Guide
Replaying a recorded request: from a HAR file to curl or fetch
A HAR file, short for HTTP Archive, is a JSON recording of everything a browser did on the network: every request, every response, timings and bodies. It is what support teams ask for when a page misbehaves. It is also an excellent starting point for a script, because it captures exactly what worked in the browser. This page picks one request out of the recording and writes it as a command you can run.
What is inside a HAR file
The top-level object has a log with an entries list. Each entry holds a request (method, URL, headers, cookies and any posted data) and a response (status, headers, content). The page reads the requests and shows a numbered list with the method, the address without its scheme, and the status code, so you can find the call you care about. Large recordings can have thousands of entries; the list shows the first 500.
Which headers are removed
Browsers add headers that a script does not need. HTTP/2 pseudo-headers such as :authority and :path are not real headers and cannot be sent by curl. Host and Content-Length are set by the tool itself from the URL and the body. An optional switch also removes the sec-* family, pragma, cache-control, upgrade-insecure-requests and similar, which describe browser behaviour. You can drop the Cookie header as well, which is wise when sharing a command.
curl or fetch
The curl output starts with the URL and then adds -X for methods other than GET, a line for each header with -H, and –data-raw for the body, with single quotes escaped for a shell. When “Use –compressed” is on, the Accept-Encoding header is replaced by that flag, so curl asks for compressed data and decodes it. The fetch output is JavaScript with the method, a headers object and a body string, ready to paste into a script or a console.
Credentials and safety
Recorded requests nearly always carry cookies, bearer tokens or API keys. A command containing them can be used by anyone who has it. The page warns whenever the output includes a Cookie or Authorization header, and everything stays in your browser, in memory only; nothing is uploaded or saved. Remove credentials before pasting a command into a ticket or a chat, and replace them with placeholders.
A worked example
The Sample button loads a recording of two calls. The first is a POST to api.example.com/v1/orders with status 201, and the page lists it as number 1. With browser noise removed and compression on, the curl output has the URL, -X POST, –compressed, a content-type header, an authorization header and –data-raw with the body {“item”:“book”,“qty”:2}. The :authority and sec-fetch-mode headers are gone, and the accept-encoding header became the –compressed flag. The second call, a GET with a query string, produces a command without -X or a body.
Limits
Bodies are reproduced as the recorder stored them. Binary content, file uploads in multipart form and very large payloads may be missing or altered, and the page does not rebuild a multipart boundary. HAR files from different tools vary in detail, and entries without a request section are skipped. The command repeats a single request; it does not follow redirects, handle cookies between calls, or script a sequence. Use your own recordings and respect the terms of the services you call.
Related tools
- cURL to Fetch converts a command into code for several languages.
- HAR Analyzer summarises timings and sizes across a whole file.
- HTTP Headers to JSON parses a block of headers into an object.
- Cookies to JSON converts cookie files between formats.
Checked against the current version of the HAR to cURL on .