Send GET/POST/PUT/DELETE with custom headers and body, and inspect the response, status and timing.
Query parameters are appended to the URL.
Requests run from our server (no CORS limits). Redirects are shown but not followed; internal/private hosts are blocked.