POST implied by `-d`)
`-H "K: V"`	Add a header
`-d` / `--json`	Body (`--json` sets Content-Type + Accept, curl ≥ 7.82)
`-sS`	Silent but still show errors
`-i` / `-I`	Include response headers / HEAD only
`-v`	Verbose request/response
`-o FILE` / `-O`	Save body / use remote filename
`-w FORMAT`	Print metrics (status, timings)
`-f` / `--fail-with-body`	Non-zero exit on HTTP ≥ 400
`-L`	Follow redirects
`--max-time N`	Total timeout (seconds)
`--retry N --retry-all-errors`	Retry transient failures

CRUD requests

GET / POST / PUT / PATCH / DELETE

SHELL

1BASE=http://localhost:8080/api/v1

3curl -sS -G "$BASE/users" --data-urlencode "q=abebe kebede" -d page=0 -d size=20

4curl -sS -X POST "$BASE/users" -H "Content-Type: application/json" \

5 -d '{"name":"Alex","email":"alex@example.com"}'

6curl -sS --json '{"name":"Alex"}' "$BASE/users" # JSON shortcut

7curl -sS --json @payload.json "$BASE/users" # body from file

8curl -sS -X PUT "$BASE/users/42" --json '{"name":"New"}'

9curl -sS -X PATCH "$BASE/users/42" --json '{"email":"n@x.com"}'

10curl -sS -X DELETE "$BASE/users/42" -w "%{http_code}\n"

11curl -sS "$BASE/users/42" | jq . # pretty-print

Auth & headers

Tokens, keys, cookies, mTLS

SHELL

1curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/me"

2curl -sS -u user:pass "$BASE/secure"

3curl -sS -H "X-API-Key: $API_KEY" "$BASE/data"

5# login -> capture token -> reuse

6TOKEN=$(curl -sS --json '{"username":"alex","password":"secret"}' "$BASE/auth/login" | jq -r .accessToken)

8# cookie session

9curl -sS -c cookies.txt --json '{"u":"a","p":"b"}' "$BASE/login"

10curl -sS -b cookies.txt "$BASE/profile"

12# correlation + idempotency (payment APIs)

13curl -sS -H "X-Request-Id: $(uuidgen)" -H "Idempotency-Key: $(uuidgen)" --json @txn.json "$BASE/payments"

15# mTLS

16curl -sS --cert client.crt --key client.key --cacert ca.crt https://api.internal/health

Keep secrets in env vars — passwords on the command line show up in ps and shell history. Never use -k against production.

Files & forms

multipart, form, download

SHELL

1curl -sS -F "file=@./report.pdf;type=application/pdf" -F "desc=Q3" "$BASE/files"

2curl -sS -d "username=alex&role=admin" "$BASE/form"

3curl -sS -L -O -C - https://example.com/big.iso # download + resume

Timing & debugging

Phases: DNS → TCP connect → TLS → TTFB (server work) → total. A high TTFB points at the server, not the network.

-w metrics

SHELL

1curl -s -o /dev/null -w "%{http_code}\n" "$BASE/health"

3curl -s -o /dev/null -w 'dns:%{time_namelookup}s connect:%{time_connect}s tls:%{time_appconnect}s ttfb:%{time_starttransfer}s total:%{time_total}s size:%{size_download}B status:%{http_code}\n' "$BASE/users"

5curl -s -o /dev/null -w '%{json}' "$BASE/users" | jq '{code:.http_code,total:.time_total}'

6curl -sSI "$BASE/users" # headers only

7curl -v "$BASE/users" 2>&1 | grep -E '^[<>]' # wire view

8curl -sS --resolve api.example.com:443:10.0.0.12 https://api.example.com/health # hit one node

Call the API 100× — sequential

Simple loop, then count status codes. Tested: prints 100 200.

for loop + tally

SHELL

1URL="http://localhost:8080/api/v1/health"

2for i in $(seq 1 100); do

3 curl -s -o /dev/null -w "%{http_code}\n" "$URL"

4done | sort | uniq -c

Call the API 100× — parallel

xargs -P runs 10 at a time; curl ≥ 7.66 can also parallelise natively with URL globbing.

xargs -P / curl --parallel

SHELL

1# 10 concurrent, status tally + avg/max

2seq 100 | xargs -P 10 -I{} curl -s -o /dev/null -w "%{http_code} %{time_total}\n" "$URL" \

