🔑 Authentication
Login
Register
🌐 REST API Testing
Item Management
Quick Actions
💬 WebSocket Chat
Connection
Disconnected
Chat
⚡ JSON-RPC Calculator
Calculator Operations
Quick Tests
📁 File Upload & Forms
File Upload
📁 Click to select files or drag and drop here
Form Submission
🤖 AI Chatbot Interface
Test different content types and messages with our AI chatbot
Quick Tests
AI Chat
🗜️ Compression Testing
The origin supports Brotli (br), gzip, and deflate on all non-streaming endpoints.
Streaming paths (/api/sse/*, /api/ndjson/*, /ws/*) are never buffered or compressed.
Note: browsers control Accept-Encoding automatically — use the curl commands below to force a specific encoding and inspect raw Content-Encoding response headers.
Quick Fetch Test
Browser sends Accept-Encoding: br, gzip, deflate automatically and transparently decodes the response. The Negotiated field below shows what the server actually used.
curl Commands
Copy these to observe raw Content-Encoding headers. The brotli -d command decodes the binary body.
curl -sv -H "Accept-Encoding: br" "https://qaaifwtest1.konaqa.com/mcp/health" 2>&1 | grep "Content-Encoding"
curl -s -H "Accept-Encoding: gzip" -H "Content-Type: application/json" \
-d '{"message":"hello"}' "https://qaaifwtest1.konaqa.com/api/aichat" | gunzip
curl -sv "https://qaaifwtest1.konaqa.com/api/aichat" \
-H "Content-Type: application/json" -d '{"message":"hello"}' 2>&1 | grep "Content-Encoding"
curl -sN -H "Accept-Encoding: br" "https://qaaifwtest1.konaqa.com/api/sse/pii?type=ssn"
curl -sN -H "Accept-Encoding: br" "https://qaaifwtest1.konaqa.com/api/ndjson/pii?type=all"
curl -s -H "Accept-Encoding: br" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
"https://qaaifwtest1.konaqa.com/mcp" > /tmp/mcp.br && \
wc -c /tmp/mcp.br && \
brotli -d /tmp/mcp.br -o /tmp/mcp.json && \
wc -c /tmp/mcp.json
🔐 OWASP API Test Endpoints
122 endpoints across 16 business domains at /api/v1/*. Designed to exercise all OWASP API Security Top 10 (2023/2024) risk categories and Akamai Unified Asset Inventory & Discovery traffic patterns.
OWASP API Top 10 Coverage
| Risk | Key Endpoints |
|---|---|
| API1 Broken Object Level Auth | /users/{id}, /orders/{id}, /payments/{id}, /accounts/{id} |
| API2 Broken Authentication | /auth/token, /auth/apikeys, /auth/mfa/* |
| API3 Broken Object Property Level | /users/{id}/profile, /users/{id}/roles, /config |
| API4 Unrestricted Resource Consumption | /documents (upload), /reports/generate, /analytics/export |
| API5 Broken Function Level Auth | /admin/*, /internal/*, /config/features/{id} |
| API6 Unrestricted Sensitive Business Flows | /cart/checkout, /checkout/guest, /checkout/payment-intent, /checkout/confirm, /checkout/{sessionId}, /checkout/{sessionId}/abandon, /accounts/transfer, /payments/refund |
| API7 Server Side Request Forgery | /integrations/fetch |
| API8 Security Misconfiguration | /debug/env, /internal/config-dump, /debug/threads |
| API9 Improper Inventory Management | /internal/* shadow endpoints, /debug/* |
| API10 Unsafe Consumption of APIs | /integrations/slack/notify, /integrations/crm/sync, /integrations/sso/callback |
Domain Summary (16 domains, 122 endpoints)
| Domain | Base Path | # | OWASP Risk |
|---|---|---|---|
| Users | /api/v1/users | 12 | API1, API3 |
| Auth | /api/v1/auth | 9 | API2 |
| Accounts | /api/v1/accounts | 5 | API1, API6 |
| Payments | /api/v1/payments | 4 | API1, API6 |
| Orders & Cart | /api/v1/orders, /api/v1/cart | 10 | API1, API6 |
| Checkout | /api/v1/checkout | 5 | API6 |
| Products | /api/v1/products, /api/v1/categories | 7 | AID Discovery |
| Notifications & Webhooks | /api/v1/notifications, /api/v1/webhooks | 9 | API4 |
| Reports & Analytics | /api/v1/reports, /api/v1/analytics | 7 | API4 |
| Documents | /api/v1/documents, /api/v1/export | 8 | API4 |
| Search | /api/v1/search, /api/v1/suggest | 5 | AID Discovery |
| Admin | /api/v1/admin, /api/v1/config | 9 | API5 |
| Internal / Shadow | /api/v1/internal, /api/v1/debug, /api/v1/health | 10 | API8, API9 |
| Integrations | /api/v1/integrations | 4 | API7, API10 |
| PII | /api/v1/pii | 8 | FAI PII targets |
| SOAP / MCP protocol | /api/v1/soap, /api/v1/mcp | 10 | AID Protocol |
curl https://qaaifwtest1.konaqa.com/api/v1/users
·
curl https://qaaifwtest1.konaqa.com/api/v1/pii/users/1
·
curl https://qaaifwtest1.konaqa.com/api/v1/debug/env
📺 Real-time & Streaming
Dedicated pages for each streaming protocol — open each in a new tab to run them side by side.
STOMP Chat
Full STOMP 1.2 over WebSocket with JWT auth. Endpoint: /ws/chat-native. AI responses contain PII for WAF response-body testing. Click Get Token then Connect.
Raw JSON WebSocket
Raw Jakarta @ServerEndpoint at /ws/chat-raw. First message must be {"type":"auth","token":"..."}. No STOMP framing.
SSE / NDJSON Tester
Server-Sent Events (/api/sse/chat, /api/sse/pii) and NDJSON streaming (/api/ndjson/chat, /api/ndjson/pii). Includes Akamai FAI config reference.
Protocol Comparison
Side-by-side view of STOMP vs raw JSON WebSocket frames — useful for comparing how each protocol carries the same message through Akamai.
Open Comparison ↗Streaming AI Chat
Chunked HTTP streaming demo at /api/aichat/streaming and SSE-mode enhanced chat at /api/aichat/enhanced?stream=true.
Compression Tester
Test Brotli, gzip, and identity encoding across endpoints. Browser auto-negotiates Accept-Encoding — use the built-in curl commands to force br and inspect raw Content-Encoding headers.
MCP Swagger UI
Interactive API docs for all 50 MCP tools across math, string, PII, security, and system categories. Test tool calls directly from the browser.
Open Swagger UI ↗🧠 MCP Server (Model Context Protocol)
Streamable HTTP transport — 50 tools across math, string, PII, security, and system categories. Version-pinned endpoints for WAF protocol inspection testing.
Quick Actions
Endpoint
🔒 Protected Resources
User Profile
Protected Actions
These endpoints require authentication. Login first to access them.