How to Test the Salesforce REST API in Your Browser
Test Salesforce REST API calls without Postman: session handling, the endpoints admins actually use, and how to read the response safely.
Updated 2026-09-09
Most admin API work is a handful of GET requests: describe an object, read the limits, pull a record. Setting up a full API client for that is more work than the question deserves.
This page covers the calls worth knowing and how to run them against your current session.
The endpoints admins use most
/services/data/- which API versions this org supports./services/data/v61.0/limits- every org limit and its remaining headroom./services/data/v61.0/sobjects/Account/describe- every field on an object, with types./services/data/v61.0/query?q=SELECT+Id+FROM+Account+LIMIT+1- a SOQL query over REST.
Authentication
Every call needs an OAuth access token in an Authorization header. In-browser explorers reuse your existing Salesforce session, which is why they are quicker than configuring a connected app for a one-off request.
Treat session IDs as credentials. Do not paste them into shared documents, screenshots, or third-party sites.
curl -H "Authorization: Bearer $ACCESS_TOKEN" \
"$INSTANCE_URL/services/data/v61.0/limits"Doing it inside Salesforce
TurboKit's REST API explorer runs these calls against the org you are logged into, handles the session, and formats the JSON response - no connected app, no token copying.
Rules of the road
- Pin an API version in the URL;
v61.0behaves differently from the latest version. - Every call consumes daily API quota - loops in a browser tool count too.
- Test writes in a sandbox. A PATCH against production is not undoable from the response pane.
Frequently asked questions
- Do I need a connected app to call the Salesforce REST API?
- For an external client, yes - you need OAuth credentials. Tools running inside an authenticated Salesforce session can reuse that session instead.
- Which API version should I use?
- Pin a specific recent version rather than tracking the newest. Behaviour changes between versions, and a pinned version keeps integrations predictable.
- Why does my query return only 2,000 records?
- The REST Query resource pages results. Follow
nextRecordsUrlin the response to fetch the next batch, or use the Bulk API for large extracts.
More from the Admin How-To
- Change Sets vs Metadata API Deployments: Which to UseChange sets and Metadata API / CLI deployments solve the same problem differently. Here is when each one is the right choice, and what a change set genuinely cannot do.
- How to Check Field-Level Security in Salesforce FastCheck field-level security in Salesforce without clicking through Setup: where FLS lives, how it interacts with profiles and permission sets, and faster ways to read it.
- How to Check Salesforce Org LimitsCheck Salesforce org limits - API calls, data storage, file storage, and daily email - from Setup, the limits API, and the browser, before you hit them.
- How to Compare Two Profiles in SalesforceCompare two Salesforce profiles field by field: the native Setup route, the permission types worth diffing, and how to keep the result auditable.
- How to Create and Deploy a Salesforce Change SetStep by step: create an outbound change set, upload it, and deploy it as an inbound change set - plus the deployment connection you need between orgs before any of it works.
- How to Create Multiple Custom Fields in Salesforce QuicklyCreate custom fields in Salesforce in bulk - the Setup wizard, metadata deployment, and in-browser field creation - plus the naming rules to settle first.