3 | awk '{c[$1]++; t+=$2; if($2>m)m=$2} END{for(k in c) print "status",k,c[k]; printf "avg=%.4fs max=%.4fs n=%d\n", t/NR, m, NR}'

5# native parallel + globbing

6curl -s --parallel --parallel-max 10 -o /dev/null -w "%{http_code}\n" "$URL?i=[1-100]" | sort | uniq -c

POST 100× with unique payloads

Unique body + idempotency key per call

SHELL

1for i in $(seq 1 100); do

2 curl -s -o /dev/null -w "$i %{http_code} %{time_total}\n" \

3 -H "Authorization: Bearer $TOKEN" \

4 -H "Idempotency-Key: $(uuidgen)" \

5 --json "{\"ref\":\"TXN-$i\",\"amount\":$((RANDOM % 1000 + 1))}" \

6 "$BASE/payments"

7done | tee results.log

Latency percentiles

p50 / p95 / p99

SHELL

1for i in $(seq 1 100); do curl -s -o /dev/null -w "%{time_total}\n" "$URL"; done \

2 | sort -n | awk '{a[NR]=$1} END{printf "p50=%.3fs p95=%.3fs p99=%.3fs\n", a[int(NR*.5)], a[int(NR*.95)], a[int(NR*.99)]}'

Reusable hammer function

Drop into ~/.bashrc. Usage: hammer <url> [count=100] [concurrency=10] [extra curl args…]

hammer()

SHELL

1hammer() {

2 local url=$1 n=${2:-100} p=${3:-10}; shift 3 2>/dev/null

3 seq "$n" | xargs -P "$p" -I{} curl -s -o /dev/null "$@" -w "%{http_code} %{time_total}\n" "$url" \

4 | sort -k2 -n | awk '{c[$1]++; t[NR]=$2; s+=$2}

5 END{for(k in c) printf "HTTP %s: %d\n",k,c[k];

6 printf "n=%d avg=%.3fs p50=%.3fs p95=%.3fs max=%.3fs\n",NR,s/NR,t[int(NR*.5)],t[int(NR*.95)],t[NR]}'

8# hammer http://localhost:8080/health 500 50 -H "Authorization: Bearer $TOKEN"

Rate limits & retries

429 checks, pacing, retry

SHELL

1for i in $(seq 1 100); do curl -s -o /dev/null -w "%{http_code} " "$URL"; done; echo # expect 429s

2for i in $(seq 1 100); do curl -s -o /dev/null -w "%{http_code}\n" "$URL"; sleep 0.2; done # ~5 req/s

3curl -sS --retry 5 --retry-delay 1 --retry-all-errors --max-time 10 "$URL"

Real load testing

curl loops are for smoke/regression checks. For accurate RPS and latency histograms use a dedicated tool.

hey / ab / wrk

SHELL

1hey -n 1000 -c 50 -H "Authorization: Bearer $TOKEN" "$URL"

2ab -n 1000 -c 50 "$URL"

3wrk -t4 -c100 -d30s "$URL"

Only load-test systems you own or have permission to test.

CI assertions

Health, JSON asserts, readiness, .curlrc

SHELL

1code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$BASE/health")

2[ "$code" = "200" ] || { echo "Health check failed: $code"; exit 1; }

4curl -sSf "$BASE/users/42" | jq -e '.email == "alex@example.com"' >/dev/null && echo PASS

6until curl -sf -o /dev/null "$BASE/actuator/health"; do echo waiting...; sleep 2; done

8# one source of truth for defaults

9cat > api.curlrc <<'EOF'

10silent

11show-error

12max-time = 10

13header = "Accept: application/json"

14EOF

15curl -K api.curlrc "$BASE/users"

Other concepts

STEP 1 OF 8

Postman: Import → paste a curl command (Code → cURL exports back)

Status codes

Code	Meaning	Typical cause
200 / 201 / 204	OK / Created / No Content	Success
400 / 422	Bad Request / Unprocessable	Validation, bad JSON
401 / 403	Unauthorized / Forbidden	Missing/expired token / no permission
404 / 405	Not Found / Method Not Allowed	Wrong path / wrong verb
409	Conflict	Duplicate / version conflict
429	Too Many Requests	Rate limit — check Retry-After
500 / 502 / 503 / 504	Server / Bad Gateway / Unavailable / Timeout	Crash / upstream down / overloaded / slow upstream